Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-11 02:59:07 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-reactions/app/controllers/discourse_reactions
History
Exact
discoursebot 7209b52679
 SECURITY: anonymous users can read hidden real names via reaction-user endpoints [backport 2026.6] (#41933) 
Backport of #41931 to release/2026.6.

---

## Summary

Fix anonymous disclosure of hidden full names of reactors and likers via
reaction-user APIs when `enable_names` setting is disabled. The
`CustomReactionsController` now conditionally includes the `name` field
only when `enable_names` is enabled, ensuring the invariant that hidden
full names are not exposed to unauthenticated users.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1451

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Isaac Janzen <50783505+janzenisaac@users.noreply.github.com>
2026-07-22 12:22:42 -05:00
..
custom_reactions_controller.rb SECURITY: anonymous users can read hidden real names via reaction-user endpoints [backport 2026.6] (#41933) 2026-07-22 12:22:42 -05:00