0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-07 13:19:19 +08:00
discourse/spec/lib
discoursebot da6a89a985
SECURITY: Enforce first-post visibility for topic bookmarks [backport 2026.7] (#42353)
Backport of #42321 to release/2026.7.

---

## Summary

Topic bookmark creation, listing, search, and reminder eligibility now
require the first post to be visible to the user. The fix adds an inner
join on the first post with hidden-post filtering to the list query and
delegates creation and visibility checks to `guardian.can_see_post?` on
the first post, preventing an authenticated user from bookmarking a
topic or searching its metadata after the first post is hidden.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1530

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

---------

Co-authored-by: Chris Alberti <christo@discourse.org>
2026-08-05 12:53:16 -05:00
..
acl FEATURE: Support users in DAccessControl and backend (#41358) 2026-07-15 09:18:06 +10:00
active_support_type_extensions DEV: Add symbol to ActiveModel attribute types (#36420) 2025-12-03 10:57:44 +01:00
admin_dashboard/reports DEV: Let plugins exclude reports from the customisable dashboard (#40463) 2026-06-03 16:36:01 +03:00
auth SECURITY: Bind shared session key to auth token and enforce user gates (#41610) 2026-07-14 13:25:05 +08:00
backup_restore FEATURE: Hot algorithm for nested replies (simple) (#41742) 2026-07-20 10:56:05 -05:00
common_passwords
compression FEATURE: Add emoji_picker_pinned_groups for pinning groups in the picker (#41881) 2026-07-22 09:51:15 -07:00
concern DEV: Split passkey and security key WebAuthn ceremonies for 2FA (#40817) 2026-06-17 12:52:47 -03:00
content_localization FEATURE: Localize local oneboxes (#40493) 2026-06-08 11:49:55 +08:00
content_security_policy FIX: invalid CSP directive sources should allow site to boot with valid CSP directives (#31256) 2025-02-10 20:38:36 +08:00
demon DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
discourse DEV: Bump landlock, refactor, and add problem check (#42049) 2026-07-27 13:51:16 +01:00
discourse_webauthn DEV: Split passkey and security key WebAuthn ceremonies for 2FA (#40817) 2026-06-17 12:52:47 -03:00
email SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks 2026-06-30 16:10:52 +02:00
file_store DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
final_destination FIX: Keep TCPServer.open(port) working with the Happy Eyeballs patch 2026-07-22 09:05:38 +02:00
freedom_patches DEV: Sandbox all image processing via Landlock (#42048) 2026-07-27 18:27:34 +01:00
guardian SECURITY: Block requests for hidden post revisions through historical version reconstruction [backport 2026.7] (#42270) 2026-08-03 12:27:57 -05:00
highlight_js
i18n FIX: incorrect Breton plural rule logic operator (#37545) 2026-02-05 18:04:59 +11:00
import
middleware SECURITY: Prevent cache poisoning/XSS via color scheme cookies 2026-07-28 16:40:22 +02:00
migration DEV: Rename anonymous group to anonymous_users (#40435) 2026-06-02 09:29:46 +10:00
nested_replies PERF: Add fast nested reply stats preparation (#41870) 2026-07-21 10:45:53 -05:00
onebox SECURITY: Onebox iframe origin allowlist enforces URL authority boundary [backport 2026.7] 2026-07-31 22:01:38 +01:00
plugin FEATURE: Let plugins register persistable admin dashboard section settings (#41843) 2026-07-22 18:00:38 +03:00
pretty_text FIX: Use anonymous permissions for hashtag lookup when cooking without a valid user (#39994) 2026-05-13 14:03:27 -05:00
rate_limiter
release_utils DEV: Bump version automatically when cutting release branches (#38504) 2026-03-12 12:05:28 +01:00
reviewable FIX: ensure remove_reviewable_ids is always an array (#37131) 2026-01-15 10:35:59 +08:00
scheduler DEV: Double timeout for spec in spec/defer_spec.rb (#35368) 2025-10-14 17:13:26 +08:00
second_factor DEV: Split passkey and security key WebAuthn ceremonies for 2FA (#40817) 2026-06-17 12:52:47 -03:00
seed_data DEV: Do not seed TOS and Privacy topics even if company_name is present (#41814) 2026-07-17 13:29:49 -04:00
service DEV: Preserve existing errors in service model steps (#41896) 2026-07-23 17:15:26 +10:00
sidekiq FIX: Ensure retry_count is set when checking if a job is being retried (#36034) 2025-11-14 14:18:50 +11:00
site_settings UX: Convert AI translation's max days ago setting to a specific date setting instead (#42082) 2026-07-28 18:27:34 +08:00
stylesheet DEV: Drop empty core mobile/desktop stylesheets (#41988) 2026-07-23 20:30:13 +01:00
svg_sprite DEV: Fix state leak in svg_sprite spec (#39997) 2026-05-13 22:08:48 +02:00
tasks DEV: Address parallel S3 upload review feedback 2026-07-23 17:11:41 +00:00
theme_settings_group_resolver DEV: Add resolve_group_membership for theme object settings of group type (#41756) 2026-07-17 10:19:29 +10:00
theme_settings_manager DEV: Add disallowed_groups to theme/component settings (#41792) 2026-07-20 09:28:52 +10:00
theme_store DEV: Improve handling of private theme installs (#41845) 2026-07-24 13:42:41 -04:00
topic_query SECURITY: Restrict tagged group message lists (#41342) 2026-07-06 12:19:05 +08:00
turbo_tests/flaky
validators UX: Convert AI translation's max days ago setting to a specific date setting instead (#42082) 2026-07-28 18:27:34 +08:00
wizard UX: One step wizard (#36082) 2025-11-25 13:35:32 -05:00
admin_confirmation_spec.rb
admin_user_index_query_spec.rb FEATURE: Support bulk user search in the admin users list (#41572) 2026-07-09 10:34:52 -03:00
anonymous_action_spec.rb FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256) 2026-05-26 09:30:38 +02:00
application_layout_preloader_spec.rb DEV: Add resolve_group_membership for theme object settings of group type (#41756) 2026-07-17 10:19:29 +10:00
archetype_spec.rb
asset_processor_spec.rb DEV: Improve cross-plugin/theme import handling (#40939) 2026-06-30 16:11:38 +01:00
bookmark_manager_spec.rb
bookmark_query_spec.rb SECURITY: Enforce first-post visibility for topic bookmarks [backport 2026.7] (#42353) 2026-08-05 12:53:16 -05:00
bookmark_reminder_notification_handler_spec.rb FIX: don't clear reminder on deleted bookmarks (#35987) 2025-11-12 17:47:07 +01:00
bookmarks_bulk_action_spec.rb FIX: BookmarksBulkAction#delete passing integer to guardian instead of Bookmark object (#37871) 2026-02-17 15:14:46 +10:00
browser_detection_spec.rb
browser_pageview_referrer_inspector_spec.rb FEATURE: Add top countries and top referrers cards to the admin dashboard (#40215) 2026-05-22 12:59:16 +08:00
cache_spec.rb DEV: fix a large amount of typos (#37428) 2026-02-02 16:31:58 +11:00
canonical_url_spec.rb UX: Prevent incomplete crawler localization settings (#41297) 2026-07-01 12:13:22 +08:00
category_badge_spec.rb A11Y: don't use the title attribute for category and tag descriptions (#42005) 2026-07-24 09:49:41 -04:00
category_guardian_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
color_math_spec.rb
composer_messages_finder_spec.rb FIX: Show composer education message once per session (#41124) 2026-06-23 12:19:42 -03:00
content_buffer_spec.rb
content_localization_spec.rb FIX: User options take precedence over show-original anon cookie (#39520) 2026-04-25 00:44:20 +08:00
content_security_policy_spec.rb UX: Do not include upgrade-insecure-requests in report-only CSP (#41414) 2026-07-03 09:56:08 +01:00
cooked_post_processor_spec.rb FIX: Preserve "+" in server-side sync_sso payloads (#42024) 2026-07-24 16:28:56 +02:00
crawler_detection_spec.rb FEATURE: Allow fallback home routes for crawlers for custom homepage sites (#41234) 2026-06-29 09:57:40 -04:00
crawler_scorer_spec.rb DEV: Score sessions that rotate IP addresses in CrawlerScorer (#42083) 2026-07-28 18:05:04 +08:00
current_user_spec.rb
db_helper_spec.rb
directory_helper_spec.rb
discourse_diff_spec.rb DEV: use classes to style hidden post history revision (#38159) 2026-03-03 09:58:03 -05:00
discourse_event_spec.rb DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
discourse_hub_spec.rb DEV: Optionally raise error on DiscourseHub calls (#39347) 2026-04-20 15:01:58 +01:00
discourse_id_spec.rb FEATURE: Discourse ID setting page (#36316) 2025-12-11 16:04:09 +01:00
discourse_ip_info_spec.rb FIX: Add reverse DNS timeout to DiscourseIpInfo (#40593) 2026-06-05 12:29:51 +08:00
discourse_logstash_logger_spec.rb DEV: Make specs pass with ruby 3.4 (#35411) 2025-10-15 12:40:18 +03:00
discourse_plugin_registry_spec.rb DEV: Allow plugins to register admin-panel-specific CSS (#40345) 2026-05-28 11:03:38 +01:00
discourse_redis_spec.rb DEV: Upgrade the Redis gem to v5.4 2025-03-19 14:34:00 +01:00
discourse_spec.rb DEV: Tidy atomic_ln_s specs and align describe block naming (#41355) 2026-07-02 06:43:09 +08:00
discourse_tagging_spec.rb FIX: Allow selecting tags that are only used in personal messages (#41918) 2026-07-24 12:27:03 +02:00
discourse_updates_spec.rb FEATURE: Improve display of installed/available version on dashboard (#41165) 2026-06-24 13:07:05 +01:00
disk_cache_eviction_spec.rb PERF: extract shared DiskCacheEviction utility for disk caches (#37842) 2026-02-16 12:24:38 +01:00
distributed_cache_spec.rb
distributed_memoizer_spec.rb
distributed_mutex_spec.rb DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
email_cook_spec.rb
email_updater_spec.rb FIX: add alternate email duplicate row (#37673) 2026-02-12 12:46:55 +04:00
ember_assets_spec.rb DEV: Rename EmberCli to EmberAssets (#40938) 2026-06-16 12:56:56 +02:00
encodings_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
enum_spec.rb
excerpt_parser_spec.rb FIX: Prevent double-escaping of HTML entities in titles and meta descriptions (#41261) 2026-07-02 20:26:35 +02:00
feed_element_installer_spec.rb
feed_item_accessor_spec.rb
file_helper_spec.rb FIX: Serve inline-safe uploads inline on the local file store (#40739) 2026-07-14 18:52:35 +01:00
filter_best_posts_spec.rb
final_destination_spec.rb UX: Explain bot verification challenges in onebox error previews (#41764) 2026-07-16 15:49:52 +02:00
flag_settings_spec.rb
gaps_spec.rb
gc_stat_instrumenter_spec.rb
git_repo_spec.rb
git_url_spec.rb
git_utils_spec.rb FIX: GitUtils preventing boot (#37599) 2026-02-06 13:07:28 +00:00
github_rate_limit_spec.rb FEATURE: Route all GitHub API requests through one rate-limited client (#40637) 2026-06-15 10:59:10 +02:00
global_path_spec.rb
group_lookup_spec.rb
group_manager_spec.rb PERF: Add Users to Group Improvements Pt. 2 (#38901) 2026-04-06 09:31:50 -05:00
guardian_spec.rb FIX: Enforce group visibility when filtering users by group (#41370) 2026-07-03 07:08:52 +02:00
has_errors_spec.rb
hijack_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
homepage_helper_spec.rb FEATURE: explicit default homepage setting (#41785) 2026-07-22 16:22:19 -04:00
html_prettify_spec.rb
html_to_markdown_spec.rb DEV: fix a large amount of typos (#37428) 2026-02-02 16:31:58 +11:00
http_language_parser_spec.rb FIX: Language parser matches with dashes or underscores (#31381) 2025-02-19 11:55:14 +08:00
ical_encoder_spec.rb FIX: Prevent HTML-encoding of special characters in ICS feeds (#39152) 2026-04-08 16:43:41 +02:00
image_sizer_spec.rb
inline_oneboxer_spec.rb FEATURE: Private GitHub inline oneboxes (#40393) 2026-06-01 10:42:28 +10:00
js_locale_helper_spec.rb DEV: Refactor locale bundle loading (#37114) 2026-01-16 11:45:14 +00:00
json_error_spec.rb
letter_avatar_spec.rb
localization_attributes_replacer_spec.rb FIX: only show first paragraph of localized category descriptions (#41511) 2026-07-10 16:59:40 -04:00
localized_cooked_post_processor_spec.rb FEATURE: Automatic AI captions (#41586) 2026-07-15 13:24:10 +08:00
message_id_service_spec.rb
method_profiler_spec.rb
mini_scheduler_long_running_job_logger_spec.rb DEV: Fix state leak in MiniSchedulerLongRunningJobLogger spec (#36453) 2025-12-04 16:47:01 +08:00
mini_sql_multisite_connection_spec.rb
mobile_detection_spec.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
new_post_manager_spec.rb FIX: Review media without image dimensions (#42079) 2026-07-28 16:57:02 +10:00
new_post_result_spec.rb
onebox_spec.rb
oneboxer_github_backoff_spec.rb FEATURE: Route all GitHub API requests through one rate-limited client (#40637) 2026-06-15 10:59:10 +02:00
oneboxer_spec.rb SECURITY: Onebox iframe origin allowlist enforces URL authority boundary [backport 2026.7] 2026-07-31 22:01:38 +01:00
onpdiff_spec.rb DEV: Add comparison budget to ONPDiff (#38063) 2026-02-25 14:25:03 -05:00
password_hasher_spec.rb
pbkdf2_spec.rb
pinned_check_spec.rb
plain_text_to_markdown_spec.rb
post_action_creator_spec.rb SECURITY: fix is_warning type coercion bypass in PostActionsController 2026-03-19 15:21:28 +00:00
post_action_destroyer_spec.rb
post_action_type_view_spec.rb FIX: Missing/incorrect flag reason in account_deleted emails (#34955) 2025-11-17 15:22:22 +00:00
post_creator_spec.rb FEATURE: Add Bypass permission checks to create post (#41279) 2026-07-20 11:06:37 +02:00
post_destroyer_spec.rb FEAT: Allow unsilencing after author deletes flagged post (#41727) 2026-07-16 09:41:24 +08:00
post_jobs_enqueuer_spec.rb
post_localization_creator_spec.rb FIX: Also check if user can see post or topic prior to letting them localize it (#36749) 2025-12-18 02:12:58 +08:00
post_localization_destroyer_spec.rb FIX: Also check if user can see post or topic prior to letting them localize it (#36749) 2025-12-18 02:12:58 +08:00
post_localization_updater_spec.rb FIX: Also check if user can see post or topic prior to letting them localize it (#36749) 2025-12-18 02:12:58 +08:00
post_locker_spec.rb
post_merger_spec.rb
post_revisor_spec.rb UX: Allow user to set post and topic title language when manually creating post translations in modal (#41734) 2026-07-16 10:43:39 +08:00
posts_filter_spec.rb FEAT: Support excluding topics in posts filters (#41216) 2026-06-26 13:56:36 +10:00
presence_channel_spec.rb FIX: Don't auto-remove chat members from logged_in_users group (#40543) 2026-06-03 18:15:32 +02:00
pretty_text_spec.rb SECURITY: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing [backport 2026.7] 2026-07-31 22:01:38 +01:00
promotion_spec.rb FIX: recalculate respects default invitee trust level (#32393) 2025-04-23 09:49:44 +08:00
quote_comparer_spec.rb
quote_rewriter_spec.rb FIX: Preserve display name in quotes when using the rich text editor (#38078) 2026-02-26 21:04:07 +01:00
rate_limiter_spec.rb
read_only_mixin_spec.rb FEATURE: Log in with a one-time email code (#40804) 2026-06-17 12:34:48 -07:00
retrieve_title_spec.rb
route_format_spec.rb SECURITY: block cross-site backup traversal in multisite local storage 2026-05-19 00:26:04 +01:00
rtl_spec.rb
s3_cors_rulesets_spec.rb
s3_helper_spec.rb Revert "Revert "FIX: Multipart S3 uploads failing with checksum calculation set to "when required""" (#41747) 2026-07-15 22:53:07 +02:00
s3_inventory_multisite_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
s3_inventory_spec.rb Revert "Revert "FIX: Multipart S3 uploads failing with checksum calculation set to "when required""" (#41747) 2026-07-15 22:53:07 +02:00
schema_settings_object_validator_spec.rb DEV: Add datetime type for site settings / object settings (#36849) 2025-12-30 10:52:30 -06:00
score_calculator_spec.rb
scss_checker_spec.rb DEV: Compile 'common' CSS into own assets (#31416) 2025-05-01 10:44:49 +01:00
search_spec.rb SECURITY: Apply category tag visibility to full-text search (#41668) 2026-07-13 15:16:26 -03:00
server_session_spec.rb DEV: Allow ServerSession to store arbitrary data (#34919) 2025-09-26 10:35:28 +02:00
service_spec.rb DEV: Allow contracts to inherit from another class (#35599) 2025-10-30 10:05:36 +01:00
shrink_uploaded_image_spec.rb FIX: Return file paths from FileStore download methods (#37760) 2026-02-17 11:56:50 +01:00
sidebar_section_links_updater_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
sidekiq_long_running_job_logger_spec.rb DEV: Upgrade Sidekiq to v7.3.9 2025-03-10 15:02:48 +01:00
signal_trap_logger_spec.rb
site_icon_manager_spec.rb DEV: Fix a site_icon_manager spec flake (#39497) 2026-04-23 20:48:43 +02:00
site_setting_extension_multisite_spec.rb FIX: Refresh site settings after process forks (#41856) 2026-07-22 10:31:05 +08:00
site_setting_extension_spec.rb FIX: Scope duplicate topic title check to what the user can see (#41871) 2026-07-24 15:35:35 +02:00
slug_spec.rb
spam_handler_spec.rb
statistics_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
suggested_topics_builder_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
system_message_spec.rb
system_themes_manager_spec.rb FIX: allow out-of-sequence theme settings migrations on re-sync (#38705) 2026-03-20 11:16:22 +10:00
tag_localization_creator_spec.rb SECURITY: Unsanitized TagLocalization Descriptions (#41555) 2026-07-08 14:42:13 -05:00
tag_localization_destroyer_spec.rb FEATURE: Introduce tag localizations with API, without UI yet (#36754) 2025-12-18 18:25:58 +08:00
tag_localization_updater_spec.rb FEATURE: Introduce tag localizations with API, without UI yet (#36754) 2025-12-18 18:25:58 +08:00
text_cleaner_spec.rb DEV: fix a large amount of typos (#37428) 2026-02-02 16:31:58 +11:00
text_sentinel_spec.rb
theme_flag_modifier_spec.rb
theme_javascript_compiler_spec.rb DEV: Improve cross-plugin/theme import handling (#40939) 2026-06-30 16:11:38 +01:00
theme_screenshots_handler_spec.rb FIX: ignore SiteSetting.max_image_size_kb for theme screenshots (#33215) 2025-06-17 08:58:37 +08:00
theme_settings_group_resolver_spec.rb DEV: Add resolve_group_membership for theme object settings of group type (#41756) 2026-07-17 10:19:29 +10:00
theme_settings_manager_spec.rb DEV: Add disallowed_groups to theme/component settings (#41792) 2026-07-20 09:28:52 +10:00
theme_settings_parser_spec.rb DEV: Add disallowed_groups to theme/component settings (#41792) 2026-07-20 09:28:52 +10:00
theme_settings_validator_spec.rb DEV: Add resolve_group_membership for theme object settings of group type (#41756) 2026-07-17 10:19:29 +10:00
theme_site_setting_resolver_spec.rb FEATURE: Themeable site settings (#32233) 2025-07-16 11:00:21 +10:00
timeline_lookup_spec.rb
tiny_japanese_segmenter_spec.rb
topic_creator_spec.rb FIX: Scope duplicate topic title check to what the user can see (#41871) 2026-07-24 15:35:35 +02:00
topic_localization_creator_spec.rb FIX: Update topic excerpts when the first post is localized (#36885) 2025-12-29 23:33:39 +08:00
topic_localization_destroyer_spec.rb FIX: Also check if user can see post or topic prior to letting them localize it (#36749) 2025-12-18 02:12:58 +08:00
topic_localization_updater_spec.rb FIX: Also check if user can see post or topic prior to letting them localize it (#36749) 2025-12-18 02:12:58 +08:00
topic_og_image_generator_spec.rb FEATURE: generated OpenGraph images for topics (#39194) 2026-06-26 10:37:10 -04:00
topic_publisher_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_query_spec.rb FEATURE: Add upcoming change for unified new view (#40631) 2026-06-09 11:34:22 +10:00
topic_retriever_spec.rb
topic_upload_security_manager_spec.rb
topic_view_spec.rb FIX: Allow selecting tags that are only used in personal messages (#41918) 2026-07-24 12:27:03 +02:00
topics_bulk_action_spec.rb FIX: Scope group archive and inbox actions to the group's messages (#41662) 2026-07-14 10:05:10 +05:30
topics_filter_spec.rb SECURITY: Enforce first-post visibility for topic bookmarks [backport 2026.7] (#42353) 2026-08-05 12:53:16 -05:00
trashable_spec.rb
truncate_logs_formatter_spec.rb
trust_level_spec.rb
twitter_api_spec.rb Revert "DEV: Replace Rinku native gem with PrettyText" (#31692) 2025-03-07 12:01:22 +10:00
unread_spec.rb
upcoming_changes_spec.rb FEATURE: Upcoming change to lower the pending users reminder delay default (#42019) 2026-07-28 14:24:30 +02:00
upload_creator_spec.rb FIX: Run validation checks for heic, heif files before conversion (#42075) 2026-07-28 12:26:27 +08:00
upload_markdown_spec.rb FIX: Prevent backslash accumulation in upload markdown labels (#39461) 2026-06-03 18:10:38 +02:00
upload_recovery_spec.rb DEV: Add setting to tag s3 objects enabling tag based access control policies (#32988) 2025-06-16 13:26:18 +08:00
upload_security_spec.rb
url_helper_spec.rb DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
user_comm_screener_spec.rb FIX: likes are not visible when rejecting PMs (#35753) 2025-11-03 16:23:32 +11:00
user_lookup_spec.rb
user_name_suggester_spec.rb FIX: Leave username blank during OAuth signup when no valid suggestion exists (#36830) 2026-01-08 11:02:35 +01:00
version_compatibility_spec.rb UX: Do not log error for empty .discourse-compatibility file (#41804) 2026-07-17 10:55:00 +01:00
work_queue_spec.rb