Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-09 21:45:25 +08:00
Code Packages Activity Actions
discourse/app
History
Exact
discourse-patch-triage[bot] 0f50a07a6e SECURITY: Signup-time primary_group_id assignment grants whisperer access [backport 2026.1] 
Backport of #698 to release/2026.1.

---

## Summary

Applies security patch from triage.

## Security advisory

https://github.com/discourse/discourse/security/advisories/GHSA-vmwq-jvxx-jwfx

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/978
- Original commit:

---

🤖 Auto-generated from the patch diff via Patch Triage. Review carefully before merging.
2026-06-30 16:27:06 +02:00
..
assets UX: Improve post stream scrolling stability and layout control [backport 2026.1] (#38318) 2026-03-06 10:06:47 -06:00
controllers SECURITY: Signup-time primary_group_id assignment grants whisperer access [backport 2026.1] 2026-06-30 16:27:06 +02:00
helpers UX: add preview to email templates (#36657) 2026-01-08 11:33:53 +04:00
jobs SECURITY: Authorize secure-upload hotlink downloads against post user [backport 2026.1] 2026-06-30 16:27:06 +02:00
mailers UX: improve sender name in emails (#36974) 2026-01-06 15:41:01 +04:00
models SECURITY: Signup-time primary_group_id assignment grants whisperer access [backport 2026.1] 2026-06-30 16:27:06 +02:00
queries/reports FEATURE: Add admin-only reports and centralize report visibility logic 2026-01-28 17:11:14 +00:00
serializers SECURITY: Hidden post revisions leak through adjacent visible diffs [backport 2026.1] 2026-06-30 16:27:06 +02:00
services SECURITY: Regular users can route multipart uploads into the admin backup store [backport 2026.1] 2026-06-30 16:27:06 +02:00
views FIX: Strip HTML from category og:description meta tag (#37322) 2026-01-27 18:16:35 +11:00