Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-09 21:45:25 +08:00
Code Packages Activity Actions
discourse/spec/lib/guardian
History
Exact
Osama Sayegh 17e4bb4109
 FIX: Reject DiscourseConnect SSO payloads when secret is blank (#40830) 
DiscourseConnect verified SSO payload signatures with whatever
`discourse_connect_secret` was configured, including an empty string, so
an instance with DiscourseConnect enabled but no secret set did not fail
safely.

`DiscourseConnectBase#parse` now fails when the effective secret is
blank, and `EnableSsoValidator` refuses to enable DiscourseConnect
unless a secret of at least 10 characters is set.
2026-06-12 15:17:16 +03:00
..
bookmark_guardian_spec.rb
flag_guardian_spec.rb
invite_guardian_spec.rb FIX: Reject DiscourseConnect SSO payloads when secret is blank (#40830) 2026-06-12 15:17:16 +03:00
localization_guardian_spec.rb FIX: Also check if user can see post or topic prior to letting them localize it (#36749) 2025-12-18 02:12:58 +08:00
post_guardian_spec.rb FIX: Hidden post excerpts can be returned by group activity serializers (#40217) 2026-05-21 15:28:41 +08:00
staff_action_log_guardian_spec.rb SECURITY: Restrict staff action logs visibility for moderators 2026-01-28 17:11:14 +00:00
tag_guardian_spec.rb FIX: Don't auto-remove chat members from logged_in_users group (#40543) 2026-06-03 18:15:32 +02:00
topic_guardian_spec.rb SECURITY: Require topic visibility for category group moderator actions 2026-05-19 00:26:04 +01:00
upload_guardian_spec.rb FIX: Enforce secure-upload ACL in AI bot prompt path (#39903) 2026-05-13 09:55:32 +08:00
user_guardian_spec.rb FIX: Reject DiscourseConnect SSO payloads when secret is blank (#40830) 2026-06-12 15:17:16 +03:00