Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-05 10:42:34 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-reactions/app/controllers/discourse_reactions
History
Exact
Isaac Janzen 76f0734c7a
 SECURITY: anonymous users can read hidden real names via reaction-user endpoints (#41931) 
## Summary

Fix anonymous disclosure of hidden full names of reactors and likers via
reaction-user APIs when `enable_names` setting is disabled. The
`CustomReactionsController` now conditionally includes the `name` field
only when `enable_names` is enabled, ensuring the invariant that hidden
full names are not exposed to unauthenticated users.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1451

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-22 12:18:18 -05:00
..
custom_reactions_controller.rb SECURITY: anonymous users can read hidden real names via reaction-user endpoints (#41931) 2026-07-22 12:18:18 -05:00