mirror of
https://github.com/discourse/discourse.git
synced 2026-08-07 13:19:19 +08:00
71f57d1d9a
Backport of #473 to release/2026.1. --- Two issues fixed: 1. **Group visibility bypass** — the `target_groups` parameter was passed directly to the user resolution query without checking group or member visibility for the acting user. An authenticated chat user could craft an API request with a known private/hidden group name and receive a channel containing that group's members, leaking their identities. Fix: filter `target_groups` through `visible_groups` and `members_visible_groups` scopes before resolving users in both `CreateDirectMessageChannel` and `AddUsersToChannel` services. 2. **Chat-disabled user bypass** — `can_chat?` only checked group membership, not the `chat_enabled` user preference. A chat-disabled user could create or query DM channels between other users via the direct messages API, potentially exposing private `last_message` content. Fix: add `chat_enabled` check to `can_chat?` and add an actor inclusion guard in `fetch_target_users` so the service fails if the acting user gets filtered out of the resolved user set. --- **Security Advisory:** https://github.com/discourse/discourse/security/advisories/GHSA-2m5j-6v2r-cq2h |
||
|---|---|---|
| .. | ||
| automation | ||
| chat | ||
| checklist | ||
| discourse-adplugin | ||
| discourse-affiliate | ||
| discourse-ai | ||
| discourse-apple-auth | ||
| discourse-assign | ||
| discourse-cakeday | ||
| discourse-calendar | ||
| discourse-chat-integration | ||
| discourse-data-explorer | ||
| discourse-details | ||
| discourse-gamification | ||
| discourse-github | ||
| discourse-graphviz | ||
| discourse-hcaptcha | ||
| discourse-lazy-videos | ||
| discourse-local-dates | ||
| discourse-login-with-amazon | ||
| discourse-lti | ||
| discourse-math | ||
| discourse-microsoft-auth | ||
| discourse-narrative-bot | ||
| discourse-oauth2-basic | ||
| discourse-openid-connect | ||
| discourse-patreon | ||
| discourse-policy | ||
| discourse-post-voting | ||
| discourse-presence | ||
| discourse-reactions | ||
| discourse-rewind | ||
| discourse-rss-polling | ||
| discourse-solved | ||
| discourse-subscriptions | ||
| discourse-templates | ||
| discourse-topic-voting | ||
| discourse-user-notes | ||
| discourse-zendesk-plugin | ||
| footnote | ||
| poll | ||
| spoiler-alert | ||
| styleguide | ||
