Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-12 05:37:26 +08:00
Code Packages Activity Actions
discourse/spec/services
History
Exact
Chris Alberti bd15d025b2
 SECURITY: Enforce first-post visibility for topic bookmarks (#42321) 
## Summary

Topic bookmark creation, listing, search, and reminder eligibility now
require the first post to be visible to the user. The fix adds an inner
join on the first post with hidden-post filtering to the list query and
delegates creation and visibility checks to `guardian.can_see_post?` on
the first post, preventing an authenticated user from bookmarking a
topic or searching its metadata after the first post is hidden.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1530

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-08-05 12:52:40 -05:00
..
access_control_list FEATURE: Support users in DAccessControl and backend (#41358) 2026-07-15 09:18:06 +10:00
admin/search FIX: Enforce can_see_ip checks across admin IP features (#40019) 2026-05-19 11:37:20 +08:00
admin_notices FEATURE: Add problem checks page to admin panel and allow ignoring problem checks (#39103) 2026-04-23 08:28:33 +08:00
categories FIX: Don't reset customized site settings when new category (#41864) 2026-07-21 14:33:07 +08:00
category DEV: Refactor category hierarchical search (#37609) 2026-02-13 09:43:56 +01:00
custom_emoji UX: Better admin emoji page sorting & filtering and service refactors (#41892) 2026-07-24 12:01:21 +10:00
discourse_id FEATURE: Discourse ID setting page (#36316) 2025-12-11 16:04:09 +01:00
email_login_code UX: Improve password manager and full name handling in code login (#41746) 2026-07-15 10:43:03 -07:00
flags DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
groups DEV: Add descriptive error message when creating requestable group with no owner (#40391) 2026-05-29 11:11:59 +08:00
nested_topic FIX: Restore nested post moderation affordances (#41475) 2026-07-07 07:51:05 -05:00
notification/action FEATURE: Notify admins of upcoming changes and log events (#37003) 2026-01-21 12:45:54 +10:00
notifications DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
problem_check DEV: Restore landlock problem-check (#42172) 2026-07-30 15:13:37 +01:00
site_setting FIX: Hidden setting error when enabling plugin linked to UC (#42007) 2026-07-24 09:58:37 +10:00
site_setting_localizations/about_config FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
tags FIX: Allow selecting tags that are only used in personal messages (#41918) 2026-07-24 12:27:03 +02:00
themes FEATURE: Enable high context topic cards in Horizon by default (#39959) 2026-05-15 10:50:42 +10:00
upcoming_changes FIX: Restrict upcoming-changes toggle to registered upcoming-change settings (#42175) 2026-07-30 09:28:04 -05:00
user FEATURE: Bulk suspend users and filter the admin users list by activation (#41227) 2026-06-29 11:26:34 +02:00
user_api_key FEATURE: User API key device authorization flow (#40189) 2026-06-10 16:09:44 -04:00
video_conversion FIX: Maintain rotation for video uploads to AWS (#41767) 2026-07-16 21:07:38 +08:00
access_control_list_manager_spec.rb DEV: Add banned_acl concept to AccessControlList (#41254) 2026-06-29 16:22:30 +10:00
admin_dashboard_engagement_spec.rb PERF: Serve the activity_by_category report from daily rollups (#42046) 2026-07-28 12:53:29 +08:00
admin_dashboard_highlights_spec.rb PERF: Use daily rollups for DAU/MAU reports (#41958) 2026-07-24 09:52:40 +08:00
admin_dashboard_search_spec.rb UX: Focus dashboard search analytics on member searches (#41647) 2026-07-13 12:41:19 +08:00
admin_dashboard_section_configuration_spec.rb FEATURE: Let plugins register persistable admin dashboard section settings (#41843) 2026-07-22 18:00:38 +03:00
admin_dashboard_section_loader_spec.rb FIX: Don't fail the dashboard when one section errors (#41720) 2026-07-15 17:20:51 +08:00
admin_dashboard_site_traffic_spec.rb FEATURE: Reclassify likely crawlers in site traffic reporting (#42199) 2026-08-04 10:08:53 +08:00
anonymous_shadow_creator_spec.rb DEV: Rename anonymous group to anonymous_users (#40435) 2026-06-02 09:29:46 +10:00
auto_silence_spec.rb FIX: Moderator notifications when new post auto-silences a user (#35403) 2025-10-15 16:07:56 +08:00
badge_granter_spec.rb DEV: Automatically detect and revert translation overrides in specs (#40003) 2026-05-13 22:09:23 +02:00
base_bookmarkable_spec.rb FIX: Show deleted bookmark reminders in user bookmarks menu (#25905) 2024-02-29 09:03:49 +10:00
category_hashtag_data_source_spec.rb FIX: Use unaccent() for category name/slug search (#37622) 2026-02-12 08:43:23 +01:00
color_scheme_revisor_spec.rb FEATURE: Ability to set palettes as default on theme (#34480) 2025-08-27 09:09:34 +08:00
destroy_task_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
email_settings_exception_handler_spec.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
email_settings_validator_spec.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
email_style_updater_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
external_upload_manager_spec.rb FIX: Run validation checks for heic, heif files before conversion (#42075) 2026-07-28 12:26:27 +08:00
flag_sockpuppets_spec.rb DEV: Fix Lint/BooleanSymbol (#24747) 2023-12-06 13:19:09 +01:00
group_action_logger_spec.rb PERF: Add Users to Group Improvements Pt. 2 (#38901) 2026-04-06 09:31:50 -05:00
group_mentions_updater_spec.rb FIX: Sync category description when post content changes outside PostRevisor (#39184) 2026-05-11 16:13:23 +02:00
group_message_spec.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
hashtag_autocomplete_service_spec.rb DEV: Move canonical tag routes to /tag/slug/id keeping /tag/name support (#37055) 2026-02-11 10:21:19 +08:00
heat_settings_updater_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
hub_push_notification_pusher_spec.rb DEV: Centralize push notification delivery into a single job (#39207) 2026-04-14 11:55:45 -03:00
inline_uploads_multisite_spec.rb DEV: Fix various rubocop lints (#24749) 2023-12-06 23:25:00 +01:00
inline_uploads_spec.rb FIX: Prevent backslash accumulation in upload markdown labels (#39461) 2026-06-03 18:10:38 +02:00
list_admin_categories_spec.rb FEATURE: Category management UI for admins (#41218) 2026-07-15 09:17:25 +10:00
locale_normalizer_spec.rb FIX: Show localization for regionless locale if they exist (#33702) 2025-07-21 15:45:14 +08:00
notification_emailer_spec.rb DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
post_action_notifier_spec.rb DEV: Convert min_trust_to_create_topic to groups (#24740) 2023-12-13 14:50:13 +11:00
post_alerter_spec.rb SECURITY: Replying to a whisper lets non-whisperers create staff-only whisper posts 2026-05-19 00:26:04 +01:00
post_bookmarkable_spec.rb DEV: Remove unnecessary rails_helper requiring (#26364) 2024-03-26 11:32:01 +01:00
post_owner_changer_spec.rb SECURITY: Ensure moderator can see post/topic before allowing them to change owner 2026-01-28 17:11:14 +00:00
problem_check_spec.rb FIX: Clear disabled/deleted ProblemChecks automatically (#42243) 2026-07-31 21:18:28 +01:00
push_notification_pusher_spec.rb FIX: Clean up push subscriptions whose endpoint domain no longer resolves (#39804) 2026-05-06 14:37:58 -03:00
random_topic_selector_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
search_indexer_spec.rb FEATURE: Automatic AI captions (#41586) 2026-07-15 13:24:10 +08:00
sidebar_section_updater_spec.rb DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
sidebar_site_settings_backfiller_spec.rb DEV: Hand-pick Rails/WhereNot autofixes (#35117) 2025-10-03 13:29:22 +02:00
site_settings_spec.rb FIX: Reject DiscourseConnect SSO payloads when secret is blank (#40830) 2026-06-12 15:17:16 +03:00
staff_action_logger_spec.rb FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
tag_hashtag_data_source_spec.rb FIX: Allow selecting tags that are only used in personal messages (#41918) 2026-07-24 12:27:03 +02:00
tag_settings_updater_spec.rb FIX: Clean localized tag names (#38488) 2026-03-12 12:54:50 +08:00
theme_settings_migrations_runner_spec.rb DEV: Add category helper for theme migration (#38816) 2026-03-24 16:50:37 +08:00
themes_spec.rb DEV: Fix constant redefinition warnings when running specs (#29837) 2024-11-20 15:17:36 +11:00
topic_bookmarkable_spec.rb SECURITY: Enforce first-post visibility for topic bookmarks (#42321) 2026-08-05 12:52:40 -05:00
topic_status_updater_spec.rb FEATURE: Exclude small actions from topic counters and unread tracking (#40481) 2026-06-08 08:03:55 +02:00
topic_timestamp_changer_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
trust_level_granter_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
user_activator_spec.rb DEV: Change authenticated_with_oauth to use key instead of string. (#38381) 2026-03-10 18:31:32 -03:00
user_anonymizer_spec.rb FIX: Block associated account emails on user delete and anonymize (#37638) 2026-02-09 18:26:35 +01:00
user_authenticator_spec.rb FIX: do not enforce 2fa when an account is created with OAuth (#28625) 2024-08-29 11:19:04 +10:00
user_destroyer_spec.rb FIX: Ignore pending reviewables when their target user is deleted (#42335) 2026-08-05 13:51:45 +08:00
user_merger_spec.rb FIX: blocks post action merge for duplicated flags (#36265) 2025-11-26 16:17:57 -03:00
user_notification_schedule_processor_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
user_password_expirer_spec.rb DEV: Migrate user passwords data to UserPassword table (#28746) 2024-10-10 09:23:06 +08:00
user_silencer_spec.rb SECURITY: Stale featured rows expose unlisted topic content (#41810) 2026-07-17 09:19:08 -05:00
user_stat_count_updater_spec.rb DEV: Don’t replace Rails logger in specs (#29721) 2024-11-13 08:47:39 +08:00
user_suspender_spec.rb FEATURE: Link staff action log entries to originating reviewable (#39519) 2026-04-30 09:15:45 +08:00
user_updater_spec.rb FIX: Ensure language header selections do not silently get added to 'Languages I understand' (#42294) 2026-08-04 14:46:41 +08:00
username_changer_spec.rb FIX: Preserve display name in quotes when using the rich text editor (#38078) 2026-02-26 21:04:07 +01:00
username_checker_service_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
wildcard_domain_checker_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
wildcard_url_checker_spec.rb DEV: Fix auth redirect validation in user API key flow (#40459) 2026-06-01 15:47:35 -04:00
word_watcher_spec.rb FIX: Watched word with invalid regex crashes markdown cook (#40107) 2026-05-18 16:04:20 +08:00