Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-09 21:45:25 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-workflows
History
Exact
Joffrey JAFFEUX 4459742bec
 FIX: Bind workflow modal responses to their target user (#41620) 
Modal nodes publish an approve/reject modal to a single resolved target
user over a per-user MessageBus channel. Each button carried an
HMAC-signed action token, but the token only proved it was issued by the
server, not who it was for: any logged-in user who obtained a valid
token could POST it and resume the execution under their own account.

In practice this was hard to pull off as only the valid user would get
the message bus event (and the modal to show), but this is an important
defense in depth fix to apply.
2026-07-10 14:33:47 +02:00
..
admin/assets/javascripts DEV: Clean up workflow expression reference internals (#41545) 2026-07-09 16:11:02 -03:00
app FIX: Bind workflow modal responses to their target user (#41620) 2026-07-10 14:33:47 +02:00
assets FEATURE: Show workflow expression references as editable pills (#41442) 2026-07-08 12:02:11 +02:00
config FEATURE: Add workflow triggers for group membership changes (#41608) 2026-07-10 12:11:07 +02:00
db/migrate FEATURE: Add sub workflow call support (#41019) 2026-06-25 15:01:05 +02:00
lib FIX: Bind workflow modal responses to their target user (#41620) 2026-07-10 14:33:47 +02:00
spec FIX: Bind workflow modal responses to their target user (#41620) 2026-07-10 14:33:47 +02:00
test/javascripts FEATURE: Show workflow expression references as editable pills (#41442) 2026-07-08 12:02:11 +02:00
plugin.rb FEATURE: Add workflow triggers for group membership changes (#41608) 2026-07-10 12:11:07 +02:00
USE_CASES.md FEATURE: Add AI authoring to Discourse Workflows (#40504) 2026-06-18 18:32:30 +02:00