Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-08 17:53:55 +08:00
Code Packages Activity Actions
discourse/spec
History
Exact
Isaac Janzen 679f801eb6
 SECURITY: search_users usernames parameter bypasses user-visibility scoping (#41477) 
## Summary

Prevent the disclosure of hidden users by applying visibility scoping
when searching via the `usernames` parameter. This ensures that
suspended, inactive, unapproved, and staged users are correctly filtered
out for non-staff callers.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1399

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-06 13:06:12 -05:00
..
db FIX: Prevent backslash accumulation in upload markdown labels (#39461) 2026-06-03 18:10:38 +02:00
fabricators FEATURE: Show bounce rate and average session duration on the dashboard (#40936) 2026-07-03 10:49:32 +08:00
fixtures DEV: Allow plugins to register admin-panel-specific CSS (#40345) 2026-05-28 11:03:38 +01:00
generator DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
helpers FEATURE: Show bounce rate and average session duration on the dashboard (#40936) 2026-07-03 10:49:32 +08:00
import_export
initializers SECURITY: Harden imagemagick execution 2026-06-30 16:10:52 +02:00
integration FIX: Gate MessageBus groups when closing topic (#40913) 2026-06-15 15:27:07 -05:00
integrity DEV: Add hide_settings metadata to upcoming changes framework (#40990) 2026-06-19 10:25:39 +04:00
jobs DEV: add clean_up_inactive_users_query modifier for plugins to extend query for inactive users (#41372) 2026-07-06 09:39:11 -07:00
lib SECURITY: Restrict tagged group message lists (#41342) 2026-07-06 12:19:05 +08:00
mailers FIX: allow custom email sender name via translation overrides (#40674) 2026-06-09 14:03:03 +04:00
migrations FIX: Ensure each flag gets a unique name_key (#40899) 2026-06-24 16:37:59 +02:00
models FEATURE: Add nested replies category conversion (#41236) 2026-07-06 08:22:22 -05:00
multisite DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
queries/reports FEATURE: Change default upcoming change promotion status to Beta (#41275) 2026-07-06 09:13:37 +10:00
requests SECURITY: search_users usernames parameter bypasses user-visibility scoping (#41477) 2026-07-06 13:06:12 -05:00
script DEV: Automatic upcoming change status report and PR creation (#40291) 2026-06-11 15:19:15 +10:00
serializers SECURITY: /directory_items leaks restricted user-field values (#41476) 2026-07-06 13:05:48 -05:00
services FEATURE: Add nested replies category conversion (#41236) 2026-07-06 08:22:22 -05:00
support FEATURE: Change default upcoming change promotion status to Beta (#41275) 2026-07-06 09:13:37 +10:00
system FEATURE: Change default upcoming change promotion status to Beta (#41275) 2026-07-06 09:13:37 +10:00
tasks DEV: better multisite suppport for migrate gifs (#40792) 2026-06-11 17:51:27 +04:00
views
rails_helper.rb DEV: Block external requests in system specs via Chrome DNS resolver (#40685) 2026-06-17 12:29:57 +01:00
regenerate_swagger_docs
swagger_helper.rb