mirror of
https://github.com/discourse/discourse.git
synced 2026-08-11 02:59:07 +08:00
81497765aa
Backport of #603 to release/2026.1. --- The `test_email_settings` endpoint in `GroupsController` allowed non-staff group owners to make the server open outbound SMTP connections to arbitrary `host:port` combinations, creating an SSRF primitive. On hosted Discourse instances, even site admins don't have infrastructure access, so an unfiltered SMTP test endpoint lets them probe internal networks, cloud metadata endpoints, and internal services. This PR: - Tightens authorization from `ensure_can_edit!` to `ensure_can_admin_group!` so only admins/moderators can access the endpoint - Adds SSRF filtering using `FinalDestination::SSRFDetector` to block connections to private/internal IP addresses - Adds tests for both the auth restriction and SSRF filtering --- **Security Advisory:** https://github.com/discourse/discourse/security/advisories/GHSA-5976-77mj-m4h3 |
||
|---|---|---|
| .. | ||
| environments | ||
| initializers | ||
| locales | ||
| application.rb | ||
| boot.rb | ||
| cdn.yml.sample | ||
| database.yml | ||
| deploy.rb.sample | ||
| dev_defaults.yml | ||
| discourse.config.sample | ||
| discourse.pill.sample | ||
| discourse_defaults.conf | ||
| environment.rb | ||
| logrotate.conf | ||
| multisite.yml.production-sample | ||
| nginx.sample.conf | ||
| official_plugins.json | ||
| pitchfork.conf.rb | ||
| projections.json | ||
| puma.rb | ||
| routes.rb | ||
| sidekiq.yml | ||
| site_settings.yml | ||
| spring.rb | ||
| thin.yml.sample | ||
| unicorn.conf.rb | ||
| unicorn_launcher | ||
