Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-11 02:59:07 +08:00
Code Packages Activity Actions
discourse/frontend
History
Exact
Joffrey JAFFEUX f5d35e9b65 SECURITY: XSS when editing a malicious post 
A user full name can be evaluated as raw HTML when the following settings are set:
- `display_name_on_posts` => true
- `prioritize_username_in_ux` => false

Editing a post of a malicious user would trigger and XSS. The fix is to escape the content.
2026-02-26 12:17:27 +00:00
..
asset-processor Build(deps): Bump @rollup/browser from 4.53.5 to 4.54.0 (#36820) 2025-12-21 22:29:51 +01:00
custom-proxy Build(deps-dev): Bump glob from 11.1.0 to 13.0.0 (#36125) 2025-12-02 17:51:50 +01:00
deprecation-silencer
discourse SECURITY: XSS when editing a malicious post 2026-02-26 12:17:27 +00:00
discourse-i18n DEV: Fix random typos (#36505) 2025-12-08 11:33:19 +01:00
discourse-markdown-it FIX: strip quotation marks from names in quote BBCode (#36666) 2025-12-18 09:46:31 +01:00
discourse-plugins DEV: Enforce deprecation-free tests for preinstalled plugins/themes (#36445) 2025-12-16 17:48:29 -03:00
discourse-types DEV: Overhaul typechecking configuration (#35794) 2025-11-12 12:54:34 +00:00
ember-cli-progress-ci
pretty-text Build(deps-dev): Bump ember-cli from 6.9.0 to 6.9.1 (#36641) 2025-12-12 02:03:35 +01:00
.npmrc
polyfills.js