Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/spec/serializers
History
Exact
discoursebot d32c1381a5
 SECURITY: Enforce first-post visibility for topic bookmarks [backport 2026.6] (#42354) 
Backport of #42321 to release/2026.6.

---

## Summary

Topic bookmark creation, listing, search, and reminder eligibility now
require the first post to be visible to the user. The fix adds an inner
join on the first post with hidden-post filtering to the list query and
delegates creation and visibility checks to `guardian.can_see_post?` on
the first post, preventing an authenticated user from bookmarking a
topic or searching its metadata after the first post is hidden.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1530

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

---------

Co-authored-by: Chris Alberti <christo@discourse.org>
2026-08-05 12:53:18 -05:00
..
concerns FEATURE: Prevent silenced users from liking and using reactions (#37040) 2026-01-13 13:59:57 +01:00
about_serializer_spec.rb FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
admin_detailed_user_serializer_spec.rb SECURITY: AdminDetailedUserSerializer#latest_export leaking user exports 2026-01-28 17:11:14 +00:00
admin_plugin_serializer_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
admin_user_action_serializer_spec.rb
admin_user_list_serializer_spec.rb FIX: Staged user emails bypass moderator email visibility setting (#40411) 2026-05-29 19:26:17 -03:00
auth_provider_serializer_spec.rb
basic_group_serializer_spec.rb
basic_group_user_serializer_spec.rb
basic_post_serializer_spec.rb FEATURE: Serve localized content in the site's default locale when user's language is unsupported (#36160) 2025-11-21 17:19:04 +08:00
basic_reviewable_flagged_post_serializer_spec.rb
basic_reviewable_queued_post_serializer_spec.rb
basic_reviewable_serializer_spec.rb
basic_reviewable_user_serializer_spec.rb
basic_topic_serializer_spec.rb FEATURE: Serve localized content in the site's default locale when user's language is unsupported (#36160) 2025-11-21 17:19:04 +08:00
basic_user_serializer_spec.rb
category_detailed_serializer_spec.rb
category_serializer_spec.rb SECURITY: Stop exposing hidden tag names through category serializers [backport 2026.6] 2026-07-28 17:05:36 +02:00
category_upload_serializer_spec.rb
color_scheme_serializer_spec.rb
component_index_serializer_spec.rb
current_user_serializer_spec.rb FEATURE: Allow topic_timers_allowed_groups to manage topic timers (#41126) 2026-06-23 12:46:56 -05:00
detailed_user_badge_serializer_spec.rb
directory_item_serializer_spec.rb SECURITY: /directory_items leaks restricted user-field values [backport 2026.6] (#41483) 2026-07-06 14:10:38 -05:00
emoji_serializer_spec.rb
flag_serializer_spec.rb
flagged_user_serializer_spec.rb SECURITY: Hide IP from flagged regular users 2026-03-19 15:21:28 +00:00
found_user_serializer_spec.rb
group_show_serializer_spec.rb FIX: Ensure moderators do not clear group email domain (#39631) 2026-04-29 14:32:38 +08:00
group_user_serializer_spec.rb
group_user_with_custom_fields_serializer_spec.rb
incoming_email_details_serializer_spec.rb FIX: Remove error section when viewing details for received emails (#35228) 2025-10-07 16:25:11 +08:00
incoming_email_serializer_spec.rb FIX: Remove error section when viewing details for received emails (#35228) 2025-10-07 16:25:11 +08:00
invite_serializer_spec.rb SECURITY: Prevent expired invite details from leaking (#41184) 2026-06-25 22:01:51 +08:00
listable_topic_serializer_spec.rb
nested_replies_basic_category_serializer_spec.rb FEATURE: First iteration of nested replies (#38888) 2026-04-16 08:06:44 -05:00
new_post_result_serializer_spec.rb
notification_serializer_spec.rb FIX: Notifications may not have topics (#36143) 2025-11-21 01:50:31 +08:00
pending_post_serializer_spec.rb
post_action_type_serializer_spec.rb
post_item_excerpt_spec.rb FIX: Handle Nokogiri HTML parser limits in PrettyText.excerpt (#37610) 2026-02-06 22:00:54 +01:00
post_localization_serializer_spec.rb
post_revision_serializer_spec.rb FEATURE: Allow editing a post's reply target from the composer (#39471) 2026-04-29 12:23:26 -03:00
post_serializer_spec.rb FIX: Post serialization exposes hidden-profile user status messages (#40885) 2026-06-15 09:25:47 -05:00
poster_serializer_spec.rb
remote_theme_serializer_spec.rb
reviewable_claimed_topic_serializer_spec.rb
reviewable_flagged_post_serializer_spec.rb FIX: Show translated post in review queue when present (#40378) 2026-05-29 14:32:11 -04:00
reviewable_note_serializer_spec.rb
reviewable_queued_post_serializer_spec.rb SECURITY: Restrict raw email in queued post payloads 2026-05-19 00:26:04 +01:00
reviewable_score_serializer_spec.rb FIX: escape HTML characters in watched word reason (#39378) 2026-04-20 14:15:38 -05:00
reviewable_serializer_spec.rb DEV: Expand top_tags, topic.tags, etc, to return an array of tag objects instead of tag names (#36678) 2026-02-02 10:03:02 +08:00
reviewable_user_serializer_spec.rb DEV: Remove reviewable_ui_refresh feature flag and legacy code (#36752) 2026-02-23 10:45:36 +08:00
single_sign_on_record_serializer_spec.rb
site_category_serializer_spec.rb SECURITY: Stop exposing hidden tag names through category serializers [backport 2026.6] 2026-07-28 17:05:36 +02:00
site_serializer_spec.rb SECURITY: Stop exposing hidden tag names through category serializers [backport 2026.6] 2026-07-28 17:05:36 +02:00
suggested_topic_serializer_spec.rb FIX: Suggested topic links to nested replies topics (#40302) 2026-05-26 08:40:38 -05:00
tag_group_serializer_spec.rb DEV: Move canonical tag routes to /tag/slug/id keeping /tag/name support (#37055) 2026-02-11 10:21:19 +08:00
tag_serializer_spec.rb FEATURE: Show localized tags (#37044) 2026-02-12 18:06:14 +08:00
theme_index_serializer_spec.rb FEATURE: enhance screenshot support for themes with dark/light modes (#36422) 2025-12-10 11:23:21 +10:00
theme_objects_setting_metadata_serializer_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
theme_serializer_spec.rb FEATURE: enhance screenshot support for themes with dark/light modes (#36422) 2025-12-10 11:23:21 +10:00
theme_settings_serializer_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
topic_link_serializer_spec.rb FIX: Filter orphaned TopicLinks and normalize http URLs to https (#37098) 2026-01-15 12:12:34 +08:00
topic_list_item_serializer_spec.rb FEATURE: Notification/tracking changes for nested replies (#39750) 2026-05-07 12:33:56 -05:00
topic_list_serializer_spec.rb FEATURE: Show localized tags (#37044) 2026-02-12 18:06:14 +08:00
topic_tracking_state_item_serializer_spec.rb FIX: Don't emit tag names/slugs in topic tracking state (#40117) 2026-05-19 05:07:17 +08:00
topic_tracking_state_serializer_spec.rb
topic_view_details_serializer_spec.rb FIX: DeleteReplies should use the guardian instead of checking for staff (#35443) 2025-10-16 18:26:41 +02:00
topic_view_posts_serializer_spec.rb
topic_view_serializer_spec.rb DEV: Remove per topic toggle (#40869) 2026-06-15 18:43:36 +08:00
upload_serializer_spec.rb
user_auth_token_serializer_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
user_badge_serializer_spec.rb
user_bookmark_list_serializer_spec.rb SECURITY: Enforce first-post visibility for topic bookmarks [backport 2026.6] (#42354) 2026-08-05 12:53:18 -05:00
user_card_serializer_spec.rb DEV: Tighten featured topic serialization data (#40549) 2026-06-03 16:32:52 -05:00
user_export_serializer_spec.rb
user_notification_total_serializer_spec.rb
user_post_bookmark_serializer_spec.rb
user_serializer_spec.rb SECURITY: Subscription contributors expose full user profile fields to anonymous viewers (#40891) 2026-06-15 10:24:06 -05:00
user_status_serializer_spec.rb
user_summary_serializer_spec.rb
user_with_custom_fields_serializer_spec.rb
web_hook_post_serializer_spec.rb
web_hook_topic_view_serializer_spec.rb
web_hook_user_serializer_spec.rb DEV: Tighten featured topic serialization data (#40549) 2026-06-03 16:32:52 -05:00
wizard_serializer_spec.rb UX: One step wizard (#36082) 2025-11-25 13:35:32 -05:00