Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-10 23:00:09 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-subscriptions
History
Exact
Isaac Janzen ac2074474f
 SECURITY: Subscription contributors expose full user profile fields to anonymous viewers (#40891) 
## Summary

Correctly enforce profile visibility restrictions in the subscriptions
contributors endpoint and user serializers. This prevents the exposure
of sensitive profile fields—including bio, location, and website—to
anonymous viewers when public profiles are disabled via site settings.
The fix also hardens the user and user card serializers to omit profile
details for unauthorized scopes as a defense-in-depth measure.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1286

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-06-15 10:24:06 -05:00
..
app SECURITY: Subscription contributors expose full user profile fields to anonymous viewers (#40891) 2026-06-15 10:24:06 -05:00
assets FIX: preserve unconfigured products state in discourse-subscriptions (#40636) 2026-06-09 11:42:50 +05:30
config I18N: Update translations (#40165) 2026-05-22 11:36:52 +02:00
db/migrate
lib DEV: Clean up scope resolution operators in plugins (#34979) 2025-09-30 14:36:34 +02:00
spec SECURITY: Subscription contributors expose full user profile fields to anonymous viewers (#40891) 2026-06-15 10:24:06 -05:00
test/javascripts FIX: preserve unconfigured products state in discourse-subscriptions (#40636) 2026-06-09 11:42:50 +05:30
package.json DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00
plugin.rb FIX: Use signed checkout user references in discourse-subscriptions (#40058) 2026-05-28 22:19:56 +05:30
README.md
tsconfig.json DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00

README.md

Discourse Subscriptions Plugin

Discourse Subscriptions allows site owners to sell recurring and one-time purchase subscriptions that grant access to a group on a Discourse instance.

For more information, please see: https://meta.discourse.org/t/discourse-subscriptions-plugin/140818