Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://gh.wpcy.net/https://github.com/discourse/discourse.git synced 2026-05-25 23:21:58 +08:00
Code Packages Activity Actions
discourse/spec/lib/guardian
History
Exact
Isaac Janzen 0e690370b4 SECURITY: Require topic visibility for category group moderator actions 
Category group moderators could perform privileged actions (claim/unclaim reviewables, delete topics, recover topics, edit posts) on topics inside private categories they did not have read access to. The authorization methods checked `is_category_group_moderator?` without first verifying `can_see_topic?`, and the controllers loaded topics/posts by raw ID without visibility scoping.

This adds `can_see_topic?` guards to `can_review_topic?`, `can_delete_topic?`, `can_recover_topic?`, and `can_edit_post?` so that category group moderation power never bypasses category read restrictions.

---

**Security Advisory:** https://github.com/discourse/discourse/security/advisories/GHSA-hjmg-2mww-vfvx
2026-05-19 00:26:04 +01:00
..
bookmark_guardian_spec.rb DEV: Consistently use Guardian helper methods (#34024) 2025-08-14 15:23:42 +08:00
flag_guardian_spec.rb FEATURE: allow edit custom flags (#32344) 2025-04-17 12:31:52 +08:00
invite_guardian_spec.rb DEV: Invites destroy_all_expired allows staff to delete any user's expired invites (#38281) 2026-03-05 09:59:48 -06:00
localization_guardian_spec.rb FIX: Also check if user can see post or topic prior to letting them localize it (#36749) 2025-12-18 02:12:58 +08:00
post_guardian_spec.rb SECURITY: Require topic visibility for category group moderator actions 2026-05-19 00:26:04 +01:00
staff_action_log_guardian_spec.rb SECURITY: Restrict staff action logs visibility for moderators 2026-01-28 17:11:14 +00:00
tag_guardian_spec.rb SECURITY: Prevent users from editing or synonymizing hidden tags they can't see 2026-03-19 15:21:28 +00:00
topic_guardian_spec.rb SECURITY: Require topic visibility for category group moderator actions 2026-05-19 00:26:04 +01:00
upload_guardian_spec.rb FIX: Enforce secure-upload ACL in AI bot prompt path (#39903) 2026-05-13 09:55:32 +08:00
user_guardian_spec.rb SECURITY: Require topic visibility for category group moderator actions 2026-05-19 00:26:04 +01:00