Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-04 10:39:43 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-calendar/app
History
Exact
Chris Alberti c253fb0197
 SECURITY: Remove stale invitee access for users removed from invited groups on private events (#42187) 
## Summary

Correctly restrict private calendar event access to current group
members. The patch replaces stale invitee-row authorization with active
invited-group membership checks across event detail serialization,
attendance searches, RSVP mutations, and livestream chat metadata, and
prunes stale invitee records when a user is removed from a group.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1377

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-30 15:15:46 -05:00
..
controllers FEATURE: render links to event topics as interactive cards (#40953) 2026-07-17 10:36:54 -04:00
models SECURITY: Remove stale invitee access for users removed from invited groups on private events (#42187) 2026-07-30 15:15:46 -05:00
serializers SECURITY: Remove stale invitee access for users removed from invited groups on private events (#42187) 2026-07-30 15:15:46 -05:00
services FEATURE: Promote Ideas & Events category types to permanent status (#42080) 2026-07-29 09:20:40 +10:00
views/discourse_post_event/events FIX: Preserve URI delimiters in ICS URL properties, removing TEXT escaping (#42107) 2026-07-28 14:53:16 -05:00