mirror of
https://github.com/discourse/discourse.git
synced 2026-08-06 13:08:40 +08:00
47728575f8The `upload_csv` endpoint accepted user-controlled CSV headers without validation, allowing arbitrary keys into the invite hashes passed to the BulkInvite job. Restrict accepted columns to the ones already handled in BulkInvite ( basically, `email`, `groups`, `topic_id`, `locale`) plus valid UserField names.
3 lines
118 B
CSV
Vendored
3 lines
118 B
CSV
Vendored
email,groups,topic_id,admin,moderator,trust_level
|
|
test@example.com,discourse,,true,true,4
|
|
test2@example.com,,,true,,4
|
