Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/lib/guardian
History
Exact
discoursebot ad8a59cb03
 SECURITY: Block requests for hidden post revisions through historical version reconstruction [backport 2026.7] (#42270) 
Backport of #42269 to release/2026.7.

---

## Summary

Prevent unauthorized disclosure of moderator-hidden post revisions by
blocking non-staff historical version requests when a hidden revision
exists at or before the requested version. The controller now uses a
dedicated Guardian predicate to enforce this range-based authorization
before reconstructing post content. Staff retain legitimate access
through their existing hidden-revision review permission.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1113

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Mark VanLandingham <markvanlan@gmail.com>
2026-08-03 12:27:57 -05:00
..
bookmark_guardian.rb
category_guardian.rb PERF: Speed up category visibility checks (#41977) 2026-07-24 07:53:49 +08:00
ensure_magic.rb
flag_guardian.rb
group_guardian.rb FEATURE: Split setting for allowing mods to manage categories and groups (#35174) 2025-10-06 10:43:42 +03:00
invite_guardian.rb FEATURE: Allow inviting new users directly as admins (#41748) 2026-07-16 14:59:24 -07:00
localization_guardian.rb FIX: Allow manual Community sidebar links to be localized (#41898) 2026-07-22 15:57:56 +08:00
permalink_guardian.rb SECURITY: prevent permalink redirects from leaking restricted slugs 2026-01-28 17:11:14 +00:00
post_guardian.rb FIX: allow category group moderators to view edit history (#37876) 2026-07-24 16:29:06 +02:00
post_revision_guardian.rb SECURITY: Block requests for hidden post revisions through historical version reconstruction [backport 2026.7] (#42270) 2026-08-03 12:27:57 -05:00
sidebar_guardian.rb
staff_action_log_guardian.rb SECURITY: Restrict staff action logs visibility for moderators 2026-01-28 17:11:14 +00:00
tag_guardian.rb FIX: Don't auto-remove chat members from logged_in_users group (#40543) 2026-06-03 18:15:32 +02:00
topic_guardian.rb SECURITY: Scope PM reviewables to their allowed audience 2026-07-28 16:40:22 +02:00
upload_guardian.rb FIX: Enforce secure-upload ACL in AI bot prompt path (#39903) 2026-05-13 09:55:32 +08:00
user_guardian.rb FIX: Post serialization exposes hidden-profile user status messages (#40885) 2026-06-15 09:25:47 -05:00