Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-12 02:52:01 +08:00
Code Packages Activity Actions
discourse/spec/requests
History
Exact
Isaac Janzen 289d841a12
 FIX: Omit inaccessible reply target post numbers from post revision history (#41547) 
## Summary

Prevent the disclosure of inaccessible reply targets in post revision
history. The serializer now correctly omits metadata for target posts,
such as whispers or deleted posts, if the current user does not have
permission to view them.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1359

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-08 11:41:43 -05:00
..
admin UX: Normalize automatic membership email domains (#41434) 2026-07-03 17:22:18 +02:00
api SECURITY: Respect group member visibility for counts (#41403) 2026-07-06 12:48:06 +08:00
examples
about_controller_spec.rb FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
anonymous_actions_controller_spec.rb FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256) 2026-05-26 09:30:38 +02:00
application_controller_spec.rb FIX: Reject DiscourseConnect SSO payloads when secret is blank (#40830) 2026-06-12 15:17:16 +03:00
associate_accounts_controller_spec.rb
badges_controller_spec.rb FEATURE: Add a granular API key scope to list badges (#41086) 2026-06-22 18:32:02 +02:00
bookmarks_controller_spec.rb
calendar_subscriptions_controller_spec.rb FEATURE: Add calendar subscription URLs to user preferences (#38598) 2026-03-17 10:28:20 -03:00
categories_controller_spec.rb FEATURE: Add nested replies category conversion (#41236) 2026-07-06 08:22:22 -05:00
clicks_controller_spec.rb SECURITY: Missing visibility check in click tracking endpoint (#41140) 2026-06-24 15:15:56 +10:00
composer_controller_spec.rb SECURITY: Respect group member visibility for counts (#41403) 2026-07-06 12:48:06 +08:00
composer_messages_controller_spec.rb SECURITY: Whisper metadata disclosure via stale TopicLinks (#41139) 2026-06-24 14:44:27 +10:00
crawler_hreflang_spec.rb UX: Prevent incomplete crawler localization settings (#41297) 2026-07-01 12:13:22 +08:00
default_headers_spec.rb
dev_mode_controller_spec.rb
directory_columns_controller_spec.rb
directory_items_controller_spec.rb SECURITY: /directory_items leaks restricted user-field values (#41476) 2026-07-06 13:05:48 -05:00
discourse_id_controller_spec.rb FIX: Revocation endpoint is blocked when login_required is enabled, preventing session invalidation (#37859) 2026-02-17 09:12:14 -05:00
do_not_disturb_controller_spec.rb
drafts_controller_spec.rb FIX: Drafts/reviewables API returned 404 when acting on own resource (#39449) 2026-05-26 09:29:20 +02:00
edit_directory_columns_controller_spec.rb
email_controller_spec.rb
embed_controller_spec.rb FIX: Add visibility check to Embed info (#40896) 2026-06-15 10:20:56 -05:00
emojis_controller_spec.rb FEATURE: Locale-specific emoji search aliases (#39089) 2026-04-06 14:08:46 -03:00
exceptions_controller_spec.rb
export_csv_controller_spec.rb FIX: Suspicious login IPs bypass the moderator IP-visibility setting (#40154) 2026-05-22 13:22:32 +08:00
extra_locales_controller_spec.rb DEV: Refactor locale bundle loading (#37114) 2026-01-16 11:45:14 +00:00
finish_installation_controller_spec.rb
form_templates_controller_spec.rb SECURITY: Scope form template endpoints to accessible categories 2026-05-19 00:26:04 +01:00
forums_controller_spec.rb
gifs_controller_spec.rb FIX: move klipy gifs request to backend (#41540) 2026-07-08 17:18:42 +04:00
groups_controller_spec.rb FIX: Make auto pseudogroups visible to logged on users (#41498) 2026-07-08 09:28:18 +10:00
hashtags_controller_spec.rb
highlightjs_controller_spec.rb
home_page_controller_spec.rb FEATURE: Allow fallback home routes for crawlers for custom homepage sites (#41234) 2026-06-29 09:57:40 -04:00
inline_onebox_controller_spec.rb SECURITY: Check topic visibility in Oneboxer even when categories match 2026-03-31 15:12:45 +01:00
invites_controller_spec.rb FIX: Reject DiscourseConnect SSO payloads when secret is blank (#40830) 2026-06-12 15:17:16 +03:00
list_controller_spec.rb FIX: move klipy gifs request to backend (#41540) 2026-07-08 17:18:42 +04:00
metadata_controller_spec.rb FEATURE: Accept shared files via the Web Share Target (#41030) 2026-06-18 17:35:09 -03:00
nested_topics_controller_spec.rb FIX: Run nested replies stats job on all topics when nested is default (#41510) 2026-07-07 14:30:53 -05:00
net_http_header_spec.rb
net_http_timeout_spec.rb DEV: fix a large amount of typos (#37428) 2026-02-02 16:31:58 +11:00
noscript_escape_spec.rb
notifications_controller_spec.rb
offline_controller_spec.rb
omniauth_callbacks_controller_spec.rb FEATURE: Allow HTML for OAuth error message (#41204) 2026-06-26 08:35:06 -05:00
onebox_controller_spec.rb SECURITY: prevent hidden profile data leak via user onebox 2026-03-19 15:21:28 +00:00
permalinks_controller_spec.rb SECURITY: prevent permalink redirects from leaking restricted slugs 2026-01-28 17:11:14 +00:00
post_action_users_controller_spec.rb UX: Ignored users reactions/likes should not show up (#39672) 2026-05-11 15:32:29 -03:00
post_actions_controller_spec.rb SECURITY: fix is_warning type coercion bypass in PostActionsController 2026-03-19 15:21:28 +00:00
post_localizations_controller_spec.rb
post_readers_controller_spec.rb SECURITY: Missing post-level authorization allows whisper metadata disclosure 2026-03-31 15:12:45 +01:00
posts_controller_spec.rb FIX: Omit inaccessible reply target post numbers from post revision history (#41547) 2026-07-08 11:41:43 -05:00
presence_controller_spec.rb
published_pages_controller_spec.rb FIX: ensures only staff can check slugs (#37846) 2026-02-16 18:23:46 +01:00
push_notification_controller_spec.rb
qunit_controller_spec.rb DEV: Cache AssetProcessor code in development (#38036) 2026-02-25 11:24:41 +00:00
reviewable_claimed_topics_controller_spec.rb SECURITY: Require topic visibility for category group moderator actions 2026-05-19 00:26:04 +01:00
reviewable_notes_controller_spec.rb SECURITY: scope reviewable notes to user-visible reviewables 2026-02-26 12:22:54 +00:00
reviewables_controller_spec.rb SECURITY: Reviewable conversations expose post-voting flag PM excerpts to category moderators outside the PM (#41527) 2026-07-07 15:37:22 -05:00
robots_txt_controller_spec.rb
safe_mode_controller_spec.rb
search_controller_spec.rb FEATURE: Change default upcoming change promotion status to Beta (#41275) 2026-07-06 09:13:37 +10:00
session_controller_spec.rb FEATURE: Sign up with a one-time email code (#40909) 2026-06-23 11:30:18 -07:00
sidebar_sections_controller_spec.rb FIX: raise 404 when sidebar section doesn't exist (#37675) 2026-02-10 15:47:49 +01:00
similar_topics_controller_spec.rb
site_controller_spec.rb DEV: Gate read-restricted banner topics (#38496) 2026-03-11 08:14:57 -07:00
sitemap_controller_spec.rb
slugs_controller_spec.rb
static_controller_spec.rb FIX: Localize static topic pages … (#41260) 2026-06-29 21:34:17 +08:00
steps_controller_spec.rb
stylesheets_controller_spec.rb DEV: Allow plugins to register admin-panel-specific CSS (#40345) 2026-05-28 11:03:38 +01:00
svg_sprite_controller_spec.rb
tag_groups_controller_spec.rb FIX: Prevent tag group from saving if private + no group selected (#39599) 2026-04-29 12:10:45 +08:00
tag_localizations_controller_spec.rb FIX: Clean localized tag names (#38488) 2026-03-12 12:54:50 +08:00
tags_controller_spec.rb FIX: Ensure /tag/bad-slug/:id/edit routes to edit page (#41115) 2026-06-23 18:58:50 +08:00
theme_import_map_spec.rb DEV: Improve cross-plugin/theme import handling (#40939) 2026-06-30 16:11:38 +01:00
theme_javascripts_controller_spec.rb PERF: Move theme settings from js bundle to preload data (#40137) 2026-06-08 16:04:56 +01:00
topic_localizations_controller_spec.rb
topic_view_stats_controller_spec.rb
topics_controller_spec.rb DEV: Bump unified new upcoming change to Beta (#41454) 2026-07-08 09:50:19 +10:00
uploads_controller_multisite_spec.rb FIX: Multisite prevent anons from downloading files (#37979) 2026-02-24 10:49:14 +10:00
uploads_controller_spec.rb SECURITY: Regular users can route multipart uploads into the admin backup store 2026-06-30 16:10:52 +02:00
user_actions_controller_spec.rb FEATURE: Change default upcoming change promotion status to Beta (#41275) 2026-07-06 09:13:37 +10:00
user_api_key_clients_controller_spec.rb FIX: Empty-scopes bypass allows untrusted client registration and downstream scope/redirect policy bypass (#37855) 2026-02-17 12:39:09 +11:00
user_api_keys_controller_spec.rb FIX: Only allow OTPs to be generated from a browser session (#40964) 2026-06-17 18:07:32 +03:00
user_avatars_controller_spec.rb SECURITY: Improve SVG sanitization 2026-06-30 16:10:52 +02:00
user_badges_controller_spec.rb SECURITY: Prevent badge lookup from exposing hidden profiles (#41160) 2026-06-25 13:01:03 +08:00
user_status_controller_spec.rb FIX: Post serialization exposes hidden-profile user status messages (#40885) 2026-06-15 09:25:47 -05:00
users_controller_spec.rb FIX: Validate early for input length in username field on registration (#41525) 2026-07-07 16:27:13 -04:00
users_email_controller_spec.rb DEV: CSRF Token Not Invalidated After Password Reset (#40998) 2026-06-17 16:07:30 -04:00
webhooks_controller_spec.rb SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks 2026-06-30 16:10:52 +02:00
wizard_controller_spec.rb