mirror of
https://gh.wpcy.net/https://github.com/discourse/discourse.git
synced 2026-05-01 04:07:14 +08:00
47728575f8
The `upload_csv` endpoint accepted user-controlled CSV headers without validation, allowing arbitrary keys into the invite hashes passed to the BulkInvite job. Restrict accepted columns to the ones already handled in BulkInvite ( basically, `email`, `groups`, `topic_id`, `locale`) plus valid UserField names. |
||
|---|---|---|
| .. | ||
| discourse.csv | ||
| discourse_headers.csv | ||
| invite_malicious_headers.csv | ||
| invite_valid_and_invalid_headers.csv | ||
| invites_with_locales.csv | ||
| s3_inventory.csv | ||
| tags.csv | ||
| tags_invalid.csv | ||
| user_emails.csv | ||
| usernames.csv | ||
| usernames_with_nil_values.csv | ||
| words.csv | ||
| words_case_sensitive.csv | ||
| words_tag.csv | ||
