Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-09 21:45:25 +08:00
Code Packages Activity Actions
discourse/spec/requests
History
Exact
discoursebot d32c1381a5
 SECURITY: Enforce first-post visibility for topic bookmarks [backport 2026.6] (#42354) 
Backport of #42321 to release/2026.6.

---

## Summary

Topic bookmark creation, listing, search, and reminder eligibility now
require the first post to be visible to the user. The fix adds an inner
join on the first post with hidden-post filtering to the list query and
delegates creation and visibility checks to `guardian.can_see_post?` on
the first post, preventing an authenticated user from bookmarking a
topic or searching its metadata after the first post is hidden.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1530

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

---------

Co-authored-by: Chris Alberti <christo@discourse.org>
2026-08-05 12:53:18 -05:00
..
admin FEATURE: Bulk suspend users and filter the admin users list by activation (#41227) 2026-06-29 11:26:34 +02:00
api SECURITY: Stop exposing hidden tag names through category serializers [backport 2026.6] 2026-07-28 17:05:36 +02:00
examples
about_controller_spec.rb FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
anonymous_actions_controller_spec.rb FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256) 2026-05-26 09:30:38 +02:00
application_controller_spec.rb SECURITY: Prevent cache poisoning/XSS via color scheme cookies [backport 2026.6] 2026-07-28 17:05:36 +02:00
associate_accounts_controller_spec.rb
badges_controller_spec.rb FEATURE: Add a granular API key scope to list badges (#41086) 2026-06-22 18:32:02 +02:00
bookmarks_controller_spec.rb SECURITY: Enforce first-post visibility for topic bookmarks [backport 2026.6] (#42354) 2026-08-05 12:53:18 -05:00
calendar_subscriptions_controller_spec.rb FEATURE: Add calendar subscription URLs to user preferences (#38598) 2026-03-17 10:28:20 -03:00
categories_controller_spec.rb SECURITY: Limit Category search term and word count [backport 2026.6] (#41595) 2026-07-31 19:14:55 -05:00
clicks_controller_spec.rb SECURITY: Missing visibility check in click tracking endpoint (#41140) 2026-06-24 15:15:56 +10:00
composer_controller_spec.rb SECURITY: Respect group member visibility for counts [backport 2026.6] (#41408) 2026-07-06 12:47:57 +08:00
composer_messages_controller_spec.rb SECURITY: Duplicate lookup reveals restricted topic titles through canonicalized URLs [backport 2026.6] 2026-07-28 17:05:36 +02:00
crawler_hreflang_spec.rb FIX: Use hyphens instead of underscores for hreflang tags (#39884) 2026-05-19 21:18:46 +08:00
default_headers_spec.rb
dev_mode_controller_spec.rb DEV: Add /dev-mode endpoint for MiniProfiler auth cookie (#37027) 2026-01-12 10:01:20 +08:00
directory_columns_controller_spec.rb
directory_items_controller_spec.rb SECURITY: Private UserField value disclosure via directory_items order sort side-channel [backport 2026.6] (#41599) 2026-07-09 21:52:59 -05:00
discourse_id_controller_spec.rb FIX: Revocation endpoint is blocked when login_required is enabled, preventing session invalidation (#37859) 2026-02-17 09:12:14 -05:00
do_not_disturb_controller_spec.rb
drafts_controller_spec.rb FIX: Drafts/reviewables API returned 404 when acting on own resource (#39449) 2026-05-26 09:29:20 +02:00
edit_directory_columns_controller_spec.rb
email_controller_spec.rb
embed_controller_spec.rb SECURITY: Partition anonymous cache keys by Referer for embed routes [backport 2026.6] (#42369) 2026-08-05 12:51:08 -05:00
emojis_controller_spec.rb FEATURE: Locale-specific emoji search aliases (#39089) 2026-04-06 14:08:46 -03:00
exceptions_controller_spec.rb FIX: Respect forced color mode for logo on server-rendered pages (#37032) 2026-01-09 11:33:06 +01:00
export_csv_controller_spec.rb FIX: Suspicious login IPs bypass the moderator IP-visibility setting (#40154) 2026-05-22 13:22:32 +08:00
extra_locales_controller_spec.rb DEV: Refactor locale bundle loading (#37114) 2026-01-16 11:45:14 +00:00
finish_installation_controller_spec.rb
form_templates_controller_spec.rb SECURITY: Scope form template endpoints to accessible categories 2026-05-19 00:26:04 +01:00
forums_controller_spec.rb
groups_controller_spec.rb SECURITY: Shared-draft titles and excerpts leak through group post serialization [backport 2026.6] 2026-07-28 17:05:36 +02:00
hashtags_controller_spec.rb
highlightjs_controller_spec.rb
home_page_controller_spec.rb FEATURE: Allow fallback home routes for crawlers for custom homepage sites (#41234) 2026-06-29 09:57:40 -04:00
inline_onebox_controller_spec.rb SECURITY: Check topic visibility in Oneboxer even when categories match 2026-03-31 15:12:45 +01:00
invites_controller_spec.rb FIX: Reject DiscourseConnect SSO payloads when secret is blank (#40830) 2026-06-12 15:17:16 +03:00
list_controller_spec.rb SECURITY: Harden ListController top period query against SQL injection [backport 2026.6] (#41721) 2026-07-15 12:18:05 +08:00
metadata_controller_spec.rb FEATURE: Accept shared files via the Web Share Target (#41030) 2026-06-18 17:35:09 -03:00
nested_topics_controller_spec.rb DEV: route nested view through topic route (#40820) 2026-06-15 11:42:20 -05:00
net_http_header_spec.rb
net_http_timeout_spec.rb DEV: fix a large amount of typos (#37428) 2026-02-02 16:31:58 +11:00
noscript_escape_spec.rb
notifications_controller_spec.rb
offline_controller_spec.rb
omniauth_callbacks_controller_spec.rb FEATURE: Allow HTML for OAuth error message (#41204) 2026-06-26 08:35:06 -05:00
onebox_controller_spec.rb SECURITY: prevent hidden profile data leak via user onebox 2026-03-19 15:21:28 +00:00
permalinks_controller_spec.rb SECURITY: prevent permalink redirects from leaking restricted slugs 2026-01-28 17:11:14 +00:00
post_action_users_controller_spec.rb UX: Ignored users reactions/likes should not show up (#39672) 2026-05-11 15:32:29 -03:00
post_actions_controller_spec.rb SECURITY: fix is_warning type coercion bypass in PostActionsController 2026-03-19 15:21:28 +00:00
post_localizations_controller_spec.rb
post_readers_controller_spec.rb SECURITY: Missing post-level authorization allows whisper metadata disclosure 2026-03-31 15:12:45 +01:00
posts_controller_spec.rb SECURITY: Block requests for hidden post revisions through historical version reconstruction [backport 2026.6] (#42271) 2026-08-03 12:28:43 -05:00
presence_controller_spec.rb
published_pages_controller_spec.rb SECURITY: Leakage of hidden tags to unauthorized users [backport 2026.6] (#42226) 2026-07-31 12:39:46 -05:00
push_notification_controller_spec.rb
qunit_controller_spec.rb DEV: Cache AssetProcessor code in development (#38036) 2026-02-25 11:24:41 +00:00
reviewable_claimed_topics_controller_spec.rb SECURITY: Require topic visibility for category group moderator actions 2026-05-19 00:26:04 +01:00
reviewable_notes_controller_spec.rb SECURITY: scope reviewable notes to user-visible reviewables 2026-02-26 12:22:54 +00:00
reviewables_controller_spec.rb SECURITY: Respect topic visibility in reviewable score serializer [backport 2026.6] 2026-07-28 17:05:36 +02:00
robots_txt_controller_spec.rb
safe_mode_controller_spec.rb
search_controller_spec.rb SECURITY: Apply category tag visibility to full-text search [backport 2026.6] (#41671) 2026-07-13 15:53:31 -03:00
session_controller_spec.rb FEATURE: Sign up with a one-time email code (#40909) 2026-06-23 11:30:18 -07:00
sidebar_sections_controller_spec.rb FIX: raise 404 when sidebar section doesn't exist (#37675) 2026-02-10 15:47:49 +01:00
similar_topics_controller_spec.rb
site_controller_spec.rb SECURITY: Anonymous sidebar serialization exposes descriptions of category-restricted tags [backport 2026.6] 2026-07-28 17:05:36 +02:00
sitemap_controller_spec.rb
slugs_controller_spec.rb
static_controller_spec.rb FIX: Localize static topic pages … (#41260) 2026-06-29 21:34:17 +08:00
steps_controller_spec.rb
stylesheets_controller_spec.rb DEV: Allow plugins to register admin-panel-specific CSS (#40345) 2026-05-28 11:03:38 +01:00
svg_sprite_controller_spec.rb
tag_groups_controller_spec.rb FIX: Prevent tag group from saving if private + no group selected (#39599) 2026-04-29 12:10:45 +08:00
tag_localizations_controller_spec.rb FIX: Clean localized tag names (#38488) 2026-03-12 12:54:50 +08:00
tags_controller_spec.rb FIX: Ensure /tag/bad-slug/:id/edit routes to edit page (#41115) 2026-06-23 18:58:50 +08:00
theme_javascripts_controller_spec.rb PERF: Move theme settings from js bundle to preload data (#40137) 2026-06-08 16:04:56 +01:00
topic_localizations_controller_spec.rb
topic_view_stats_controller_spec.rb
topics_controller_spec.rb SECURITY: DoS vis uncapped Bulk Topic Actions [backport 2026.6] (#42002) 2026-07-23 23:07:22 +01:00
uploads_controller_multisite_spec.rb FIX: Multisite prevent anons from downloading files (#37979) 2026-02-24 10:49:14 +10:00
uploads_controller_spec.rb SECURITY: Regular users can route multipart uploads into the admin backup store 2026-06-30 16:10:52 +02:00
user_actions_controller_spec.rb FIX: Prevent hidden excerpts in user actions (#40028) 2026-05-14 18:35:39 +05:30
user_api_key_clients_controller_spec.rb FIX: Empty-scopes bypass allows untrusted client registration and downstream scope/redirect policy bypass (#37855) 2026-02-17 12:39:09 +11:00
user_api_keys_controller_spec.rb Revert "FIX: Only allow OTPs to be generated from a browser session (#40964)" (#41875) (#41920) 2026-07-22 18:56:56 +03:00
user_avatars_controller_spec.rb SECURITY: Improve SVG sanitization 2026-06-30 16:10:52 +02:00
user_badges_controller_spec.rb SECURITY: Prevent badge lookup from exposing hidden profiles (#41160) 2026-06-25 13:01:03 +08:00
user_status_controller_spec.rb FIX: Post serialization exposes hidden-profile user status messages (#40885) 2026-06-15 09:25:47 -05:00
users_controller_spec.rb SECURITY: Enforce first-post visibility for topic bookmarks [backport 2026.6] (#42354) 2026-08-05 12:53:18 -05:00
users_email_controller_spec.rb DEV: CSRF Token Not Invalidated After Password Reset (#40998) 2026-06-17 16:07:30 -04:00
webhooks_controller_spec.rb SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks 2026-06-30 16:10:52 +02:00
wizard_controller_spec.rb