Exact

Exact Union RegExp

Isaac Janzen f1dcbb24e0 SECURITY: Private UserField value disclosure via directory_items order sort side-channel (#41598) ... ## Summary Prevent unauthenticated disclosure of private user custom field values via the directory items sort order. The fix restricts the `order` parameter to public fields for non-staff users and falls back to default sorting when an unauthorized field is requested. ## Source - Patch Triage: https://patch.discourse.org/patch-triage/1334 Co-authored-by: discourse-patch-triage <272280883+discourse-patch-triage[bot]@users.noreply.github.com>		2026-07-09 21:52:51 -05:00
..
admin	FEATURE: Support bulk user search in the admin users list (#41572)	2026-07-09 10:34:52 -03:00
api	SECURITY: Respect group member visibility for counts (#41403)	2026-07-06 12:48:06 +08:00
examples
about_controller_spec.rb
anonymous_actions_controller_spec.rb
application_controller_spec.rb
associate_accounts_controller_spec.rb
badges_controller_spec.rb
bookmarks_controller_spec.rb
calendar_subscriptions_controller_spec.rb
categories_controller_spec.rb	FEATURE: Add nested replies category conversion (#41236)	2026-07-06 08:22:22 -05:00
clicks_controller_spec.rb
composer_controller_spec.rb	SECURITY: Respect group member visibility for counts (#41403)	2026-07-06 12:48:06 +08:00
composer_messages_controller_spec.rb
crawler_hreflang_spec.rb	UX: Prevent incomplete crawler localization settings (#41297)	2026-07-01 12:13:22 +08:00
default_headers_spec.rb
dev_mode_controller_spec.rb
directory_columns_controller_spec.rb
directory_items_controller_spec.rb	SECURITY: Private UserField value disclosure via directory_items order sort side-channel (#41598)	2026-07-09 21:52:51 -05:00
discourse_id_controller_spec.rb
do_not_disturb_controller_spec.rb
drafts_controller_spec.rb
edit_directory_columns_controller_spec.rb
email_controller_spec.rb
embed_controller_spec.rb
emojis_controller_spec.rb
exceptions_controller_spec.rb
export_csv_controller_spec.rb
extra_locales_controller_spec.rb
finish_installation_controller_spec.rb
form_templates_controller_spec.rb
forums_controller_spec.rb
gifs_controller_spec.rb	FIX: move klipy gifs request to backend (#41540)	2026-07-08 17:18:42 +04:00
groups_controller_spec.rb	FIX: Make auto pseudogroups visible to logged on users (#41498)	2026-07-08 09:28:18 +10:00
hashtags_controller_spec.rb
highlightjs_controller_spec.rb
home_page_controller_spec.rb	FEATURE: Allow fallback home routes for crawlers for custom homepage sites (#41234)	2026-06-29 09:57:40 -04:00
inline_onebox_controller_spec.rb
invites_controller_spec.rb
list_controller_spec.rb	FIX: move klipy gifs request to backend (#41540)	2026-07-08 17:18:42 +04:00
metadata_controller_spec.rb
nested_topics_controller_spec.rb	FIX: Run nested replies stats job on all topics when nested is default (#41510)	2026-07-07 14:30:53 -05:00
net_http_header_spec.rb
net_http_timeout_spec.rb
noscript_escape_spec.rb
notifications_controller_spec.rb
offline_controller_spec.rb
omniauth_callbacks_controller_spec.rb	FEATURE: Allow HTML for OAuth error message (#41204)	2026-06-26 08:35:06 -05:00
onebox_controller_spec.rb
permalinks_controller_spec.rb
post_action_users_controller_spec.rb
post_actions_controller_spec.rb
post_localizations_controller_spec.rb
post_readers_controller_spec.rb
posts_controller_spec.rb	FIX: Omit inaccessible reply target post numbers from post revision history (#41547)	2026-07-08 11:41:43 -05:00
presence_controller_spec.rb
published_pages_controller_spec.rb
push_notification_controller_spec.rb
qunit_controller_spec.rb
reviewable_claimed_topics_controller_spec.rb
reviewable_notes_controller_spec.rb
reviewables_controller_spec.rb	SECURITY: Reviewable conversations expose post-voting flag PM excerpts to category moderators outside the PM (#41527)	2026-07-07 15:37:22 -05:00
robots_txt_controller_spec.rb
safe_mode_controller_spec.rb
search_controller_spec.rb	FEATURE: Change default upcoming change promotion status to Beta (#41275)	2026-07-06 09:13:37 +10:00
session_controller_spec.rb
sidebar_sections_controller_spec.rb
similar_topics_controller_spec.rb
site_controller_spec.rb
sitemap_controller_spec.rb
slugs_controller_spec.rb
static_controller_spec.rb	FIX: Localize static topic pages … (#41260)	2026-06-29 21:34:17 +08:00
steps_controller_spec.rb
stylesheets_controller_spec.rb
svg_sprite_controller_spec.rb
tag_groups_controller_spec.rb
tag_localizations_controller_spec.rb
tags_controller_spec.rb
theme_import_map_spec.rb	DEV: Improve cross-plugin/theme import handling (#40939)	2026-06-30 16:11:38 +01:00
theme_javascripts_controller_spec.rb
topic_localizations_controller_spec.rb
topic_view_stats_controller_spec.rb
topics_controller_spec.rb	SECURITY: detailed_404 Security Setting Bypassed (#41549)	2026-07-09 10:58:07 -05:00
uploads_controller_multisite_spec.rb
uploads_controller_spec.rb	SECURITY: Regular users can route multipart uploads into the admin backup store	2026-06-30 16:10:52 +02:00
user_actions_controller_spec.rb	FEATURE: Change default upcoming change promotion status to Beta (#41275)	2026-07-06 09:13:37 +10:00
user_api_key_clients_controller_spec.rb
user_api_keys_controller_spec.rb
user_avatars_controller_spec.rb	SECURITY: Improve SVG sanitization	2026-06-30 16:10:52 +02:00
user_badges_controller_spec.rb
user_status_controller_spec.rb
users_controller_spec.rb	FIX: Validate early for input length in username field on registration (#41525)	2026-07-07 16:27:13 -04:00
users_email_controller_spec.rb
webhooks_controller_spec.rb	SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks	2026-06-30 16:10:52 +02:00
wizard_controller_spec.rb