mirror of
https://gh.wpcy.net/https://github.com/discourse/discourse.git
synced 2026-05-21 19:42:54 +08:00
d327865476
Backport of #659 to release/2026.4. --- Public category chat events were being published without MessageBus permissions, which meant anonymous or chat-disabled subscribers could receive chat payloads. This scopes those broadcasts to the configured chat-allowed groups, and maps everyone to trust_level_0 so logged-in users still get updates without exposing them to anon clients. https://github.com/discourse/discourse/security/advisories/GHSA-j7wq-rf5c-8783 |
||
|---|---|---|
| .. | ||
| controllers/chat | ||
| jobs | ||
| models | ||
| queries/chat | ||
| serializers/chat | ||
| services/chat | ||
| validators/chat | ||
| views | ||
