Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-07 13:19:19 +08:00
Code Packages Activity Actions
discourse/spec/serializers
History
Exact
discoursebot da6a89a985
 SECURITY: Enforce first-post visibility for topic bookmarks [backport 2026.7] (#42353) 
Backport of #42321 to release/2026.7.

---

## Summary

Topic bookmark creation, listing, search, and reminder eligibility now
require the first post to be visible to the user. The fix adds an inner
join on the first post with hidden-post filtering to the list query and
delegates creation and visibility checks to `guardian.can_see_post?` on
the first post, preventing an authenticated user from bookmarking a
topic or searching its metadata after the first post is hidden.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1530

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

---------

Co-authored-by: Chris Alberti <christo@discourse.org>
2026-08-05 12:53:16 -05:00
..
concerns FEATURE: Prevent silenced users from liking and using reactions (#37040) 2026-01-13 13:59:57 +01:00
about_serializer_spec.rb FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
admin_category_serializer_spec.rb FEATURE: Category management UI for admins (#41218) 2026-07-15 09:17:25 +10:00
admin_detailed_user_serializer_spec.rb SECURITY: AdminDetailedUserSerializer#latest_export leaking user exports 2026-01-28 17:11:14 +00:00
admin_plugin_serializer_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
admin_user_action_serializer_spec.rb
admin_user_list_serializer_spec.rb FIX: Staged user emails bypass moderator email visibility setting (#40411) 2026-05-29 19:26:17 -03:00
auth_provider_serializer_spec.rb
basic_group_serializer_spec.rb
basic_group_user_serializer_spec.rb
basic_post_serializer_spec.rb FEATURE: Serve localized content in the site's default locale when user's language is unsupported (#36160) 2025-11-21 17:19:04 +08:00
basic_reviewable_flagged_post_serializer_spec.rb
basic_reviewable_queued_post_serializer_spec.rb
basic_reviewable_serializer_spec.rb
basic_reviewable_user_serializer_spec.rb
basic_topic_serializer_spec.rb FEATURE: Serve localized content in the site's default locale when user's language is unsupported (#36160) 2025-11-21 17:19:04 +08:00
basic_user_serializer_spec.rb
category_detailed_serializer_spec.rb
category_serializer_spec.rb SECURITY: Stop exposing hidden tag names through category serializers 2026-07-28 16:40:22 +02:00
category_upload_serializer_spec.rb
color_scheme_serializer_spec.rb
component_index_serializer_spec.rb
current_user_serializer_spec.rb FEATURE: Allow admins to localize custom sidebar section and links (#41795) 2026-07-21 21:45:50 +08:00
detailed_user_badge_serializer_spec.rb
directory_item_serializer_spec.rb SECURITY: /directory_items leaks restricted user-field values (#41476) 2026-07-06 13:05:48 -05:00
emoji_serializer_spec.rb
flag_serializer_spec.rb
flagged_user_serializer_spec.rb SECURITY: Hide IP from flagged regular users 2026-03-19 15:21:28 +00:00
found_user_serializer_spec.rb
group_show_serializer_spec.rb FIX: Ensure moderators do not clear group email domain (#39631) 2026-04-29 14:32:38 +08:00
group_user_serializer_spec.rb
group_user_with_custom_fields_serializer_spec.rb
incoming_email_details_serializer_spec.rb
incoming_email_serializer_spec.rb
invite_serializer_spec.rb SECURITY: Prevent expired invite details from leaking (#41184) 2026-06-25 22:01:51 +08:00
listable_topic_serializer_spec.rb
nested_replies_basic_category_serializer_spec.rb FEATURE: Add nested replies category conversion (#41236) 2026-07-06 08:22:22 -05:00
new_post_result_serializer_spec.rb
notification_serializer_spec.rb FIX: Notifications may not have topics (#36143) 2025-11-21 01:50:31 +08:00
pending_post_serializer_spec.rb
post_action_type_serializer_spec.rb
post_item_excerpt_spec.rb FIX: Handle Nokogiri HTML parser limits in PrettyText.excerpt (#37610) 2026-02-06 22:00:54 +01:00
post_localization_serializer_spec.rb
post_revision_serializer_spec.rb FIX: Omit inaccessible reply target post numbers from post revision history (#41547) 2026-07-08 11:41:43 -05:00
post_serializer_spec.rb FIX: Post serialization exposes hidden-profile user status messages (#40885) 2026-06-15 09:25:47 -05:00
poster_serializer_spec.rb
remote_theme_serializer_spec.rb
reviewable_claimed_topic_serializer_spec.rb
reviewable_flagged_post_serializer_spec.rb FIX: Show translated post in review queue when present (#40378) 2026-05-29 14:32:11 -04:00
reviewable_note_serializer_spec.rb
reviewable_queued_post_serializer_spec.rb SECURITY: Restrict raw email in queued post payloads 2026-05-19 00:26:04 +01:00
reviewable_score_serializer_spec.rb FIX: escape HTML characters in watched word reason (#39378) 2026-04-20 14:15:38 -05:00
reviewable_serializer_spec.rb DEV: Expand top_tags, topic.tags, etc, to return an array of tag objects instead of tag names (#36678) 2026-02-02 10:03:02 +08:00
reviewable_user_serializer_spec.rb DEV: Remove reviewable_ui_refresh feature flag and legacy code (#36752) 2026-02-23 10:45:36 +08:00
sidebar_section_serializer_spec.rb FIX: Allow manual Community sidebar links to be localized (#41898) 2026-07-22 15:57:56 +08:00
single_sign_on_record_serializer_spec.rb
site_category_serializer_spec.rb SECURITY: Stop exposing hidden tag names through category serializers 2026-07-28 16:40:22 +02:00
site_serializer_spec.rb SECURITY: Stop exposing hidden tag names through category serializers 2026-07-28 16:40:22 +02:00
suggested_topic_serializer_spec.rb FIX: Suggested topic links to nested replies topics (#40302) 2026-05-26 08:40:38 -05:00
tag_group_serializer_spec.rb DEV: Move canonical tag routes to /tag/slug/id keeping /tag/name support (#37055) 2026-02-11 10:21:19 +08:00
tag_serializer_spec.rb FEATURE: Show localized tags (#37044) 2026-02-12 18:06:14 +08:00
theme_index_serializer_spec.rb FEATURE: enhance screenshot support for themes with dark/light modes (#36422) 2025-12-10 11:23:21 +10:00
theme_objects_setting_metadata_serializer_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
theme_serializer_spec.rb FEATURE: enhance screenshot support for themes with dark/light modes (#36422) 2025-12-10 11:23:21 +10:00
theme_settings_serializer_spec.rb DEV: Add disallowed_groups to theme/component settings (#41792) 2026-07-20 09:28:52 +10:00
topic_link_serializer_spec.rb FIX: Filter orphaned TopicLinks and normalize http URLs to https (#37098) 2026-01-15 12:12:34 +08:00
topic_list_item_serializer_spec.rb FEATURE: Notification/tracking changes for nested replies (#39750) 2026-05-07 12:33:56 -05:00
topic_list_serializer_spec.rb FEATURE: Show localized tags (#37044) 2026-02-12 18:06:14 +08:00
topic_tracking_state_item_serializer_spec.rb FIX: Don't emit tag names/slugs in topic tracking state (#40117) 2026-05-19 05:07:17 +08:00
topic_tracking_state_serializer_spec.rb
topic_view_details_serializer_spec.rb
topic_view_posts_serializer_spec.rb
topic_view_serializer_spec.rb DEV: Remove per topic toggle (#40869) 2026-06-15 18:43:36 +08:00
upload_serializer_spec.rb
user_auth_token_serializer_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
user_badge_serializer_spec.rb
user_bookmark_list_serializer_spec.rb SECURITY: Enforce first-post visibility for topic bookmarks [backport 2026.7] (#42353) 2026-08-05 12:53:16 -05:00
user_card_serializer_spec.rb DEV: Tighten featured topic serialization data (#40549) 2026-06-03 16:32:52 -05:00
user_export_serializer_spec.rb
user_notification_total_serializer_spec.rb
user_post_bookmark_serializer_spec.rb
user_serializer_spec.rb SECURITY: Subscription contributors expose full user profile fields to anonymous viewers (#40891) 2026-06-15 10:24:06 -05:00
user_status_serializer_spec.rb
user_summary_serializer_spec.rb
user_with_custom_fields_serializer_spec.rb
web_hook_post_serializer_spec.rb
web_hook_topic_view_serializer_spec.rb
web_hook_user_serializer_spec.rb DEV: Tighten featured topic serialization data (#40549) 2026-06-03 16:32:52 -05:00
wizard_serializer_spec.rb UX: One step wizard (#36082) 2025-11-25 13:35:32 -05:00