Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-11 02:59:07 +08:00
Code Packages Activity Actions
discourse/plugins/chat/app/models
History
Exact
Chris Alberti e7d0b84326
 SECURITY: Scope thread-read reset to originating channel and restrict bulk trigger to c... (#42417) 
## Summary

A chat participant could enable threading in their own DM and trigger a
thread-read reset job that marked thread memberships as read across all
channels, including private DMs the attacker could not access. The patch
scopes the SQL update to the target channel and only enqueues the bulk
reset when threading is enabled on a category channel.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1531

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-08-10 09:54:37 -05:00
..
chat SECURITY: Scope thread-read reset to originating channel and restrict bulk trigger to c... (#42417) 2026-08-10 09:54:37 -05:00
concerns/chat DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00