Exact

Exact Union RegExp

Régis Hanol baa573d414 FIX: Enforce group visibility when filtering users by group (#41370) ... Previously, filtering a user search by group (e.g. `/u/search/users?groups=admins`) only checked whether the requester could see the group's members, not the group itself. Because the default automatic groups are visible to logged-in users but expose their members publicly, an anonymous or non-member user could enumerate the members of a group hidden from them, even though every other path that lists users by group (the user directory, `/g/:name/members`, group topic lists) already required both checks. This adds a `Guardian#can_see_group_and_members?` helper that requires both group and member visibility, and routes the user search, user directory, and plugin group-listing paths through it. This closes the leak, fixes a related all-or-nothing bug in `can_see_groups?` when several groups are filtered at once, and keeps the rule in one place so a caller can no longer reintroduce it by checking only half.		2026-07-03 07:08:52 +02:00
..
regular/discourse_post_event	FIX: Enforce group visibility when filtering users by group (#41370)	2026-07-03 07:08:52 +02:00
scheduled	FIX: Job exception: Holidays::InvalidRegion (#35473)	2025-10-17 17:53:53 +02:00