Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-11 02:59:07 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-workflows/lib
History
Exact
Joffrey JAFFEUX 4459742bec
 FIX: Bind workflow modal responses to their target user (#41620) 
Modal nodes publish an approve/reject modal to a single resolved target
user over a per-user MessageBus channel. Each button carried an
HMAC-signed action token, but the token only proved it was issued by the
server, not who it was for: any logged-in user who obtained a valid
token could POST it and resume the execution under their own account.

In practice this was hard to pull off as only the valid user would get
the message bus event (and the modal to show), but this is an important
defense in depth fix to apply.
2026-07-10 14:33:47 +02:00
..
discourse_workflows FIX: Bind workflow modal responses to their target user (#41620) 2026-07-10 14:33:47 +02:00
tasks FEATURE: Add AI authoring to Discourse Workflows (#40504) 2026-06-18 18:32:30 +02:00