Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://gh.wpcy.net/https://github.com/discourse/discourse.git synced 2026-06-18 23:39:11 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-data-explorer
History
Exact
Bannon Tanner 44bac11628
SECURITY: Group report details expose raw Data Explorer SQL to non-admin group members (#40919) 
## Summary

Prevent the exposure of raw Data Explorer SQL to non-admin group members
when viewing report details. The sql attribute is now correctly gated to
administrators within the query details serializer.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1290
- Affected file:
https://github.com/discourse/discourse/blob/main/plugins/discourse-data-explorer/app/serializers/discourse_data_explorer/query_details_serializer.rb

---

🤖 Auto-generated from the patch diff via Patch Triage. Review carefully
before merging.

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-06-16 13:46:19 -05:00
..
admin/assets/javascripts/admin UX: Core foundation changes (#40847) 2026-06-12 16:38:46 -05:00
app SECURITY: Group report details expose raw Data Explorer SQL to non-admin group members (#40919) 2026-06-16 13:46:19 -05:00
assets UI: Update data explorer graphs to look similar to standard reports in the new dashboard (#40881) 2026-06-15 21:22:10 +08:00
config I18N: Update translations (#40823) 2026-06-12 16:19:35 +02:00
db/migrate DEV: Check & resolve sequence issues during db:check_structure_dump (#40118) 2026-05-18 15:23:41 +01:00
lib UX: Data explorer improvements (#40605) 2026-06-05 19:31:37 +08:00
spec SECURITY: Group report details expose raw Data Explorer SQL to non-admin group members (#40919) 2026-06-16 13:46:19 -05:00
test/javascripts UX: Data explorer improvements (#40605) 2026-06-05 19:31:37 +08:00
package.json DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00
plugin.rb DEV: Switch DE agent to use tools for structure and accuracy (#40315) 2026-06-03 22:08:44 +08:00
README.md
tsconfig.json DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00

README.md

Data Explorer Plugin

This plugin allows admins to run SQL queries against the live Discourse database, including parameterized queries and formatting for several common column types.

For more information, please see: https://meta.discourse.org/t/data-explorer-plugin/32566