Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/config/locales
History
Exact
Nat 3a3d315a85 SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks [backport 2026.1] 
Manual backport of #732 to 2026.1. Conflict in server.en.yml (no qq_mail_smtp line on this branch) resolved.
  GHSA-8f9m-v436-wr3x

---

Any AWS account holder can subscribe their own SNS topic to a Discourse instance's /webhooks/aws and publish bounce notifications that AWS will sign legitimately. The forged bounces are processed against arbitrary user emails, bumping bounce_score and eventually triggering email revocation..

This fix adds a new `aws_sns_topic_arn_allowlist` site setting. Also hardens Jobs::ProcessSnsNotification against three issues:
- Binds bounces to (message_id, to_address) via find_by, so a legitimately-subscribed SNS publisher can no longer bounce arbitrary recipients we didn't send to.
- Skips duplicate notifications (next if email_log.bounced?) — AWS SNS delivers at-least-once.
- Uses update! instead of update_columns so EmailLog's existing before_save normalizes the bounce status code.

Also add a dashboard problem flags self-hosted admins whose SMTP looks like SES but who haven't set the allowlist yet.

https://github.com/discourse/discourse/security/advisories/GHSA-8f9m-v436-wr3x
2026-06-30 16:27:06 +02:00
..
client.ar.yml I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
client.be.yml I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
client.bg.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.bs_BA.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.ca.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.cs.yml I18N: Update translations (#37802) 2026-02-13 09:31:51 +01:00
client.da.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.de.yml I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
client.el.yml I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
client.en.yml FIX: Missing link titles for upcoming change notifications (#37323) 2026-01-28 09:52:24 +10:00
client.en_GB.yml I18N: Update translations (#37101) 2026-01-14 09:39:58 +01:00
client.es.yml I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
client.et.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.fa_IR.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.fi.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.fr.yml I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
client.gl.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.he.yml I18N: Update translations (#37374) 2026-01-29 09:42:01 +01:00
client.hr.yml I18N: Update translations (#37630) 2026-02-09 09:34:28 +01:00
client.hu.yml I18N: Update translations (#37441) 2026-02-02 09:59:49 +01:00
client.hy.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.id.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.it.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.ja.yml I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
client.ko.yml I18N: Update translations (#37441) 2026-02-02 09:59:49 +01:00
client.lt.yml I18N: Update translations (#37374) 2026-01-29 09:42:01 +01:00
client.lv.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.nb_NO.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.nl.yml I18N: Update translations (#37752) 2026-02-12 10:30:00 +01:00
client.pl_PL.yml I18N: Update translations (#37374) 2026-01-29 09:42:01 +01:00
client.pt.yml I18N: Update translations (#37374) 2026-01-29 09:42:01 +01:00
client.pt_BR.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.ro.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.ru.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.sk.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.sl.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.sq.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.sr.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.sv.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.sw.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.te.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.th.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.tr_TR.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
client.ug.yml I18N: Update translations (#37525) 2026-02-04 12:32:19 +01:00
client.uk.yml I18N: Update translations (#37478) 2026-02-04 00:17:58 +01:00
client.ur.yml I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
client.vi.yml I18N: Update translations (#37562) 2026-02-05 09:18:39 +01:00
client.zh_CN.yml I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
client.zh_TW.yml I18N: Update translations (#37328) 2026-01-27 15:25:08 +01:00
names.yml UX: Use English as language label where appropriate (#36762) 2025-12-18 13:10:23 -05:00
plurals.rb DEV: Update Ruby I18n pluralization rules 2024-07-29 15:44:52 +02:00
server.ar.yml I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
server.be.yml I18N: Update translations (#37101) 2026-01-14 09:39:58 +01:00
server.bg.yml I18N: Update translations (#37101) 2026-01-14 09:39:58 +01:00
server.bs_BA.yml I18N: Update translations (#37101) 2026-01-14 09:39:58 +01:00
server.ca.yml I18N: Update translations (#37137) 2026-01-15 09:10:23 +01:00
server.cs.yml I18N: Update translations (#37210) 2026-01-20 11:58:39 +01:00
server.da.yml I18N: Update translations (#37101) 2026-01-14 09:39:58 +01:00
server.de.yml I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
server.el.yml I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
server.en.yml SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks [backport 2026.1] 2026-06-30 16:27:06 +02:00
server.en_GB.yml Update translations (#36220) 2025-12-01 12:52:35 +01:00
server.es.yml I18N: Update translations (#37308) 2026-01-26 19:07:49 +01:00
server.et.yml I18N: Update translations (#37210) 2026-01-20 11:58:39 +01:00
server.fa_IR.yml I18N: Update translations (#37101) 2026-01-14 09:39:58 +01:00
server.fi.yml I18N: Update translations (#37308) 2026-01-26 19:07:49 +01:00
server.fr.yml I18N: Update translations (#37308) 2026-01-26 19:07:49 +01:00
server.gl.yml I18N: Update translations (#37137) 2026-01-15 09:10:23 +01:00
server.he.yml I18N: Update translations (#37308) 2026-01-26 19:07:49 +01:00
server.hr.yml I18N: Update translations (#37630) 2026-02-09 09:34:28 +01:00
server.hu.yml I18N: Update translations (#37441) 2026-02-02 09:59:49 +01:00
server.hy.yml I18N: Update translations (#37210) 2026-01-20 11:58:39 +01:00
server.id.yml I18N: Update translations (#37101) 2026-01-14 09:39:58 +01:00
server.it.yml I18N: Update translations (#37308) 2026-01-26 19:07:49 +01:00
server.ja.yml I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
server.ko.yml I18N: Update translations (#37441) 2026-02-02 09:59:49 +01:00
server.lt.yml I18N: Update translations (#37374) 2026-01-29 09:42:01 +01:00
server.lv.yml I18N: Update translations (#37101) 2026-01-14 09:39:58 +01:00
server.nb_NO.yml I18N: Update translations (#37101) 2026-01-14 09:39:58 +01:00
server.nl.yml I18N: Update translations (#37838) 2026-02-18 09:57:32 +01:00
server.pl_PL.yml I18N: Update translations (#37374) 2026-01-29 09:42:01 +01:00
server.pt.yml I18N: Update translations (#37374) 2026-01-29 09:42:01 +01:00
server.pt_BR.yml I18N: Update translations (#37308) 2026-01-26 19:07:49 +01:00
server.ro.yml I18N: Update translations (#37308) 2026-01-26 19:07:49 +01:00
server.ru.yml I18N: Update translations (#37308) 2026-01-26 19:07:49 +01:00
server.sk.yml I18N: Update translations (#37308) 2026-01-26 19:07:49 +01:00
server.sl.yml I18N: Update translations (#37101) 2026-01-14 09:39:58 +01:00
server.sq.yml I18N: Update translations (#37210) 2026-01-20 11:58:39 +01:00
server.sr.yml I18N: Update translations (#37101) 2026-01-14 09:39:58 +01:00
server.sv.yml I18N: Update translations (#37137) 2026-01-15 09:10:23 +01:00
server.sw.yml I18N: Update translations (#37101) 2026-01-14 09:39:58 +01:00
server.te.yml I18N: Update translations (#37137) 2026-01-15 09:10:23 +01:00
server.th.yml I18N: Update translations (#37101) 2026-01-14 09:39:58 +01:00
server.tr_TR.yml I18N: Update translations (#37308) 2026-01-26 19:07:49 +01:00
server.ug.yml I18N: Update translations (#37308) 2026-01-26 19:07:49 +01:00
server.uk.yml I18N: Update translations (#37478) 2026-02-04 00:17:58 +01:00
server.ur.yml I18N: Update translations (#37210) 2026-01-20 11:58:39 +01:00
server.vi.yml I18N: Update translations (#37234) 2026-01-21 11:07:13 +01:00
server.zh_CN.yml I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
server.zh_TW.yml I18N: Update translations (#37101) 2026-01-14 09:39:58 +01:00
transliterate.ar.yml Create transliterate.ar.yml (#6197) 2018-07-31 14:41:49 +10:00
transliterate.bg.yml FEATURE: Add Bulgarian language 2018-05-29 21:07:17 +02:00
transliterate.de.yml FEATURE: Adds transliteration of German umlauts in slugs 2015-02-27 23:53:58 +01:00
transliterate.el.yml UX: Add transliteration support for the Greek language 2019-04-25 22:49:21 +02:00
transliterate.en.yml FEATURE: Adds transliteration of German umlauts in slugs 2015-02-27 23:53:58 +01:00
transliterate.ru.yml FEATURE: Adds transliteration of German umlauts in slugs 2015-02-27 23:53:58 +01:00
transliterate.ug.yml FEATURE: Add Uyghur language (#27183) 2024-05-27 09:58:18 +02:00
transliterate.vi.yml FIX: i18n integrity specs 2017-02-24 11:35:33 +01:00