mirror of
https://github.com/discourse/discourse.git
synced 2026-08-11 02:59:07 +08:00
56e9ffc8f4Backport of #42109 to release/2026.6. --- ## Summary The invitee-list route for private events previously authorized only host-post visibility, allowing an authenticated viewer to retrieve attendee identities, RSVP states, and attendance totals that should be hidden. The fix enforces the same private-event detail policy used by EventSerializer before returning invitee data, returning a 403 error to unauthorized viewers. ## Source - Patch Triage: https://patch.discourse.org/patch-triage/1546 Co-authored-by: discourse-patch-triage <272280883+discourse-patch-triage[bot]@users.noreply.github.com> Co-authored-by: Bannon Tanner <bannon@discourse.org> |
||
|---|---|---|
| .. | ||
| action | ||
| event | ||
| bulk_invite.rb | ||
| chat_channel_sync.rb | ||
| create_invitee.rb | ||
| csv_bulk_invite.rb | ||
| destroy_event.rb | ||
| destroy_invitee.rb | ||
| invite.rb | ||
| list_invitees.rb | ||
| update_invitee.rb | ||
