mirror of
https://gh.wpcy.net/https://github.com/discourse/discourse.git
synced 2026-05-07 21:38:22 +08:00
d74ff25db9
## Summary - Adds a `guardian.can_see_topic?` check in `DiscoursePoll::Poll` to prevent users from interacting with polls on topics they can no longer access - Covers the case where a user loses group membership for a private category but could still toggle poll status via the API - Adds integration test verifying poll toggle is blocked after group removal --- **Security Advisory:** https://github.com/discourse/discourse/security/advisories/GHSA-wq58-pvf6-w4p8 |
||
|---|---|---|
| .. | ||
| controllers | ||
| fabricators | ||
| integration | ||
| jobs/regular | ||
| lib | ||
| models | ||
| requests | ||
| serializers | ||
| system | ||
