Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/app
History
Exact
Chris Alberti 7584509977
 SECURITY: Enforce first-post visibility for topic bookmarks [backport 2026.1] (#42356) 
Backport of #42321 to release/2026.1.

Manual backport to also include the fix from PR #39873 (commit
05e03eab29) which was never backported to 2026.1

---

## Summary

Topic bookmark creation, listing, search, and reminder eligibility now
require the first post to be visible to the user. The fix adds an inner
join on the first post with hidden-post filtering to the list query and
delegates creation and visibility checks to `guardian.can_see_post?` on
the first post, preventing an authenticated user from bookmarking a
topic or searching its metadata after the first post is hidden.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1530

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

---------

Co-authored-by: Sam <sam.saffron@gmail.com>
Co-authored-by: discourse-patch-triage[bot] <272280883+discourse-patch-triage[bot]@users.noreply.github.com>
Co-authored-by: Gabriel Grubba <70247653+Grubba27@users.noreply.github.com>
2026-08-05 12:53:28 -05:00
..
assets UX: Improve post stream scrolling stability and layout control [backport 2026.1] (#38318) 2026-03-06 10:06:47 -06:00
controllers SECURITY: Block requests for hidden post revisions through historical version reconstruction [backport 2026.1] (#42272) 2026-08-03 12:36:17 -05:00
helpers SECURITY: Prevent cache poisoning/XSS via color scheme cookies [backport 2026.1] 2026-07-28 17:00:54 +02:00
jobs SECURITY: Authorize secure-upload hotlink downloads against post user [backport 2026.1] 2026-06-30 16:27:06 +02:00
mailers UX: improve sender name in emails (#36974) 2026-01-06 15:41:01 +04:00
models SECURITY: Escape embed URL for HTML attribute context in footer [backport 2026.1] (#42317) 2026-08-04 11:00:16 -05:00
queries/reports FEATURE: Add admin-only reports and centralize report visibility logic 2026-01-28 17:11:14 +00:00
serializers SECURITY: Enforce first-post visibility for topic bookmarks [backport 2026.1] (#42356) 2026-08-05 12:53:28 -05:00
services SECURITY: Enforce first-post visibility for topic bookmarks [backport 2026.1] (#42356) 2026-08-05 12:53:28 -05:00
views FIX: Strip HTML from category og:description meta tag (#37322) 2026-01-27 18:16:35 +11:00