0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-11 02:59:07 +08:00
discourse/app/services
discourse-patch-triage[bot] 7ddde26661 SECURITY: Regular users can route multipart uploads into the admin backup store [backport 2026.1]
Backport of #665 to release/2026.1.

---

## Summary

Applies security patch from triage.

## Security advisory

https://github.com/discourse/discourse/security/advisories/GHSA-3mvf-q9rg-w6m7

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1068
- Original commit:

---

🤖 Auto-generated from the patch diff via Patch Triage. Review carefully before merging.
2026-06-30 16:27:06 +02:00
..
admin_notices FIX: Dismissing admin notices fails with 422 when tracker has NULL target (#36878) 2025-12-29 16:32:12 +01:00
discourse_id DEV: Allow new instances to be set up directly with Discourse ID (#36731) 2025-12-23 12:13:36 -05:00
flags FEATURE: allow edit custom flags (#32344) 2025-04-17 12:31:52 +08:00
notification/action FEATURE: Notify admins of upcoming changes and log events (#37003) 2026-01-21 12:45:54 +10:00
notifications FEATURE: Consolidate link notifications (#26567) 2024-04-09 11:53:37 -06:00
problem_check SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks [backport 2026.1] 2026-06-30 16:27:06 +02:00
review DEV: Log Reviewable actions (#36076) 2025-11-20 13:41:40 +11:00
site_setting FEATURE: log admin's choice to backfill when updating a default site (#36296) 2025-11-27 18:40:07 +01:00
spam_rule FIX: Moderator notifications when new post auto-silences a user (#35403) 2025-10-15 16:07:56 +08:00
tags I18N: Add pluralization for chat rewind, bulk tagging & post deleted msg (#37255) 2026-01-26 14:41:54 +01:00
themes FIX: Add delete button to themes grid (#34606) 2025-08-29 10:09:23 +08:00
upcoming_changes FEATURE: Notify admins of upcoming changes and log events (#37003) 2026-01-21 12:45:54 +10:00
user SECURITY: Enforce edit permissions and audit trail in TriggerPostAction 2026-03-19 15:46:24 +00:00
video_conversion DEV: Add video conversion support for chat messages (#36275) 2025-12-01 12:34:56 -07:00
anonymous_shadow_creator.rb UX: Improve naming for anonymous mode settings (#31832) 2025-03-21 04:54:06 +03:00
badge_granter.rb FIX: Allow badges with SQL queries to be manually granted (#36866) 2026-01-09 13:58:09 +01:00
base_bookmarkable.rb SECURITY: Ensure guardian check when creating QueryGroupBookmark 2026-02-26 12:24:37 +00:00
category_hashtag_data_source.rb FEATURE: add icons and emojis to category (#31795) 2025-03-26 09:46:17 +04:00
category_hierarchical_search.rb FIX: Load categories for edit navigation menu modal in hierarchical order (#36927) 2026-01-07 14:03:52 +08:00
color_scheme_revisor.rb FEATURE: Allow editing theme-owned palettes (#34722) 2025-10-06 09:02:39 +03:00
destroy_task.rb FIX: Confirmation prompt breaks when using pipe (#35261) 2025-10-08 11:12:09 +08:00
email_settings_exception_handler.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
email_settings_validator.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
email_style_updater.rb
external_upload_manager.rb SECURITY: Regular users can route multipart uploads into the admin backup store [backport 2026.1] 2026-06-30 16:27:06 +02:00
group_action_logger.rb
group_mentions_updater.rb
group_message.rb DEV: Don't allow context-free system post destruction (#32523) 2025-05-05 09:58:29 +08:00
handle_chunk_upload.rb
hashtag_autocomplete_service.rb FEATURE: add icons and emojis to category (#31795) 2025-03-26 09:46:17 +04:00
heat_settings_updater.rb
inline_uploads.rb FIX: Use filename as alt for hotlinked image uploads (#31651) 2025-03-11 14:45:06 +11:00
locale_normalizer.rb FIX: Show localization for regionless locale if they exist (#33702) 2025-07-21 15:45:14 +08:00
notification_emailer.rb DEV: Bump rubocop_discourse (#29608) 2024-11-06 06:27:49 +08:00
post_action_notifier.rb
post_alerter.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
post_bookmarkable.rb FIX: Serialize categories for bookmarks (#26606) 2024-04-17 17:23:47 +03:00
post_owner_changer.rb SECURITY: Ensure moderator can see post/topic before allowing them to change owner 2026-01-28 17:11:14 +00:00
push_notification_pusher.rb FIX: avoid double base path on push notification (#32228) 2025-04-12 08:16:53 +10:00
random_topic_selector.rb
registered_bookmarkable.rb FIX: Bookmarkable query placholders (#35935) 2025-11-10 12:36:53 +10:00
search_indexer.rb FEATURE: Add full-text search for chat messages (#34704) 2025-10-22 11:30:35 +02:00
sidebar_section_links_updater.rb DEV: Limit the number of category sidebar links a user can have (#26756) 2024-04-25 13:21:39 -05:00
sidebar_site_settings_backfiller.rb DEV: Drop distributed mutex fromSidebarSiteSettingsBackfiller#backfill! (#25674) 2024-02-15 06:21:03 +08:00
site_setting_update_existing_users.rb FEATURE: Convert watched_precedence_over_muted to default site setting (#35671) 2025-10-30 10:04:18 +10:00
site_settings_task.rb FEATURE: mandatory fields for group site setting (#26612) 2024-04-18 08:53:52 +10:00
staff_action_logger.rb SECURITY: Restrict staff action logs visibility for moderators 2026-01-28 17:11:14 +00:00
tag_hashtag_data_source.rb DEV: add tag hashtag data source style type (#33289) 2025-06-20 18:08:47 +04:00
theme_settings_migrations_runner.rb DEV: Prepare for rename of app/assets/javascripts/ -> frontend/ 2025-10-22 16:24:11 +01:00
themes_install_task.rb FEATURE: Theme settings migrations (#24071) 2023-11-02 08:10:15 +03:00
topic_bookmarkable.rb FIX: Serialize categories for bookmarks (#26606) 2024-04-17 17:23:47 +03:00
topic_status_updater.rb FIX: Exclude unlisted topics from hot scores (#37312) 2026-01-27 13:46:57 +11:00
topic_timestamp_changer.rb
tracked_topics_updater.rb
trust_level_granter.rb
user_action_manager.rb FIX: permanent delete of posts by deleted users (#28992) 2024-09-24 12:26:31 +03:00
user_activator.rb DEV: Move more data into the server session (#35145) 2025-10-03 10:20:32 +02:00
user_anonymizer.rb FIX: Clean up historical staff logs when anonymizing users (#36936) 2026-01-14 14:53:38 +01:00
user_authenticator.rb DEV: Move more data into the server session (#35145) 2025-10-03 10:20:32 +02:00
user_destroyer.rb FIX: UserDestroyer should unclaim any claimed reviewables. (#36277) 2025-11-27 13:54:48 +11:00
user_merger.rb FIX: blocks post action merge for duplicated flags (#36265) 2025-11-26 16:17:57 -03:00
user_notification_renderer.rb
user_notification_schedule_processor.rb
user_password_expirer.rb DEV: Migrate user passwords data to UserPassword table (#28746) 2024-10-10 09:23:06 +08:00
user_silencer.rb FIX: Include silence reason for auto-silenced users (#35898) 2025-11-12 07:53:53 +08:00
user_stat_count_updater.rb
user_suspender.rb SECURITY: Don't allow suspending staff users via other_user_ids param 2024-07-03 20:49:29 +08:00
user_updater.rb FEATURE: disable link notification user preference (#35352) 2025-10-14 10:53:05 +02:00
username_changer.rb
username_checker_service.rb
web_hook_emitter.rb DEV: Move webhook event header modifier for redelivery-recalucation (#27177) 2024-05-24 10:37:10 -05:00
wildcard_domain_checker.rb
wildcard_url_checker.rb
word_watcher.rb FIX: silent failure when watched words contains invalid regex (#36132) 2025-11-25 21:56:33 +01:00