Exact

Exact Union RegExp

Isaac Janzen ac2074474f SECURITY: Subscription contributors expose full user profile fields to anonymous viewers (#40891) ... ## Summary Correctly enforce profile visibility restrictions in the subscriptions contributors endpoint and user serializers. This prevents the exposure of sensitive profile fields—including bio, location, and website—to anonymous viewers when public profiles are disabled via site settings. The fix also hardens the user and user card serializers to omit profile details for unauthorized scopes as a defense-in-depth measure. ## Source - Patch Triage: https://patch.discourse.org/patch-triage/1286 Co-authored-by: discourse-patch-triage <272280883+discourse-patch-triage[bot]@users.noreply.github.com>		2026-06-15 10:24:06 -05:00
..
concerns	FEATURE: Prevent silenced users from liking and using reactions (#37040)	2026-01-13 13:59:57 +01:00
about_serializer_spec.rb
admin_detailed_user_serializer_spec.rb	SECURITY: AdminDetailedUserSerializer#latest_export leaking user exports	2026-01-28 17:11:14 +00:00
admin_plugin_serializer_spec.rb	DEV: Enable Rails/FilePath rubocop rule (#40097)	2026-05-19 19:07:54 +02:00
admin_user_action_serializer_spec.rb
admin_user_list_serializer_spec.rb	FIX: Staged user emails bypass moderator email visibility setting (#40411)	2026-05-29 19:26:17 -03:00
auth_provider_serializer_spec.rb	DEV: Add capability to pass an icon setting into auth provider registration (#34584)	2025-08-28 09:14:36 -05:00
basic_group_serializer_spec.rb
basic_group_user_serializer_spec.rb
basic_post_serializer_spec.rb	FEATURE: Serve localized content in the site's default locale when user's language is unsupported (#36160)	2025-11-21 17:19:04 +08:00
basic_reviewable_flagged_post_serializer_spec.rb
basic_reviewable_queued_post_serializer_spec.rb
basic_reviewable_serializer_spec.rb
basic_reviewable_user_serializer_spec.rb
basic_topic_serializer_spec.rb	FEATURE: Serve localized content in the site's default locale when user's language is unsupported (#36160)	2025-11-21 17:19:04 +08:00
basic_user_serializer_spec.rb	DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073)	2025-10-06 16:11:01 +02:00
category_detailed_serializer_spec.rb
category_serializer_spec.rb	DEV: Remove enable_simplified_category_creation old code (#40108)	2026-05-27 10:04:46 +10:00
category_upload_serializer_spec.rb
color_scheme_serializer_spec.rb	FIX: Allow creating new color palettes based on custom palettes (#34351)	2025-08-20 11:58:40 +08:00
component_index_serializer_spec.rb	DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577)	2025-07-11 11:16:34 -03:00
current_user_serializer_spec.rb	DEV: Use admin created_at for onboarding logic (#40478)	2026-06-02 10:33:46 -04:00
detailed_user_badge_serializer_spec.rb
directory_item_serializer_spec.rb
emoji_serializer_spec.rb
flag_serializer_spec.rb	DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577)	2025-07-11 11:16:34 -03:00
flagged_user_serializer_spec.rb	SECURITY: Hide IP from flagged regular users	2026-03-19 15:21:28 +00:00
found_user_serializer_spec.rb	DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073)	2025-10-06 16:11:01 +02:00
group_show_serializer_spec.rb	FIX: Ensure moderators do not clear group email domain (#39631)	2026-04-29 14:32:38 +08:00
group_user_serializer_spec.rb	DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073)	2025-10-06 16:11:01 +02:00
group_user_with_custom_fields_serializer_spec.rb
incoming_email_details_serializer_spec.rb	FIX: Remove error section when viewing details for received emails (#35228)	2025-10-07 16:25:11 +08:00
incoming_email_serializer_spec.rb	FIX: Remove error section when viewing details for received emails (#35228)	2025-10-07 16:25:11 +08:00
invite_serializer_spec.rb
listable_topic_serializer_spec.rb	DEV: Remove 'experimental' prefix from settings (#33233)	2025-06-19 12:23:42 +08:00
nested_replies_basic_category_serializer_spec.rb	FEATURE: First iteration of nested replies (#38888)	2026-04-16 08:06:44 -05:00
new_post_result_serializer_spec.rb
notification_serializer_spec.rb	FIX: Notifications may not have topics (#36143)	2025-11-21 01:50:31 +08:00
pending_post_serializer_spec.rb
post_action_type_serializer_spec.rb
post_item_excerpt_spec.rb	FIX: Handle Nokogiri HTML parser limits in PrettyText.excerpt (#37610)	2026-02-06 22:00:54 +01:00
post_localization_serializer_spec.rb
post_revision_serializer_spec.rb	FEATURE: Allow editing a post's reply target from the composer (#39471)	2026-04-29 12:23:26 -03:00
post_serializer_spec.rb	FIX: Post serialization exposes hidden-profile user status messages (#40885)	2026-06-15 09:25:47 -05:00
poster_serializer_spec.rb
remote_theme_serializer_spec.rb
reviewable_claimed_topic_serializer_spec.rb
reviewable_flagged_post_serializer_spec.rb	FIX: Show translated post in review queue when present (#40378)	2026-05-29 14:32:11 -04:00
reviewable_note_serializer_spec.rb	DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577)	2025-07-11 11:16:34 -03:00
reviewable_queued_post_serializer_spec.rb	SECURITY: Restrict raw email in queued post payloads	2026-05-19 00:26:04 +01:00
reviewable_score_serializer_spec.rb	FIX: escape HTML characters in watched word reason (#39378)	2026-04-20 14:15:38 -05:00
reviewable_serializer_spec.rb	DEV: Expand top_tags, topic.tags, etc, to return an array of tag objects instead of tag names (#36678)	2026-02-02 10:03:02 +08:00
reviewable_user_serializer_spec.rb	DEV: Remove reviewable_ui_refresh feature flag and legacy code (#36752)	2026-02-23 10:45:36 +08:00
single_sign_on_record_serializer_spec.rb
site_serializer_spec.rb	DEV: Make upcoming change CSS classes opt-in (#40669)	2026-06-10 12:12:58 +10:00
suggested_topic_serializer_spec.rb	FIX: Suggested topic links to nested replies topics (#40302)	2026-05-26 08:40:38 -05:00
tag_group_serializer_spec.rb	DEV: Move canonical tag routes to /tag/slug/id keeping /tag/name support (#37055)	2026-02-11 10:21:19 +08:00
tag_serializer_spec.rb	FEATURE: Show localized tags (#37044)	2026-02-12 18:06:14 +08:00
theme_index_serializer_spec.rb	FEATURE: enhance screenshot support for themes with dark/light modes (#36422)	2025-12-10 11:23:21 +10:00
theme_objects_setting_metadata_serializer_spec.rb	DEV: Enable Rails/FilePath rubocop rule (#40097)	2026-05-19 19:07:54 +02:00
theme_serializer_spec.rb	FEATURE: enhance screenshot support for themes with dark/light modes (#36422)	2025-12-10 11:23:21 +10:00
theme_settings_serializer_spec.rb	DEV: Enable Rails/FilePath rubocop rule (#40097)	2026-05-19 19:07:54 +02:00
topic_link_serializer_spec.rb	FIX: Filter orphaned TopicLinks and normalize http URLs to https (#37098)	2026-01-15 12:12:34 +08:00
topic_list_item_serializer_spec.rb	FEATURE: Notification/tracking changes for nested replies (#39750)	2026-05-07 12:33:56 -05:00
topic_list_serializer_spec.rb	FEATURE: Show localized tags (#37044)	2026-02-12 18:06:14 +08:00
topic_tracking_state_item_serializer_spec.rb	FIX: Don't emit tag names/slugs in topic tracking state (#40117)	2026-05-19 05:07:17 +08:00
topic_tracking_state_serializer_spec.rb
topic_view_details_serializer_spec.rb	FIX: DeleteReplies should use the guardian instead of checking for staff (#35443)	2025-10-16 18:26:41 +02:00
topic_view_posts_serializer_spec.rb
topic_view_serializer_spec.rb	DEV: Remove per topic toggle (#40869)	2026-06-15 18:43:36 +08:00
upload_serializer_spec.rb	DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577)	2025-07-11 11:16:34 -03:00
user_auth_token_serializer_spec.rb	DEV: Enable Rails/FilePath rubocop rule (#40097)	2026-05-19 19:07:54 +02:00
user_badge_serializer_spec.rb
user_bookmark_list_serializer_spec.rb
user_card_serializer_spec.rb	DEV: Tighten featured topic serialization data (#40549)	2026-06-03 16:32:52 -05:00
user_export_serializer_spec.rb
user_notification_total_serializer_spec.rb
user_post_bookmark_serializer_spec.rb
user_serializer_spec.rb	SECURITY: Subscription contributors expose full user profile fields to anonymous viewers (#40891)	2026-06-15 10:24:06 -05:00
user_status_serializer_spec.rb
user_summary_serializer_spec.rb
user_with_custom_fields_serializer_spec.rb
web_hook_post_serializer_spec.rb
web_hook_topic_view_serializer_spec.rb
web_hook_user_serializer_spec.rb	DEV: Tighten featured topic serialization data (#40549)	2026-06-03 16:32:52 -05:00
wizard_serializer_spec.rb	UX: One step wizard (#36082)	2025-11-25 13:35:32 -05:00