Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-09 21:45:25 +08:00
Code Packages Activity Actions
discourse/spec
History
Exact
discoursebot 408c3162a1
 SECURITY: Limit Category search term and word count [backport 2026.5] (#41596) 
Backport of #41588 to release/2026.5.

---

#### Description

Category search accepted an unbounded term from anonymous requests and
expanded every whitespace-separated word into an ILIKE predicate. Large
terms could generate expensive SQL and tie up request workers.


#### Fix

Cap the total term length and the number of words used for SQL filters.

Co-authored-by: jdmartinez1062 <juan@discourse.org>
2026-07-31 19:14:59 -05:00
..
db DEV: Move Community sidebar section + links from migrations to seed fixture (#39973) 2026-05-13 12:13:12 +01:00
fabricators FEATURE: Add top countries and top referrers cards to the admin dashboard (#40215) 2026-05-22 12:59:16 +08:00
fixtures
generator DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
helpers SECURITY: Bind shared session key to auth token and enforce user gates [backport 2026.5] (#41644) 2026-07-14 13:25:33 +08:00
import_export
initializers SECURITY: Harden imagemagick execution [backport 2026.5] 2026-06-30 16:17:06 +02:00
integration FIX: Correctly rescue failed embed_mode parsing (#40298) 2026-05-26 15:29:48 +01:00
integrity DEV: Enforce learn_more_url for upcoming changes (#40150) 2026-05-20 16:18:28 +10:00
jobs SECURITY: Authorize secure-upload hotlink downloads against post user [backport 2026.5] 2026-06-30 16:17:06 +02:00
lib SECURITY: Prevent cache poisoning/XSS via color scheme cookies [backport 2026.5] 2026-07-28 17:03:00 +02:00
mailers DEV: Automatically detect and revert translation overrides in specs (#40003) 2026-05-13 22:09:23 +02:00
models SECURITY: Respect topic visibility in reviewable score serializer [backport 2026.5] 2026-07-28 17:03:00 +02:00
multisite DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
queries/reports FEATURE: Activity by category section of the new dashboard's engagement section (#40227) 2026-05-22 13:10:38 +08:00
requests SECURITY: Limit Category search term and word count [backport 2026.5] (#41596) 2026-07-31 19:14:59 -05:00
script/import_scripts
serializers SECURITY: Stop exposing hidden tag names through category serializers [backport 2026.5] 2026-07-28 17:03:00 +02:00
services SECURITY: Stale featured rows expose unlisted topic content [backport 2026.5] (#41812) 2026-07-17 09:38:39 -05:00
support FIX: type: objects uploads should be stored as IDs (#40178) 2026-05-21 13:45:27 -03:00
system SECURITY: Stored XSS in staff action logs injects staff UI [backport 2026.5] 2026-07-28 17:03:00 +02:00
tasks FIX: type: objects uploads should be stored as IDs (#40178) 2026-05-21 13:45:27 -03:00
views
rails_helper.rb DEV: Fix dashboard date picker spec [backport 2026.5] (#40701) 2026-06-09 18:23:14 +01:00
regenerate_swagger_docs
swagger_helper.rb