Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-11 02:59:07 +08:00
Code Packages Activity Actions
discourse/plugins/chat/lib
History
Exact
Isaac Janzen 91a15047f6
 SECURITY: Removed channel member can edit and trash their own chat messages (#41469) 
## Summary

Prevent users from editing chat messages in channels they can no longer
access by requiring channel preview permissions in the authorization
check. This fix addresses an authorization gap where stale chat
memberships allowed users to modify their previous messages after losing
access to a private category.

Patch Triage: https://patch.discourse.org/patch-triage/1403

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-06 11:51:49 -05:00
..
chat SECURITY: Removed channel member can edit and trash their own chat messages (#41469) 2026-07-06 11:51:49 -05:00
chat_sdk DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
discourse_dev DEV: Refactor Chat::ListChannelThreadMessages a bit (#33380) 2025-08-08 14:05:38 +02:00
discourse_workflows/nodes DEV: Add chat message workflow trigger (#40200) 2026-06-12 16:49:07 +02:00
email_controller_helper
onebox/templates FIX: Chat channel onebox icons render and support channel emoji (#39826) 2026-05-11 15:17:36 +02:00
tasks