Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-12 05:37:26 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-solved/spec
History
Exact
Isaac Janzen 0337d7ddd8
 SECURITY: /solution/by_user leaks whisper/hidden accepted-answer post (#41479) 
## Summary

Prevent the unauthorized disclosure of hidden or whisper posts through
the `/solution/by_user` endpoint. The patch ensures that only posts
visible to the current visitor are returned by applying post-level
visibility filters and guardian authorization checks during
serialization.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1400

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

---------

Co-authored-by: discourse-patch-triage[bot] <272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-07 10:42:26 -05:00
..
components DEV: Allow multiple solutions in solved plugin (#39806) 2026-05-28 07:12:28 -05:00
fabricators DEV: Allow multiple solutions in solved plugin (#39806) 2026-05-28 07:12:28 -05:00
integration FEATURE: Exclude small actions from topic counters and unread tracking (#40481) 2026-06-08 08:03:55 +02:00
lib FEATURE: Add a Support section to the admin dashboard0 (#41359) 2026-07-06 09:31:51 +08:00
models FIX: Hide Solved empty_box_on_unsolved on Horizon (#41276) 2026-07-01 10:09:03 +10:00
requests SECURITY: /solution/by_user leaks whisper/hidden accepted-answer post (#41479) 2026-07-07 10:42:26 -05:00
serializers FIX: Show solved status on topic titles loaded directly (#41186) 2026-06-25 15:28:24 +02:00
services/discourse_solved FIX: prevent empty QA Page schema in Solved (#40471) 2026-06-02 22:43:49 +08:00
system FEATURE: Add a Support section to the admin dashboard0 (#41359) 2026-07-06 09:31:51 +08:00