Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-12 05:37:26 +08:00
Code Packages Activity Actions
discourse/app/services
History
Exact
discoursebot da6a89a985
 SECURITY: Enforce first-post visibility for topic bookmarks [backport 2026.7] (#42353) 
Backport of #42321 to release/2026.7.

---

## Summary

Topic bookmark creation, listing, search, and reminder eligibility now
require the first post to be visible to the user. The fix adds an inner
join on the first post with hidden-post filtering to the list query and
delegates creation and visibility checks to `guardian.can_see_post?` on
the first post, preventing an authenticated user from bookmarking a
topic or searching its metadata after the first post is hidden.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1530

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

---------

Co-authored-by: Chris Alberti <christo@discourse.org>
2026-08-05 12:53:16 -05:00
..
access_control_list FEATURE: Support users in DAccessControl and backend (#41358) 2026-07-15 09:18:06 +10:00
admin/search FIX: Enforce can_see_ip checks across admin IP features (#40019) 2026-05-19 11:37:20 +08:00
admin_notices FEATURE: Add problem checks page to admin panel and allow ignoring problem checks (#39103) 2026-04-23 08:28:33 +08:00
categories FIX: Don't reset customized site settings when new category (#41864) 2026-07-21 14:33:07 +08:00
category SECURITY: Stop exposing hidden tag names through category serializers 2026-07-28 16:40:22 +02:00
concerns FIX: Average daily engaged users KPI instead of summing the period (#40384) 2026-05-29 09:22:13 +08:00
custom_emoji UX: Better admin emoji page sorting & filtering and service refactors (#41892) 2026-07-24 12:01:21 +10:00
discourse_id DEV: Allow new instances to be set up directly with Discourse ID (#36731) 2025-12-23 12:13:36 -05:00
email_login_code UX: Improve password manager and full name handling in code login (#41746) 2026-07-15 10:43:03 -07:00
flags FEATURE: allow edit custom flags (#32344) 2025-04-17 12:31:52 +08:00
groups DEV: Add descriptive error message when creating requestable group with no owner (#40391) 2026-05-29 11:11:59 +08:00
nested_topic FEATURE: Hot algorithm for nested replies (simple) (#41742) 2026-07-20 10:56:05 -05:00
notification/action FEATURE: Notify admins of upcoming changes and log events (#37003) 2026-01-21 12:45:54 +10:00
notifications FEATURE: Consolidate link notifications (#26567) 2024-04-09 11:53:37 -06:00
problem_check DEV: Drop landlock problem-check (#42059) 2026-07-27 16:54:51 +01:00
site_setting FIX: Hidden setting error when enabling plugin linked to UC (#42007) 2026-07-24 09:58:37 +10:00
site_setting_localizations/about_config FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
spam_rule FIX: Moderator notifications when new post auto-silences a user (#35403) 2025-10-15 16:07:56 +08:00
tags FEATURE: Prioritize recently used tags in the composer tag picker (#41669) 2026-07-14 13:17:18 +02:00
themes FIX: Hide Solved empty_box_on_unsolved on Horizon (#41276) 2026-07-01 10:09:03 +10:00
upcoming_changes DEV: Fix upcoming change logging for NotifyPromotion (#41967) 2026-07-24 11:33:29 +10:00
user UX: Improve password manager and full name handling in code login (#41746) 2026-07-15 10:43:03 -07:00
user_api_key FEATURE: User API key device authorization flow (#40189) 2026-06-10 16:09:44 -04:00
video_conversion FIX: Maintain rotation for video uploads to AWS (#41767) 2026-07-16 21:07:38 +08:00
access_control_list_manager.rb DEV: Add banned_acl concept to AccessControlList (#41254) 2026-06-29 16:22:30 +10:00
admin_dashboard_engagement.rb FEATURE: Make "Who's posting?" category filter multi-select (#41837) 2026-07-22 15:55:28 +03:00
admin_dashboard_highlights.rb FIX: Average daily engaged users KPI instead of summing the period (#40384) 2026-05-29 09:22:13 +08:00
admin_dashboard_search.rb UX: Focus dashboard search analytics on member searches (#41647) 2026-07-13 12:41:19 +08:00
admin_dashboard_section_configuration.rb FEATURE: Let plugins register persistable admin dashboard section settings (#41843) 2026-07-22 18:00:38 +03:00
admin_dashboard_section_loader.rb DEV: Serialize dashboard sections for flamegraph profiling (#41897) 2026-07-23 07:49:58 +08:00
admin_dashboard_site_traffic.rb DEV: Use beacon counters for dashboard traffic (#41894) 2026-07-23 09:24:07 +08:00
anonymous_shadow_creator.rb FEATURE: Anonymous shadow sessions can outlive suspension of the master account (#40156) 2026-05-20 12:07:56 +08:00
badge_granter.rb FEATURE: award badges based on topic votes received (#39493) 2026-04-28 10:53:06 +10:00
base_bookmarkable.rb SECURITY: Ensure guardian check when creating QueryGroupBookmark 2026-02-26 12:22:54 +00:00
category_hashtag_data_source.rb FIX: Use unaccent() for category name/slug search (#37622) 2026-02-12 08:43:23 +01:00
color_scheme_revisor.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
destroy_task.rb PERF: Serve the activity_by_category report from daily rollups (#42046) 2026-07-28 12:53:29 +08:00
email_settings_exception_handler.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
email_settings_validator.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
email_style_updater.rb
external_upload_manager.rb SECURITY: Regular users can route multipart uploads into the admin backup store 2026-06-30 16:10:52 +02:00
group_action_logger.rb PERF: Add Users to Group Improvements Pt. 2 (#38901) 2026-04-06 09:31:50 -05:00
group_mentions_updater.rb FIX: Sync category description when post content changes outside PostRevisor (#39184) 2026-05-11 16:13:23 +02:00
group_message.rb DEV: Don't allow context-free system post destruction (#32523) 2025-05-05 09:58:29 +08:00
handle_chunk_upload.rb DEV: Fix assigned but unused variable Prism warnings (#39436) 2026-04-22 12:42:14 +02:00
hashtag_autocomplete_service.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
heat_settings_updater.rb
hub_push_notification_pusher.rb DEV: Centralize push notification delivery into a single job (#39207) 2026-04-14 11:55:45 -03:00
inline_uploads.rb FIX: Prevent backslash accumulation in upload markdown labels (#39461) 2026-06-03 18:10:38 +02:00
list_admin_categories.rb FEATURE: Category management UI for admins (#41218) 2026-07-15 09:17:25 +10:00
locale_normalizer.rb FIX: Show localization for regionless locale if they exist (#33702) 2025-07-21 15:45:14 +08:00
notification_emailer.rb FIX: Send notification emails for staff-coloured posts (#37712) 2026-02-11 13:26:27 +01:00
post_action_notifier.rb DEV: route bulk tag actions through PostRevisor (#37848) 2026-02-24 14:39:01 +01:00
post_alerter.rb DEV: Enable some minor rubocop rules (#40094) 2026-05-19 15:29:38 +02:00
post_bookmarkable.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
post_owner_changer.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
push_notification_pusher.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
random_topic_selector.rb
registered_bookmarkable.rb
search_indexer.rb FEATURE: Automatic AI captions (#41586) 2026-07-15 13:24:10 +08:00
sidebar_section_links_updater.rb
sidebar_section_updater.rb FIX: Allow manual Community sidebar links to be localized (#41898) 2026-07-22 15:57:56 +08:00
sidebar_site_settings_backfiller.rb
site_setting_update_existing_users.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
site_settings_task.rb
staff_action_logger.rb FEATURE: Log staff actions for admin onboarding panel steps (#42032) 2026-07-24 14:43:01 -07:00
tag_hashtag_data_source.rb FIX: Tag search 500 when content_localization is enabled (#37769) 2026-02-12 23:58:03 +08:00
tag_settings_updater.rb FIX: Tag settings can reassign hidden synonym tags by ID (#39778) 2026-05-07 11:01:51 +10:00
theme_settings_migrations_runner.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
themes_install_task.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
topic_bookmarkable.rb SECURITY: Enforce first-post visibility for topic bookmarks [backport 2026.7] (#42353) 2026-08-05 12:53:16 -05:00
topic_status_updater.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
topic_timestamp_changer.rb
tracked_topics_updater.rb
trust_level_granter.rb
user_action_manager.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
user_activator.rb FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256) 2026-05-26 09:30:38 +02:00
user_anonymizer.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
user_authenticator.rb
user_destroyer.rb FIX: Resolve all of a deleted spammer's reviewables (#40780) 2026-06-15 13:34:15 +08:00
user_merger.rb FIX: blocks post action merge for duplicated flags (#36265) 2025-11-26 16:17:57 -03:00
user_notification_renderer.rb
user_notification_schedule_processor.rb
user_password_expirer.rb
user_silencer.rb SECURITY: Stale featured rows expose unlisted topic content (#41810) 2026-07-17 09:19:08 -05:00
user_stat_count_updater.rb
user_suspender.rb FEATURE: Anonymous shadow sessions can outlive suspension of the master account (#40156) 2026-05-20 12:07:56 +08:00
user_updater.rb FIX: Support uppercase in User Profile Website URL (#42072) 2026-07-28 09:27:03 -05:00
username_changer.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
username_checker_service.rb
web_hook_emitter.rb DEV: Move webhook event header modifier for redelivery-recalucation (#27177) 2024-05-24 10:37:10 -05:00
wildcard_domain_checker.rb
wildcard_url_checker.rb DEV: Fix auth redirect validation in user API key flow (#40459) 2026-06-01 15:47:35 -04:00
word_watcher.rb FIX: Watched word with invalid regex crashes markdown cook (#40107) 2026-05-18 16:04:20 +08:00