Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-08 17:53:55 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-post-voting/lib
History
Exact
discoursebot 58e45dc7c9
 SECURITY: Reviewable conversations expose post-voting flag PM excerpts to category moderators outside the PM [backport 2026.1] (#41531) 
Backport of #41527 to release/2026.1.

---

## Summary

Prevent unauthorized access to private message excerpts in reviewable
responses by ensuring companion conversations are only serialized when
the viewer has permission to see the underlying topic. The patch also
ensures category moderators receive legitimate access to post-voting
flag conversations by including the relevant moderation groups in the
private message recipient list.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1282

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Isaac Janzen <50783505+janzenisaac@users.noreply.github.com>
2026-07-07 15:37:32 -05:00
..
discourse_dev DEV: Add discourse-dev seed for post voting reviewable (#35435) 2025-10-21 09:57:05 +08:00
post_voting SECURITY: Reviewable conversations expose post-voting flag PM excerpts to category moderators outside the PM [backport 2026.1] (#41531) 2026-07-07 15:37:32 -05:00