mirror of
https://gh.wpcy.net/https://github.com/discourse/discourse.git
synced 2026-06-18 23:39:11 +08:00
5e6d53d3bb
## Summary
Current main still publishes topic timer reload events on /topic/<id>
without any MessageBus audience restriction. A focused request spec
against the real /message-bus/poll endpoint showed an anonymous client,
who cannot see a restricted-category topic, can subscribe from the
pre-timer message id and receive the timer-generated {reload_topic:
true} event. The payload is small, but it confirms the reported
restricted-topic existence/channel activity leak. Nearby code
demonstrates other topic MessageBus publishes are expected to merge
Topic#secure_audience_publish_messages, which the timer jobs do not do.
Patch-triage searches for the report id, GHSA terms, MessageBus/topic
timer/secure_audience/CloseTopic/OpenTopic keywords, and related
restricted-topic live-notification leaks did not find an exact
duplicate; inspected similar patches were different root
causes/components.
## Source
- Patch Triage: https://patch.discourse.org/patch-triage/1156
Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
|
||
|---|---|---|
| .. | ||
| activerecord_preventing_writes_spec.rb | ||
| api_keys_spec.rb | ||
| auto_reject_reviewable_users_spec.rb | ||
| blocked_hotlinked_media_spec.rb | ||
| category_tag_spec.rb | ||
| content_security_policy_spec.rb | ||
| discord_omniauth_spec.rb | ||
| discourse_cookie_store_spec.rb | ||
| email_outbound_spec.rb | ||
| email_style_spec.rb | ||
| facebook_omniauth_spec.rb | ||
| flags_spec.rb | ||
| github_omniauth_spec.rb | ||
| group_spec.rb | ||
| invalid_request_spec.rb | ||
| invite_only_registration_spec.rb | ||
| message_bus_spec.rb | ||
| multisite_cookies_spec.rb | ||
| multisite_spec.rb | ||
| rate_limiting_spec.rb | ||
| remote_theme_color_schemes_spec.rb | ||
| request_tracker_spec.rb | ||
| same_ip_spammers_spec.rb | ||
| secure_uploads_spec.rb | ||
| sendmail_spec.rb | ||
| smtp_spec.rb | ||
| spam_rules_spec.rb | ||
| tag_counts_spec.rb | ||
| topic_auto_close_spec.rb | ||
| topic_thumbnail_spec.rb | ||
| topic_timer_message_bus_spec.rb | ||
| twitter_omniauth_spec.rb | ||
| watched_words_spec.rb | ||
