Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-12 05:37:26 +08:00
Code Packages Activity Actions
discourse/plugins/chat/spec
History
Exact
Isaac Janzen 91a15047f6
 SECURITY: Removed channel member can edit and trash their own chat messages (#41469) 
## Summary

Prevent users from editing chat messages in channels they can no longer
access by requiring channel preview permissions in the authorization
check. This fix addresses an authorization gap where stale chat
memberships allowed users to modify their previous messages after losing
access to a private category.

Patch Triage: https://patch.discourse.org/patch-triage/1403

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-06 11:51:49 -05:00
..
components/chat FIX: Don't auto-remove chat members from logged_in_users group (#40543) 2026-06-03 18:15:32 +02:00
db/post_migrate FIX: Duplicate notifications when mentioned in chat (#39670) 2026-04-30 14:52:39 -03:00
fabricators FEATURE: Pin chat messages (#37985) 2026-02-23 22:00:16 +01:00
integration DEV: Add chat message workflow trigger (#40200) 2026-06-12 16:49:07 +02:00
jobs FEATURE: Restore web push quick reply for chat messages (#39614) 2026-04-29 12:36:03 -03:00
lib FEATURE: add new chat reactions popup (#41028) 2026-06-25 14:56:08 +04:00
mailers DEV: bump simple email subject status to stable (#41285) 2026-06-30 18:18:57 +04:00
models A11Y: live announcements and optional sounds for chat messages (#41213) 2026-07-02 12:48:58 -04:00
queries/chat Revert "FIX: Existing DM sends bypass direct-message group restrictions (#40405)" (#40561) 2026-06-04 15:00:45 +08:00
requests SECURITY: Removed channel member can edit and trash their own chat messages (#41469) 2026-07-06 11:51:49 -05:00
serializer SECURITY: Chat authorization and disclosure fixes 2026-05-19 00:26:04 +01:00
services FEATURE: allow anonymous users to view public chat channels (#40688) 2026-06-18 15:18:51 -04:00
support FEATURE: Pin chat messages (#37985) 2026-02-23 22:00:16 +01:00
system UX: simplify chat join preview card (#41054) 2026-06-29 11:49:15 -04:00
validators
plugin_helper.rb DEV: Enable some minor rubocop rules (#40094) 2026-05-19 15:29:38 +02:00
plugin_spec.rb FIX: show chat DM button when personal messages are restricted (#37920) 2026-02-19 12:37:25 +01:00