0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-11 02:59:07 +08:00
discourse/lib/guardian
Arpit Jalan d10e6799cd
FIX: keep private message conversion limited to staff (#41460)
Converting a topic between a private message and a regular topic is
meant to go through the dedicated staff-only conversion flow. The
generic topic update path did not apply that same restriction, so the
topic's archetype could be changed there without it.

Route archetype changes involving private messages through the same
`can_convert_topic?` permission the conversion flow already uses, so
both paths behave consistently.
2026-07-06 14:13:48 +05:30
..
bookmark_guardian.rb DEV: Consistently use Guardian helper methods (#34024) 2025-08-14 15:23:42 +08:00
category_guardian.rb FEATURE: Support group based category posting review modes (#38707) 2026-04-07 10:41:16 +08:00
ensure_magic.rb
flag_guardian.rb
group_guardian.rb FEATURE: Split setting for allowing mods to manage categories and groups (#35174) 2025-10-06 10:43:42 +03:00
invite_guardian.rb DEV: Invites destroy_all_expired allows staff to delete any user's expired invites (#38281) 2026-03-05 09:59:48 -06:00
localization_guardian.rb FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
permalink_guardian.rb SECURITY: prevent permalink redirects from leaking restricted slugs 2026-01-28 17:11:14 +00:00
post_guardian.rb FIX: Hidden post excerpts can be returned by group activity serializers (#40217) 2026-05-21 15:28:41 +08:00
post_revision_guardian.rb
sidebar_guardian.rb
staff_action_log_guardian.rb SECURITY: Restrict staff action logs visibility for moderators 2026-01-28 17:11:14 +00:00
tag_guardian.rb FIX: Don't auto-remove chat members from logged_in_users group (#40543) 2026-06-03 18:15:32 +02:00
topic_guardian.rb FIX: keep private message conversion limited to staff (#41460) 2026-07-06 14:13:48 +05:30
upload_guardian.rb FIX: Enforce secure-upload ACL in AI bot prompt path (#39903) 2026-05-13 09:55:32 +08:00
user_guardian.rb FIX: Post serialization exposes hidden-profile user status messages (#40885) 2026-06-15 09:25:47 -05:00