Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-12 05:37:26 +08:00
Code Packages Activity Actions
discourse/spec/models
History
Exact
Régis Hanol ac7664d733 SECURITY: prevent permalink redirects from leaking restricted slugs 
Permalinks pointing to access-restricted resources (private topics,
categories, posts, or hidden tags) were redirecting users to URLs
containing the resource slug, even when the user didn't have access.

This leaked potentially sensitive information (e.g., private topic
titles) via the redirect Location header and the 404 page's search box.

This fix adds access checks via a new `PermalinkGuardian` module before
redirecting or returning target URLs. If the current user cannot see
the target resource, a 404 is returned instead.

Also fixes `Guardian#can_see_tag?` to properly check hidden tag
visibility instead of always returning true.

Ref - t/172554
2026-01-28 17:10:56 +00:00
..
concerns FEATURE: Add support for uploads on translated posts (#35871) 2025-11-12 08:55:21 -08:00
about_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
admin_dashboard_data_spec.rb DEV: Remove old problem check system - part 2 (#34403) 2025-08-20 16:15:21 +08:00
admin_notice_spec.rb DEV: Database backed admin notices (#26192) 2024-05-23 09:29:08 +08:00
api_key_scope_spec.rb FIX: Logs api scope not working (#25215) 2024-01-10 19:30:10 -07:00
api_key_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
application_request_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
associated_group_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
badge_grouping_spec.rb DEV: Remove unnecessary rails_helper requiring (#26364) 2024-03-26 11:32:01 +01:00
badge_spec.rb FIX: Don't require restart for first flag badge working with custom flag (#35733) 2025-11-03 09:42:33 +08:00
badge_type_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
bookmark_spec.rb FIX: notification reminder is deleted with bookmark (#35141) 2025-10-03 08:34:19 +02:00
category_featured_topic_spec.rb DEV: Convert min_trust_to_create_topic to groups (#24740) 2023-12-13 14:50:13 +11:00
category_group_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
category_list_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
category_localization_spec.rb FEATURE: Show translated category names from localizations table if they exist for the user locale (#32380) 2025-04-22 15:13:19 +08:00
category_setting_spec.rb FEATURE: Configurable auto-bump cooldown (#20507) 2023-03-10 13:45:01 +08:00
category_spec.rb DEV: Sync category permissions when group membership changes 2025-11-28 15:44:33 -03:00
category_tag_stat_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
category_user_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
child_theme_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
color_scheme_color_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
color_scheme_spec.rb FEATURE: Allow editing theme-owned palettes (#34722) 2025-10-06 09:02:39 +03:00
developer_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
digest_email_site_setting_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
directory_item_spec.rb PERF: DirectoryItem.refresh! daily can take an extremely long time (#35860) 2025-11-10 13:23:23 +10:00
discourse_connect_spec.rb DEV: Finish renaming secure_session to server_session 2025-09-23 10:35:02 +02:00
do_not_disturb_timing_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
draft_sequence_spec.rb FEATURE: Multiple Draft Topics (#30790) 2025-01-29 10:23:26 +04:00
draft_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
email_change_request_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
email_log_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
email_token_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
embeddable_host_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
embeddable_host_tag_spec.rb FEATURE: Extend embeddable hosts with Individual tags and author assignments (#26868) 2024-05-16 15:47:01 -04:00
emoji_spec.rb FIX: Emoji.exists? should be consistent with Emoji[] (#36347) 2025-12-01 18:58:30 +01:00
flag_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
form_template_spec.rb DEV: Fix flaky test for form template (#33960) 2025-07-30 13:55:26 +10:00
given_daily_like_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
global_setting_spec.rb FIX: GlobalSetting should treat negative integers as integers (#36276) 2025-11-26 15:52:19 -08:00
group_archived_message_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
group_associated_group_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
group_history_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
group_request_spec.rb DEV: Bump the limits on group request text fields 2023-05-24 09:57:46 +02:00
group_spec.rb FIX: Remove flair, title, when user is removed from automatic group (e.g. admin, moderator) (#36842) 2025-12-23 21:27:03 +08:00
group_user_spec.rb FIX: Skip trust level changes when group grant_trust_level is 0 (#35572) 2025-10-23 14:23:25 -04:00
incoming_link_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
incoming_links_report_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
invite_redeemer_spec.rb DEV: Migrate user passwords data to UserPassword table (#28746) 2024-10-10 09:23:06 +08:00
invite_spec.rb FIX: reduce redemption_count when invited user is destroyed (#35695) 2025-10-30 13:43:51 +11:00
javascript_cache_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
locale_site_setting_spec.rb FEATURE: Localize language names (#33790) 2025-07-29 11:48:45 +08:00
mailing_list_mode_site_setting_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
moved_post_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
notification_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
onebox_locale_site_setting_spec.rb FEATURE: Add a onebox_locale site setting. (#30655) 2025-01-09 14:11:37 +11:00
optimized_image_spec.rb FIX: key optimized images on format (#32575) 2025-05-06 14:40:51 +10:00
optimized_video_spec.rb DEV: Ensure optimized videos have the correct acl (#36364) 2025-12-01 19:50:08 -07:00
permalink_spec.rb SECURITY: prevent permalink redirects from leaking restricted slugs 2026-01-28 17:10:56 +00:00
plugin_store_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
post_action_spec.rb FIX: Topic creation failure when enabled category moderation (#36094) 2025-11-19 14:07:10 +08:00
post_action_type_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
post_analyzer_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
post_detail_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
post_localization_spec.rb FEATURE: Add support for uploads on translated posts (#35871) 2025-11-12 08:55:21 -08:00
post_mover_spec.rb FEATURE: when moving posts to a PM also add acting user (#36789) 2025-12-22 14:10:41 +11:00
post_reply_key_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
post_reply_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
post_revision_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
post_spec.rb PERF: optimize GitHub PR onebox rebaking (#36739) 2025-12-17 12:06:16 +01:00
post_stripper_spec.rb FIX: user got notified about a mention inside a chat message quote (#24229) 2023-11-08 23:13:25 +04:00
post_timing_spec.rb FIX: update PM tracking state when marking messages as unread (#36258) 2025-11-26 18:29:35 +01:00
private_message_topic_tracking_state_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
problem_check_tracker_spec.rb DEV: Remove admin notices when destroying problem check trackers (#35976) 2025-11-13 10:34:28 +08:00
published_page_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
quoted_post_spec.rb DEV: Fix a flaky quote post spec (#22891) 2023-08-01 00:48:40 +02:00
remote_theme_spec.rb DEV: Only load specific plugin bundles during qunit test (#33678) 2025-07-21 21:00:48 +01:00
report_spec.rb FEATURE: Add admin-only reports and centralize report visibility logic 2026-01-28 17:10:56 +00:00
reviewable_action_log_spec.rb DEV: Log Reviewable actions (#36076) 2025-11-20 13:41:40 +11:00
reviewable_claimed_topic_spec.rb FEATURE: Sync Reviewable Status (#31901) 2025-03-24 14:27:18 +11:00
reviewable_flagged_post_spec.rb FIX: Restore post editing in the new reviewable UI (#35784) 2025-11-05 08:34:32 +08:00
reviewable_history_spec.rb DEV: Convert min_trust_to_flag_posts setting to groups (#24864) 2023-12-13 17:18:42 +08:00
reviewable_note_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
reviewable_post_spec.rb FIX: Restore post editing in the new reviewable UI (#35784) 2025-11-05 08:34:32 +08:00
reviewable_queued_post_spec.rb FIX: Restore post editing in the new reviewable UI (#35784) 2025-11-05 08:34:32 +08:00
reviewable_score_spec.rb DEV: Automatically update groups for test users with explicit TL (#25415) 2024-01-29 17:52:02 +08:00
reviewable_spec.rb DEV: Log Reviewable actions (#36076) 2025-11-20 13:41:40 +11:00
reviewable_user_spec.rb FEATURE: Update the ReviewableUser UI for the review queue refresh. (#35515) 2025-10-29 08:54:08 +08:00
s3_region_site_setting_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
screened_email_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
screened_ip_address_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
screened_url_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
search_log_spec.rb DEV: Add search_log modifier to prevent search log logging (#28279) 2024-08-08 12:41:10 -05:00
sidebar_section_link_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
sidebar_section_spec.rb FEATURE: dynamic search when in /filter route (#33614) 2025-07-22 16:08:10 +10:00
sidebar_url_spec.rb FIX: increase sidebar URL limit to 1000 (#23120) 2023-08-17 14:46:24 +10:00
site_setting_spec.rb DEV: Refactor and add missing tests for upload type in objects schema (#36285) 2025-11-28 04:02:23 +08:00
site_spec.rb FEATURE: Split setting for allowing mods to manage categories and groups (#35174) 2025-10-06 10:43:42 +03:00
sitemap_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
skipped_email_log_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
stylesheet_cache_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
tag_group_spec.rb FIX: csv import not being casing aware for tag groups (#35837) 2025-11-10 11:34:23 -03:00
tag_localization_spec.rb DEV: Add tag localization tables (#35962) 2025-11-11 20:39:54 +08:00
tag_spec.rb DEV: Use tag_name/tag.name instead of tag_id/tag.id where the name is actually used (#36226) 2025-12-29 13:20:06 +08:00
tag_user_spec.rb FEATURE: Convert watched_precedence_over_muted to default site setting (#35671) 2025-10-30 10:04:18 +10:00
theme_field_spec.rb DEV: Use rollup for theme JS compilation (#33103) 2025-07-25 12:02:29 +01:00
theme_modifier_set_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
theme_setting_spec.rb DEV: Refactor and add missing tests for upload type in objects schema (#36285) 2025-11-28 04:02:23 +08:00
theme_settings_migration_spec.rb FEATURE: Theme settings migrations (#24071) 2023-11-02 08:10:15 +03:00
theme_site_setting_spec.rb DEV: Refactor and add missing tests for upload type in objects schema (#36285) 2025-11-28 04:02:23 +08:00
theme_spec.rb FEATURE: enhance screenshot support for themes with dark/light modes (#36422) 2025-12-10 11:23:21 +10:00
theme_svg_sprite_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
top_menu_item_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
top_topic_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_allowed_user_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
topic_converter_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_embed_spec.rb FIX: Use oEmbed for YouTube oneboxing (#35959) 2025-11-12 14:13:16 +10:00
topic_featured_users_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
topic_group_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
topic_hot_scores_spec.rb FIX: remove category definition topics in hot (#35449) 2025-10-16 18:14:06 +02:00
topic_invite_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
topic_link_click_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_link_spec.rb SECURITY: Respect max length in bot-human PMs 2025-06-09 12:04:11 +08:00
topic_list_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_localization_spec.rb DEV: Add rake task to backfill localization excerpts which were empty (#36901) 2025-12-30 17:04:36 +08:00
topic_participant_groups_summary_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_participants_summary_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_posters_summary_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_spec.rb PERF: Optimize CategoryList#relevant_topics_query SQL query (#36476) 2025-12-08 09:31:46 +08:00
topic_tag_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
topic_thumbnail_spec.rb DEV: Fix random typos (#22078) 2023-06-13 22:02:21 +02:00
topic_timer_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
topic_tracking_state_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_user_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
topic_view_item_spec.rb FEATURE: topic_view_stats table with daily fidelity (#27197) 2024-05-27 15:25:32 +10:00
translation_override_spec.rb DEV: Refresh translation override status when updating (#31233) 2025-02-07 14:12:28 +08:00
trust_level3_requirements_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
trust_level_and_staff_setting_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
trust_level_setting_spec.rb DEV: Fix flaky deprecated setting specs (#30550) 2025-01-04 12:55:22 +01:00
unsubscribe_key_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
upload_reference_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
upload_spec.rb DEV: Better protection for drafts 2026-01-28 17:10:56 +00:00
user_action_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
user_api_key_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
user_archived_message_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
user_associated_group_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
user_auth_token_spec.rb DEV: Allow impersonation without session swapping (#34213) 2025-08-21 14:18:15 +08:00
user_avatar_spec.rb DEV: ensure rebaking works even when some users have inconsistent data (#30261) 2024-12-16 19:48:25 +08:00
user_badge_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
user_bookmark_list_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
user_custom_field_spec.rb FIX: Searchable user fields do not always have an integer name (#30223) 2024-12-17 11:06:19 +11:00
user_email_spec.rb DEV: ensure rebaking works even when some users have inconsistent data (#30261) 2024-12-16 19:48:25 +08:00
user_export_spec.rb FEATURE: Allow admins to export users (#30918) 2025-01-24 08:13:25 +11:00
user_field_spec.rb FEATURE: Implement new required options in admin user fields UI (#27079) 2024-05-23 19:18:25 +08:00
user_history_spec.rb SECURITY: Restrict staff action logs visibility for moderators 2026-01-28 17:10:56 +00:00
user_notification_schedule_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
user_option_spec.rb FEATURE: Convert watched_precedence_over_muted to default site setting (#35671) 2025-10-30 10:04:18 +10:00
user_password_spec.rb FIX: setting new password should reset password_expired_at (#29296) 2024-10-21 07:24:43 +08:00
user_profile_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
user_profile_view_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
user_search_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
user_second_factor_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
user_security_key_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
user_spec.rb DEV: Allow new instances to be set up directly with Discourse ID (#36731) 2025-12-23 12:13:36 -05:00
user_stat_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
user_status_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
user_summary_spec.rb PERF: Improve performance of most_replied_to_users (#26373) 2024-04-03 14:20:54 -06:00
user_visit_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
username_validator_spec.rb FEATURE: Add plugin hook for extra username validations (#35522) 2025-10-27 11:03:42 -03:00
watched_word_group_spec.rb SECURITY: limit the number of characters in watched word replacements. 2024-07-15 19:25:17 +08:00
watched_word_spec.rb SECURITY: limit the number of characters in watched word replacements. 2024-07-15 19:25:17 +08:00
web_crawler_request_spec.rb DEV: stop leaking data into tables during test (#21403) 2023-05-06 07:15:33 +10:00
web_hook_event_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
web_hook_event_type_spec.rb Add user_anonymized webhook event (#36208) 2025-11-25 07:43:16 -08:00
web_hook_events_daily_aggregate_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
web_hook_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00