Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-07 13:19:19 +08:00
Code Packages Activity Actions
discourse/spec
History
Exact
Isaac Janzen f1dcbb24e0
 SECURITY: Private UserField value disclosure via directory_items order sort side-channel (#41598) 
## Summary

Prevent unauthenticated disclosure of private user custom field values
via the directory items sort order. The fix restricts the `order`
parameter to public fields for non-staff users and falls back to default
sorting when an unauthorized field is requested.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1334

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-09 21:52:51 -05:00
..
db FIX: Prevent backslash accumulation in upload markdown labels (#39461) 2026-06-03 18:10:38 +02:00
fabricators FEATURE: Show bounce rate and average session duration on the dashboard (#40936) 2026-07-03 10:49:32 +08:00
fixtures DEV: Allow plugins to register admin-panel-specific CSS (#40345) 2026-05-28 11:03:38 +01:00
generator DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
helpers FEATURE: Show bounce rate and average session duration on the dashboard (#40936) 2026-07-03 10:49:32 +08:00
import_export
initializers SECURITY: Harden imagemagick execution 2026-06-30 16:10:52 +02:00
integration FIX: store method in route matcher (#41512) 2026-07-07 11:49:56 -04:00
integrity DEV: Add hide_settings metadata to upcoming changes framework (#40990) 2026-06-19 10:25:39 +04:00
jobs FIX: Run nested replies stats job on all topics when nested is default (#41510) 2026-07-07 14:30:53 -05:00
lib DEV: Fix stylesheet watcher file matching (#41593) 2026-07-09 16:30:28 -04:00
mailers FIX: allow custom email sender name via translation overrides (#40674) 2026-06-09 14:03:03 +04:00
migrations FIX: Ensure each flag gets a unique name_key (#40899) 2026-06-24 16:37:59 +02:00
models DEV: Introduce a category scope enum for flexible category selection (#41505) 2026-07-08 15:54:10 +08:00
multisite DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
queries/reports FEATURE: Change default upcoming change promotion status to Beta (#41275) 2026-07-06 09:13:37 +10:00
requests SECURITY: Private UserField value disclosure via directory_items order sort side-channel (#41598) 2026-07-09 21:52:51 -05:00
script DEV: Automatic upcoming change status report and PR creation (#40291) 2026-06-11 15:19:15 +10:00
serializers FIX: Omit inaccessible reply target post numbers from post revision history (#41547) 2026-07-08 11:41:43 -05:00
services FIX: Return database connections to the pool after dashboard builds (#41583) 2026-07-10 09:54:40 +08:00
support FEATURE: Change default upcoming change promotion status to Beta (#41275) 2026-07-06 09:13:37 +10:00
system DEV: add typescript support for core, themes and plugins (#41478) 2026-07-08 12:57:18 +01:00
tasks DEV: set enable_gifs to true in migrate gifs rake task (#41502) 2026-07-07 17:04:28 +04:00
views
rails_helper.rb DEV: Block external requests in system specs via Chrome DNS resolver (#40685) 2026-06-17 12:29:57 +01:00
regenerate_swagger_docs
swagger_helper.rb