Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-09 21:45:25 +08:00
Code Packages Activity Actions
discourse/app
History
Exact
Isaac Janzen 679f801eb6
 SECURITY: search_users usernames parameter bypasses user-visibility scoping (#41477) 
## Summary

Prevent the disclosure of hidden users by applying visibility scoping
when searching via the `usernames` parameter. This ensures that
suspended, inactive, unapproved, and staged users are correctly filtered
out for non-staff callers.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1399

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-06 13:06:12 -05:00
..
assets FEATURE: Add a Support section to the admin dashboard0 (#41359) 2026-07-06 09:31:51 +08:00
controllers SECURITY: search_users usernames parameter bypasses user-visibility scoping (#41477) 2026-07-06 13:06:12 -05:00
helpers FEATURE: Show bounce rate and average session duration on the dashboard (#40936) 2026-07-03 10:49:32 +08:00
jobs DEV: add clean_up_inactive_users_query modifier for plugins to extend query for inactive users (#41372) 2026-07-06 09:39:11 -07:00
mailers FEATURE: Log in with a one-time email code (#40804) 2026-06-17 12:34:48 -07:00
models FEATURE: Add nested replies category conversion (#41236) 2026-07-06 08:22:22 -05:00
queries/reports DEV: Remove reporting_improvements upcoming change (#41259) 2026-07-01 07:52:02 +08:00
serializers SECURITY: /directory_items leaks restricted user-field values (#41476) 2026-07-06 13:05:48 -05:00
services FEATURE: Add nested replies category conversion (#41236) 2026-07-06 08:22:22 -05:00
views FIX: improve the reliability of chat sounds (#41373) 2026-07-02 18:52:41 -04:00