Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-11 02:59:07 +08:00
Code Packages Activity Actions
discourse/plugins/chat
History
Exact
discoursebot c5502fda1e
 SECURITY: Scope thread-read reset to originating channel and restrict bulk trigger to c... [backport 2026.7] (#42477) 
Backport of #42417 to release/2026.7.

---

## Summary

A chat participant could enable threading in their own DM and trigger a
thread-read reset job that marked thread memberships as read across all
channels, including private DMs the attacker could not access. The patch
scopes the SQL update to the target channel and only enqueues the bulk
reset when threading is enabled on a category channel.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1531

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Chris Alberti <christo@discourse.org>
2026-08-10 09:54:42 -05:00
..
admin/assets/javascripts DEV: Consolidate reusable components into ui-kit (#38703) 2026-05-11 18:07:36 -03:00
app SECURITY: Scope thread-read reset to originating channel and restrict bulk trigger to c... [backport 2026.7] (#42477) 2026-08-10 09:54:42 -05:00
assets FIX: Chat browse page on mobile [backport 2026.7] (#42148) 2026-07-31 10:26:24 +10:00
config I18N: Update translations (#42465) 2026-08-10 11:05:45 +02:00
db A11Y: live announcements and optional sounds for chat messages (#41213) 2026-07-02 12:48:58 -04:00
lib SECURITY: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch 2026-07-28 16:40:22 +02:00
public/images FEATURE: add new chat reactions popup (#41028) 2026-06-25 14:56:08 +04:00
spec SECURITY: Scope thread-read reset to originating channel and restrict bulk trigger to c... [backport 2026.7] (#42477) 2026-08-10 09:54:42 -05:00
test/javascripts SECURITY: Stored XSS chat-transcript username unescaped in Rich Text Editor 2026-07-28 16:40:22 +02:00
about.json DEV: Only load specific plugin bundles during qunit test (#33678) 2025-07-21 21:00:48 +01:00
package.json DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00
plugin.rb UX: Consolidate chat notifications into live notification preferences (#41538) 2026-07-14 08:32:48 +02:00
README.md DEV: Chat service object initial implementation (#19814) 2023-02-13 13:09:57 +01:00
tsconfig.json DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00

README.md

This plugin is still in active development and may change frequently

Documentation

The Discourse Chat plugin adds chat functionality to your Discourse so it can natively support both long-form and short-form communication needs of your online community.

For user documentation, see Discourse Chat.

For developer documentation, see Discourse Documentation.