Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-09 21:45:25 +08:00
Code Packages Activity Actions
discourse/spec/requests
History
Exact
Mark VanLandingham 4143157a17
 FIX: Invalidate cached 404 topic suggestions when category access is revoked (#42413) 
## Summary

Correctly invalidate the locale-keyed 404 suggestions cache whenever a
topic is moved into a read-restricted category or a category becomes
read-restricted, preventing anonymous users from seeing stale topic
titles after access has been revoked. The fix clears all locale variants
of the dedicated fragment both immediately and after transaction commit
to close the refill race.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1672
2026-08-07 09:57:32 -05:00
..
admin FEATURE: Design wizard (#42178) 2026-08-07 06:34:46 -05:00
api UX: Always show the "Mark unread" topic button (#42189) 2026-08-04 10:29:12 -03:00
examples
about_controller_spec.rb FEATURE: Allow selection of multiple content languages when viewing topics and posts (#42128) 2026-07-30 12:19:44 +08:00
access_control_lists_controller_spec.rb FEATURE: Support users in DAccessControl and backend (#41358) 2026-07-15 09:18:06 +10:00
anonymous_actions_controller_spec.rb FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256) 2026-05-26 09:30:38 +02:00
application_controller_spec.rb FIX: Invalidate cached 404 topic suggestions when category access is revoked (#42413) 2026-08-07 09:57:32 -05:00
associate_accounts_controller_spec.rb
badges_controller_spec.rb FEATURE: Add a granular API key scope to list badges (#41086) 2026-06-22 18:32:02 +02:00
bookmarks_controller_spec.rb SECURITY: Enforce first-post visibility for topic bookmarks (#42321) 2026-08-05 12:52:40 -05:00
calendar_subscriptions_controller_spec.rb
categories_controller_spec.rb FIX: Avoid duplicate category updated events (#42406) 2026-08-06 20:54:09 +08:00
clicks_controller_spec.rb SECURITY: Missing visibility check in click tracking endpoint (#41140) 2026-06-24 15:15:56 +10:00
composer_controller_spec.rb SECURITY: Respect group member visibility for counts (#41403) 2026-07-06 12:48:06 +08:00
composer_messages_controller_spec.rb SECURITY: Duplicate lookup reveals restricted topic titles through canonicalized URLs 2026-07-28 16:40:22 +02:00
crawler_hreflang_spec.rb UX: Prevent incomplete crawler localization settings (#41297) 2026-07-01 12:13:22 +08:00
default_headers_spec.rb
dev_mode_controller_spec.rb
directory_columns_controller_spec.rb
directory_items_controller_spec.rb SECURITY: Private UserField value disclosure via directory_items order sort side-channel (#41598) 2026-07-09 21:52:51 -05:00
discourse_id_controller_spec.rb
do_not_disturb_controller_spec.rb
drafts_controller_spec.rb FIX: DraftSerializer leaks real names of topic and post authors (#42197) 2026-07-31 09:17:27 -05:00
edit_directory_columns_controller_spec.rb
email_controller_spec.rb
embed_controller_spec.rb FIX: Validate and safely handle malformed embed allowlist regexes (#42327) 2026-08-05 12:54:43 -05:00
emojis_controller_spec.rb FEATURE: Locale-specific emoji search aliases (#39089) 2026-04-06 14:08:46 -03:00
exceptions_controller_spec.rb
export_csv_controller_spec.rb FIX: Race condition allows bypass of data export rate limit in Discourse (#41990) 2026-07-29 13:04:18 -05:00
extra_locales_controller_spec.rb
finish_installation_controller_spec.rb
form_templates_controller_spec.rb SECURITY: Scope form template endpoints to accessible categories 2026-05-19 00:26:04 +01:00
forums_controller_spec.rb
gifs_controller_spec.rb FIX: move klipy gifs request to backend (#41540) 2026-07-08 17:18:42 +04:00
groups_controller_spec.rb FIX: Restrict group SMTP settings updates to administrators (#42278) 2026-08-03 15:08:53 -05:00
hashtags_controller_spec.rb
highlightjs_controller_spec.rb
home_page_controller_spec.rb FEATURE: Allow fallback home routes for crawlers for custom homepage sites (#41234) 2026-06-29 09:57:40 -04:00
inline_onebox_controller_spec.rb SECURITY: Check topic visibility in Oneboxer even when categories match 2026-03-31 15:12:45 +01:00
invites_controller_spec.rb FIX: Allow logged-in users to redeem invites when new registrations are disabled (#42026) 2026-07-25 17:02:30 +02:00
list_controller_spec.rb FIX: Enforce public profile visibility in Guardian (#42274) 2026-08-03 13:59:32 -05:00
metadata_controller_spec.rb FEATURE: Accept shared files via the Web Share Target (#41030) 2026-06-18 17:35:09 -03:00
nested_topics_controller_spec.rb FIX: Add small action controls to nested activity log (#42108) 2026-07-29 10:19:47 -05:00
net_http_header_spec.rb
net_http_timeout_spec.rb
noscript_escape_spec.rb
notifications_controller_spec.rb FIX: Gate notification acting_user_name on enable_names setting (#42234) 2026-07-31 14:25:31 -05:00
offline_controller_spec.rb
omniauth_callbacks_controller_spec.rb FEATURE: Allow HTML for OAuth error message (#41204) 2026-06-26 08:35:06 -05:00
onebox_controller_spec.rb FIX: Local user onebox bypasses profile visibility checks and exposes hidden profile data (#42239) 2026-07-31 15:06:41 -05:00
permalinks_controller_spec.rb
post_action_users_controller_spec.rb UX: Ignored users reactions/likes should not show up (#39672) 2026-05-11 15:32:29 -03:00
post_actions_controller_spec.rb FIX: Prevent flagging inaccessible topics (#42362) 2026-08-05 12:22:25 -05:00
post_localizations_controller_spec.rb UX: Allow user to set post and topic title language when manually creating post translations in modal (#41734) 2026-07-16 10:43:39 +08:00
post_readers_controller_spec.rb FIX: Respect group member visibility in private-message read receipts (#42372) 2026-08-06 10:14:39 -05:00
posts_controller_spec.rb FIX: Whisper access bypass for removed users on single-post endpoints (#42323) 2026-08-04 14:29:58 -05:00
presence_controller_spec.rb
published_pages_controller_spec.rb SECURITY: Leakage of hidden tags to unauthorized users (#42218) 2026-07-31 10:53:38 -05:00
push_notification_controller_spec.rb
qunit_controller_spec.rb
reviewable_claimed_topics_controller_spec.rb FIX: Only record deliberate reviewable claims in the timeline (#42375) 2026-08-06 10:08:08 +02:00
reviewable_notes_controller_spec.rb
reviewables_controller_spec.rb FEATURE: Allow suspending and silencing users from the review queue (#42205) 2026-07-31 14:47:40 +02:00
robots_txt_controller_spec.rb
safe_mode_controller_spec.rb
search_controller_spec.rb FEATURE: Allow selection of multiple content languages when viewing topics and posts (#42128) 2026-07-30 12:19:44 +08:00
session_controller_spec.rb UX: Improve password manager and full name handling in code login (#41746) 2026-07-15 10:43:03 -07:00
sidebar_sections_controller_spec.rb FIX: Enforce per-section sidebar link cap on partial updates (#42309) 2026-08-04 09:17:17 -05:00
similar_topics_controller_spec.rb
site_controller_spec.rb SECURITY: Anonymous sidebar serialization exposes descriptions of category-restricted tags 2026-07-28 16:40:22 +02:00
sitemap_controller_spec.rb
slugs_controller_spec.rb
static_controller_spec.rb FIX: Localize static topic pages … (#41260) 2026-06-29 21:34:17 +08:00
steps_controller_spec.rb
stylesheets_controller_spec.rb FEATURE: Design wizard (#42178) 2026-08-07 06:34:46 -05:00
svg_sprite_controller_spec.rb
tag_groups_controller_spec.rb FIX: Consistently exclude synonyms and hidden tags from tag lists (#42364) 2026-08-05 20:29:35 +02:00
tag_localizations_controller_spec.rb
tags_controller_spec.rb FIX: Consistently exclude synonyms and hidden tags from tag lists (#42364) 2026-08-05 20:29:35 +02:00
theme_import_map_spec.rb DEV: Improve cross-plugin/theme import handling (#40939) 2026-06-30 16:11:38 +01:00
theme_javascripts_controller_spec.rb PERF: Move theme settings from js bundle to preload data (#40137) 2026-06-08 16:04:56 +01:00
topic_localizations_controller_spec.rb UX: Allow user to set post and topic title language when manually creating post translations in modal (#41734) 2026-07-16 10:43:39 +08:00
topic_view_stats_controller_spec.rb
topics_controller_spec.rb FIX: Scope PostMover reviewable updates to moved posts (#42371) 2026-08-06 08:31:20 -05:00
uploads_controller_multisite_spec.rb
uploads_controller_spec.rb FIX: Serve inline-safe uploads inline on the local file store (#40739) 2026-07-14 18:52:35 +01:00
user_actions_controller_spec.rb FIX: Bound user-actions index limit at 100 (#42361) 2026-08-05 11:52:53 -05:00
user_api_key_clients_controller_spec.rb
user_api_keys_controller_spec.rb Revert "FIX: Only allow OTPs to be generated from a browser session (#40964)" (#41875) 2026-07-22 18:18:02 +03:00
user_avatars_controller_spec.rb SECURITY: Improve SVG sanitization 2026-06-30 16:10:52 +02:00
user_badges_controller_spec.rb FIX: Enforce public profile visibility in Guardian (#42274) 2026-08-03 13:59:32 -05:00
user_status_controller_spec.rb FIX: Post serialization exposes hidden-profile user status messages (#40885) 2026-06-15 09:25:47 -05:00
users_controller_spec.rb FIX: Consistently exclude synonyms and hidden tags from tag lists (#42364) 2026-08-05 20:29:35 +02:00
users_email_controller_spec.rb DEV: CSRF Token Not Invalidated After Password Reset (#40998) 2026-06-17 16:07:30 -04:00
webhooks_controller_spec.rb SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks 2026-06-30 16:10:52 +02:00
wizard_controller_spec.rb