Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-14 13:58:53 +08:00
Code Activity
discourse/plugins/chat/spec/requests
History
Exact
Chris Alberti e7d0b84326
 SECURITY: Scope thread-read reset to originating channel and restrict bulk trigger to c... (#42417) 
## Summary

A chat participant could enable threading in their own DM and trigger a
thread-read reset job that marked thread memberships as read across all
channels, including private DMs the attacker could not access. The patch
scopes the SQL update to the target channel and only enqueues the bulk
reset when threading is enabled on a category channel.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1531

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-08-10 09:54:37 -05:00
..
admin SECURITY: prevent moderators from exporting user Chat DMs 2026-02-26 12:22:54 +00:00
chat SECURITY: Scope thread-read reset to originating channel and restrict bulk trigger to c... (#42417) 2026-08-10 09:54:37 -05:00
core_ext SECURITY: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch 2026-07-28 16:40:22 +02:00
application_controller_spec.rb DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
chat_controller_spec.rb FEATURE: add new chat reactions popup (#41028) 2026-06-25 14:56:08 +04:00
direct_messages_controller_spec.rb DEV: Fix deprecations in plugins specs and silence output (#39257) 2026-04-15 00:00:46 +02:00
reviewables_controller_spec.rb SECURITY: Chat authorization and disclosure fixes 2026-05-19 00:26:04 +01:00