Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-09 21:45:25 +08:00
Code Packages Activity Actions
discourse/spec/lib/guardian
History
Exact
discoursebot ad8a59cb03
 SECURITY: Block requests for hidden post revisions through historical version reconstruction [backport 2026.7] (#42270) 
Backport of #42269 to release/2026.7.

---

## Summary

Prevent unauthorized disclosure of moderator-hidden post revisions by
blocking non-staff historical version requests when a hidden revision
exists at or before the requested version. The controller now uses a
dedicated Guardian predicate to enforce this range-based authorization
before reconstructing post content. Staff retain legitimate access
through their existing hidden-revision review permission.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1113

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Mark VanLandingham <markvanlan@gmail.com>
2026-08-03 12:27:57 -05:00
..
bookmark_guardian_spec.rb
flag_guardian_spec.rb
invite_guardian_spec.rb FEATURE: Allow inviting new users directly as admins (#41748) 2026-07-16 14:59:24 -07:00
localization_guardian_spec.rb FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
post_guardian_spec.rb FIX: allow category group moderators to view edit history (#37876) 2026-07-24 16:29:06 +02:00
post_revision_guardian_spec.rb SECURITY: Block requests for hidden post revisions through historical version reconstruction [backport 2026.7] (#42270) 2026-08-03 12:27:57 -05:00
staff_action_log_guardian_spec.rb
tag_guardian_spec.rb FIX: Don't auto-remove chat members from logged_in_users group (#40543) 2026-06-03 18:15:32 +02:00
topic_guardian_spec.rb FEATURE: Allow topic_timers_allowed_groups to manage topic timers (#41126) 2026-06-23 12:46:56 -05:00
upload_guardian_spec.rb FIX: Enforce secure-upload ACL in AI bot prompt path (#39903) 2026-05-13 09:55:32 +08:00
user_guardian_spec.rb FIX: Reject DiscourseConnect SSO payloads when secret is blank (#40830) 2026-06-12 15:17:16 +03:00