Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-12 05:37:26 +08:00
Code Packages Activity Actions
discourse/plugins/chat/spec/jobs
History
Exact
discoursebot 1af4206733
 SECURITY: Scope thread-read reset to originating channel and restrict bulk trigger to c... [backport 2026.6] (#42478) 
Backport of #42417 to release/2026.6.

---

## Summary

A chat participant could enable threading in their own DM and trigger a
thread-read reset job that marked thread memberships as read across all
channels, including private DMs the attacker could not access. The patch
scopes the SQL update to the target channel and only enqueues the bulk
reset when threading is enabled on a category channel.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1531

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Chris Alberti <christo@discourse.org>
2026-08-10 09:54:46 -05:00
..
regular SECURITY: Scope thread-read reset to originating channel and restrict bulk trigger to c... [backport 2026.6] (#42478) 2026-08-10 09:54:46 -05:00
scheduled FEATURE: Pin chat messages (#37985) 2026-02-23 22:00:16 +01:00