Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/spec/models
History
Exact
discoursebot d32c1381a5
 SECURITY: Enforce first-post visibility for topic bookmarks [backport 2026.6] (#42354) 
Backport of #42321 to release/2026.6.

---

## Summary

Topic bookmark creation, listing, search, and reminder eligibility now
require the first post to be visible to the user. The fix adds an inner
join on the first post with hidden-post filtering to the list query and
delegates creation and visibility checks to `guardian.can_see_post?` on
the first post, preventing an authenticated user from bookmarking a
topic or searching its metadata after the first post is hidden.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1530

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

---------

Co-authored-by: Chris Alberti <christo@discourse.org>
2026-08-05 12:53:18 -05:00
..
concerns FEATURE: Access control list UI and backend (#41009) 2026-06-29 09:44:58 +10:00
reports Revert "FEATURE: Surface Direct traffic in the Top referrers dashboard card (#40470)" (#40508) 2026-06-03 10:24:24 +08:00
about_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
access_control_list_spec.rb DEV: Additional changes to ACL backend (#41251) 2026-06-29 11:02:51 +10:00
admin_dashboard_data_spec.rb DEV: Remove old problem check system - part 2 (#34403) 2025-08-20 16:15:21 +08:00
admin_dashboard_report_spec.rb DEV: Scaffold backend for the new admin dashboard Reports section (#40017) 2026-05-20 09:53:26 +03:00
admin_dashboard_section_spec.rb DEV: Persist dashboard configuration in table and *not* on closure of the dialog (#40546) 2026-06-04 10:53:59 +08:00
admin_notice_spec.rb DEV: Database backed admin notices (#26192) 2024-05-23 09:29:08 +08:00
api_key_scope_spec.rb DEV: Add tests for intentional granular API key behavior for /about (#39922) 2026-05-12 09:05:11 -05:00
api_key_spec.rb DEV: allow granular api keys access to about.json 2026-04-21 11:06:25 -04:00
application_request_spec.rb
associated_group_spec.rb DEV: fix a large amount of typos (#37428) 2026-02-02 16:31:58 +11:00
badge_grouping_spec.rb DEV: Remove unnecessary rails_helper requiring (#26364) 2024-03-26 11:32:01 +01:00
badge_spec.rb FIX: Allow badges with SQL queries to be manually granted (#36866) 2026-01-09 13:58:09 +01:00
badge_type_spec.rb
bookmark_spec.rb FIX: notification reminder is deleted with bookmark (#35141) 2025-10-03 08:34:19 +02:00
browser_pageview_country_daily_rollup_spec.rb PERF: Daily rollups for top countries and top referrers reports (#40285) 2026-05-26 14:35:20 +08:00
browser_pageview_event_spec.rb DEV: Track beacon browser pageviews behind dashboard_improvements (#40934) 2026-06-23 10:21:39 +08:00
browser_pageview_referrer_daily_rollup_spec.rb FIX: Backfill normalized referrer for historical browser pageviews (#40357) 2026-06-09 09:04:57 +08:00
category_featured_topic_spec.rb
category_group_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
category_list_spec.rb DEV: fix a large amount of typos (#37428) 2026-02-02 16:31:58 +11:00
category_localization_spec.rb FEATURE: Show translated category names from localizations table if they exist for the user locale (#32380) 2025-04-22 15:13:19 +08:00
category_posting_review_group_spec.rb FEATURE: Support group based category posting review modes (#38707) 2026-04-07 10:41:16 +08:00
category_setting_spec.rb FEATURE: Support group based category posting review modes (#38707) 2026-04-07 10:41:16 +08:00
category_spec.rb SECURITY: Harden ListController top period query against SQL injection [backport 2026.6] (#41721) 2026-07-15 12:18:05 +08:00
category_tag_stat_spec.rb
category_user_spec.rb FIX: Respect user's manual topic notification level changes (#39037) 2026-04-02 11:05:00 +02:00
child_theme_spec.rb
color_scheme_color_spec.rb
color_scheme_spec.rb FEATURE: Allow editing theme-owned palettes (#34722) 2025-10-06 09:02:39 +03:00
developer_spec.rb
digest_email_site_setting_spec.rb
directory_item_spec.rb PERF: DirectoryItem.refresh! daily can take an extremely long time (#35860) 2025-11-10 13:23:23 +10:00
discourse_connect_spec.rb FIX: Reject DiscourseConnect SSO payloads when secret is blank (#40830) 2026-06-12 15:17:16 +03:00
do_not_disturb_timing_spec.rb
draft_sequence_spec.rb FEATURE: Multiple Draft Topics (#30790) 2025-01-29 10:23:26 +04:00
draft_spec.rb FIX: certain edge cases could leave phantom drafts behind (#37130) 2026-01-16 13:17:18 +11:00
email_change_request_spec.rb
email_log_spec.rb
email_login_code_spec.rb FEATURE: Log in with a one-time email code (#40804) 2026-06-17 12:34:48 -07:00
email_token_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
embeddable_host_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
embeddable_host_tag_spec.rb FEATURE: Extend embeddable hosts with Individual tags and author assignments (#26868) 2024-05-16 15:47:01 -04:00
emoji_spec.rb FIX: security hardening form codes_to_img (#39776) 2026-05-06 15:22:28 +10:00
flag_spec.rb FIX: Ensure each flag gets a unique name_key (#40899) 2026-06-24 16:37:59 +02:00
form_template_spec.rb DEV: Expand top_tags, topic.tags, etc, to return an array of tag objects instead of tag names (#36678) 2026-02-02 10:03:02 +08:00
given_daily_like_spec.rb
global_setting_spec.rb DEV: Allow loading specific plugins in development (#39975) 2026-05-13 14:13:32 +01:00
group_archived_message_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
group_associated_group_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
group_history_spec.rb
group_request_spec.rb
group_spec.rb FEATURE: Access control list UI and backend (#41009) 2026-06-29 09:44:58 +10:00
group_user_spec.rb PERF: Add Users to Group Improvements Pt. 3 (#39091) 2026-04-20 09:38:16 -05:00
ignored_user_spec.rb FIX: Hide ignored user posts from nested topic view (#39504) 2026-04-28 12:50:09 -05:00
incoming_link_spec.rb
incoming_links_report_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
invite_redeemer_spec.rb PERF: Add Users to Group Improvements Pt. 3 (#39091) 2026-04-20 09:38:16 -05:00
invite_spec.rb FIX: reduce redemption_count when invited user is destroyed (#35695) 2025-10-30 13:43:51 +11:00
javascript_cache_spec.rb
locale_site_setting_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
mailing_list_mode_site_setting_spec.rb
moved_post_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
notification_spec.rb DEV: route nested view through topic route (#40820) 2026-06-15 11:42:20 -05:00
onebox_locale_site_setting_spec.rb FEATURE: Add a onebox_locale site setting. (#30655) 2025-01-09 14:11:37 +11:00
optimized_image_spec.rb SECURITY: Harden imagemagick execution 2026-06-30 16:10:52 +02:00
optimized_video_spec.rb DEV: Ensure optimized videos have the correct acl (#36364) 2025-12-01 19:50:08 -07:00
permalink_spec.rb SECURITY: prevent permalink redirects from leaking restricted slugs 2026-01-28 17:11:14 +00:00
plugin_store_spec.rb
post_action_spec.rb DEV: Restore and update a post_action spec (#39594) 2026-04-28 18:48:50 +02:00
post_action_type_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
post_analyzer_spec.rb
post_detail_spec.rb
post_localization_spec.rb FEATURE: Add support for uploads on translated posts (#35871) 2025-11-12 08:55:21 -08:00
post_mover_spec.rb FIX: Moved reviewable post content leaks to old category moderators (#41041) 2026-06-19 16:31:55 -05:00
post_reply_key_spec.rb
post_reply_spec.rb
post_revision_spec.rb
post_spec.rb FEATURE: Localize local oneboxes (#40493) 2026-06-08 11:49:55 +08:00
post_stripper_spec.rb
post_timing_spec.rb FIX: update PM tracking state when marking messages as unread (#36258) 2025-11-26 18:29:35 +01:00
private_message_topic_tracking_state_spec.rb FEATURE: Exclude small actions from topic counters and unread tracking (#40481) 2026-06-08 08:03:55 +02:00
problem_check_tracker_spec.rb FEATURE: Add problem checks page to admin panel and allow ignoring problem checks (#39103) 2026-04-23 08:28:33 +08:00
published_page_spec.rb
quoted_post_spec.rb
remote_theme_spec.rb FEATURE: Show theme d-compat/* refs in admin UI (#40649) 2026-06-17 22:13:45 +01:00
report_spec.rb PERF: Compute dashboard KPIs in a single pass (#40705) 2026-06-10 21:09:27 +08:00
reviewable_claimed_topic_spec.rb FEATURE: Sync Reviewable Status (#31901) 2025-03-24 14:27:18 +11:00
reviewable_flagged_post_spec.rb FIX: Disagreeing with a flag fails to restore posts by demoted users (#40228) 2026-05-22 00:29:04 +02:00
reviewable_history_spec.rb
reviewable_note_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
reviewable_post_spec.rb DEV: Remove reviewable_ui_refresh feature flag and legacy code (#36752) 2026-02-23 10:45:36 +08:00
reviewable_queued_post_spec.rb FEATURE: Link staff action log entries to originating reviewable (#39519) 2026-04-30 09:15:45 +08:00
reviewable_score_spec.rb SECURITY: Respect topic visibility in reviewable score serializer [backport 2026.6] 2026-07-28 17:05:36 +02:00
reviewable_spec.rb SECURITY: Scope PM reviewables to their allowed audience [backport 2026.6] 2026-07-28 17:05:36 +02:00
reviewable_user_spec.rb Revert "FEATURE: discourse-workflows (#39704)" (#40366) 2026-05-28 13:59:42 +01:00
s3_region_site_setting_spec.rb
screened_email_spec.rb
screened_ip_address_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
screened_url_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
search_log_spec.rb FIX: Exclude anonymous searches from the dashboard search section (#40966) 2026-06-17 14:32:04 +08:00
sidebar_section_link_spec.rb
sidebar_section_spec.rb FEATURE: dynamic search when in /filter route (#33614) 2025-07-22 16:08:10 +10:00
sidebar_url_spec.rb
site_setting_localization_spec.rb FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
site_setting_spec.rb FEATURE: Allow fallback home routes for crawlers for custom homepage sites (#41234) 2026-06-29 09:57:40 -04:00
site_spec.rb FEATURE: add modifier to restrict theme color schemes (#38796) 2026-03-26 09:03:11 -04:00
sitemap_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
skipped_email_log_spec.rb
stat_spec.rb FIX: Stat type grouping (#40783) 2026-06-11 16:59:33 +10:00
stylesheet_cache_spec.rb
tag_group_spec.rb FIX: Enforce tag group permissions for non-admin staff (#37377) 2026-01-29 18:06:38 +08:00
tag_localization_spec.rb FIX: Clean localized tag names (#38488) 2026-03-12 12:54:50 +08:00
tag_spec.rb FIX: Tag search 500 when content_localization is enabled (#37769) 2026-02-12 23:58:03 +08:00
tag_user_spec.rb FIX: Respect user's manual topic notification level changes (#39037) 2026-04-02 11:05:00 +02:00
theme_field_spec.rb PERF: Move theme settings from js bundle to preload data (#40137) 2026-06-08 16:04:56 +01:00
theme_modifier_set_spec.rb
theme_setting_spec.rb FIX: type: objects uploads should be stored as IDs (#40178) 2026-05-21 13:45:27 -03:00
theme_settings_migration_spec.rb
theme_site_setting_spec.rb DEV: Refactor and add missing tests for upload type in objects schema (#36285) 2025-11-28 04:02:23 +08:00
theme_spec.rb PERF: Move theme settings from js bundle to preload data (#40137) 2026-06-08 16:04:56 +01:00
theme_svg_sprite_spec.rb
top_menu_item_spec.rb
top_topic_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_allowed_user_spec.rb
topic_converter_spec.rb FEATURE: Bulk convert PMs to public topics (and vice versa) (#39256) 2026-04-21 15:08:39 +02:00
topic_embed_spec.rb SECURITY: Escape embed URL for HTML attribute context in footer [backport 2026.6] (#42316) 2026-08-04 10:06:43 -05:00
topic_featured_users_spec.rb
topic_group_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
topic_hot_scores_spec.rb FIX: Exclude unlisted topics from hot scores (#37312) 2026-01-27 13:46:57 +11:00
topic_invite_spec.rb
topic_link_click_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_link_spec.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
topic_list_spec.rb DEV: Expand top_tags, topic.tags, etc, to return an array of tag objects instead of tag names (#36678) 2026-02-02 10:03:02 +08:00
topic_localization_spec.rb DEV: Add rake task to backfill localization excerpts which were empty (#36901) 2025-12-30 17:04:36 +08:00
topic_participant_groups_summary_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_participants_summary_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_posters_summary_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_spec.rb SECURITY: Normalize and escape topic featured links 2026-06-30 16:10:52 +02:00
topic_tag_spec.rb
topic_thumbnail_spec.rb FEATURE: Add animated_topic_thumbnails site setting (#39165) 2026-04-08 23:51:01 +02:00
topic_timer_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
topic_tracking_state_spec.rb FEATURE: Add upcoming change for unified new view (#40631) 2026-06-09 11:34:22 +10:00
topic_user_spec.rb DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
topic_view_item_spec.rb FEATURE: topic_view_stats table with daily fidelity (#27197) 2024-05-27 15:25:32 +10:00
translation_override_spec.rb UX: Display interpolation keys as interactive pills in admin editors (#37254) 2026-02-27 21:21:26 +01:00
trust_level3_requirements_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
trust_level_and_staff_setting_spec.rb
trust_level_setting_spec.rb DEV: Fix flaky deprecated setting specs (#30550) 2025-01-04 12:55:22 +01:00
unsubscribe_key_spec.rb
upload_reference_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
upload_spec.rb FIX: Skip dominant color calculation when the upload file is missing [backport 2026.6] (#42167) 2026-07-30 16:58:07 +01:00
user_action_spec.rb SECURITY: Restrict user action removal messages [backport 2026.6] (#41409) 2026-07-03 17:56:23 +08:00
user_api_key_spec.rb FEATURE: User API key device authorization flow (#40189) 2026-06-10 16:09:44 -04:00
user_archived_message_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
user_associated_group_spec.rb FIX: Do not remove user from group with no association inadvertently (#39854) 2026-05-08 12:48:56 -04:00
user_auth_token_spec.rb SECURITY: Bind shared session key to auth token and enforce user gates [backport 2026.6] (#41643) 2026-07-14 13:25:29 +08:00
user_avatar_spec.rb DEV: ensure rebaking works even when some users have inconsistent data (#30261) 2024-12-16 19:48:25 +08:00
user_badge_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
user_bookmark_list_spec.rb SECURITY: Enforce first-post visibility for topic bookmarks [backport 2026.6] (#42354) 2026-08-05 12:53:18 -05:00
user_custom_field_spec.rb FIX: Searchable user fields do not always have an integer name (#30223) 2024-12-17 11:06:19 +11:00
user_email_spec.rb FIX: allow users with normalized emails to change emails and remove + / . (#37133) 2026-01-16 07:36:58 +11:00
user_export_spec.rb FEATURE: Allow admins to export users (#30918) 2025-01-24 08:13:25 +11:00
user_field_spec.rb FEATURE: Implement new required options in admin user fields UI (#27079) 2024-05-23 19:18:25 +08:00
user_history_spec.rb SECURITY: Restrict staff action logs visibility for moderators 2026-01-28 17:11:14 +00:00
user_notification_schedule_spec.rb
user_option_spec.rb FEATURE: Convert watched_precedence_over_muted to default site setting (#35671) 2025-10-30 10:04:18 +10:00
user_password_spec.rb FIX: setting new password should reset password_expired_at (#29296) 2024-10-21 07:24:43 +08:00
user_profile_spec.rb
user_profile_view_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
user_search_spec.rb FIX: Match searchable custom fields when searching the user directory (#40698) 2026-06-10 08:16:35 +02:00
user_second_factor_spec.rb
user_security_key_spec.rb
user_spec.rb SECURITY: Signup-time primary_group_id assignment grants whisperer access 2026-06-30 16:10:52 +02:00
user_stat_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
user_status_spec.rb
user_summary_spec.rb SECURITY: Enforce first-post visibility for topic bookmarks [backport 2026.6] (#42354) 2026-08-05 12:53:18 -05:00
user_visit_spec.rb PERF: Rewrite DAU/MAU rolling count as a non-correlated sweep (#40692) 2026-06-10 17:21:49 +08:00
username_validator_spec.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
watched_word_group_spec.rb SECURITY: limit the number of characters in watched word replacements. 2024-07-15 19:25:17 +08:00
watched_word_spec.rb SECURITY: limit the number of characters in watched word replacements. 2024-07-15 19:25:17 +08:00
web_crawler_request_spec.rb
web_hook_event_spec.rb
web_hook_event_type_spec.rb FEAT: add webhooks for calendar events (#38315) 2026-03-09 12:30:19 -05:00
web_hook_events_daily_aggregate_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
web_hook_spec.rb PERF: Add Users to Group Pt. 1 (#38737) 2026-03-26 09:11:22 -05:00