Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-13 13:17:29 +08:00
Code Packages Activity Actions
discourse/plugins/chat/spec
History
Exact
Chris Alberti e7d0b84326
 SECURITY: Scope thread-read reset to originating channel and restrict bulk trigger to c... (#42417) 
## Summary

A chat participant could enable threading in their own DM and trigger a
thread-read reset job that marked thread memberships as read across all
channels, including private DMs the attacker could not access. The patch
scopes the SQL update to the target channel and only enqueues the bulk
reset when threading is enabled on a category channel.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1531

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-08-10 09:54:37 -05:00
..
components/chat DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
fabricators
integration FEATURE: Add enable_discourse_workflows upcoming change (#41541) 2026-07-13 10:48:37 +10:00
jobs SECURITY: Scope thread-read reset to originating channel and restrict bulk trigger to c... (#42417) 2026-08-10 09:54:37 -05:00
lib DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
mailers DEV: bump simple email subject status to stable (#41285) 2026-06-30 18:18:57 +04:00
models FEATURE: Sticky bar for pinned messages in chat channels (#41091) 2026-08-02 11:40:44 -03:00
queries/chat Revert "FIX: Existing DM sends bypass direct-message group restrictions (#40405)" (#40561) 2026-06-04 15:00:45 +08:00
requests SECURITY: Scope thread-read reset to originating channel and restrict bulk trigger to c... (#42417) 2026-08-10 09:54:37 -05:00
serializer UX: improve livestream chat messaging (#41750) 2026-07-21 11:07:31 +10:00
services FIX: Respect read-only permissions for chat message interactions (#42363) 2026-08-05 13:07:35 -05:00
support
system UX: allow links in pinned chat messages, update livestream (#42322) 2026-08-05 14:35:16 -04:00
validators
plugin_helper.rb DEV: Enable some minor rubocop rules (#40094) 2026-05-19 15:29:38 +02:00
plugin_spec.rb