Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-05 13:59:03 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-calendar/spec/lib
History
Exact
Chris Alberti c253fb0197
 SECURITY: Remove stale invitee access for users removed from invited groups on private events (#42187) 
## Summary

Correctly restrict private calendar event access to current group
members. The patch replaces stale invitee-row authorization with active
invited-group membership checks across event detail serialization,
attendance searches, RSVP mutations, and livestream chat metadata, and
prunes stale invitee records when a user is removed from a group.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1377

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-30 15:15:46 -05:00
..
discourse_calendar/livestream UX: improve livestream chat messaging (#41750) 2026-07-21 11:07:31 +10:00
discourse_post_event SECURITY: Remove stale invitee access for users removed from invited groups on private events (#42187) 2026-07-30 15:15:46 -05:00
calendar_custom_fields_validator_spec.rb FIX: Support uppercase and separators in event custom field names (#40995) 2026-06-24 17:02:32 +02:00
calendar_first_day_of_week_spec.rb DEV: Clean up scope resolution operators in plugins (#34979) 2025-09-30 14:36:34 +02:00
calendar_settings_validator_spec.rb
calendar_spec.rb
group_timezones_spec.rb
users_on_holiday_spec.rb