Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 01:10:43 +08:00
Code Packages Activity Actions
discourse/plugins/chat
History
Exact
discoursebot 5a165bc31f
 SECURITY: Channel member list exposes other users' chat read state and notification settings [backport 2026.1] (#40888) 
Backport of #40884 to release/2026.1.

---

## Summary

This patch updates the channel member list endpoint (GET
/chat/api/channels/:channel_id/memberships) to return only public user
details instead of exposing other users’ private membership state. It
fixes an information disclosure issue where fields like read state,
notification settings, mute/follow status, and starred state could be
returned for other channel members, with test coverage added to confirm
only the user payload is exposed.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1288

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

---------

Co-authored-by: Isaac Janzen <50783505+janzenisaac@users.noreply.github.com>
Co-authored-by: discourse-patch-triage[bot] <272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-06-15 11:13:20 -05:00
..
admin/assets/javascripts UX: add admin sidebar icons for preinstalled plugins (#36764) 2025-12-18 16:39:00 -05:00
app SECURITY: Channel member list exposes other users' chat read state and notification settings [backport 2026.1] (#40888) 2026-06-15 11:13:20 -05:00
assets FIX: dynamic highlighting of self mentions (#37321) 2026-01-28 14:59:48 +04:00
config I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
db DEV: remove chat channel icon upload id (#36693) 2025-12-16 16:00:56 +04:00
lib DEV: Fix a chat archive edge-case [backport 2026.1] (#40704) 2026-06-09 18:27:20 +01:00
public
spec SECURITY: Channel member list exposes other users' chat read state and notification settings [backport 2026.1] (#40888) 2026-06-15 11:13:20 -05:00
test/javascripts UX: Prioritize chat search results by relevance (#36959) 2026-01-06 08:57:08 +01:00
about.json DEV: Only load specific plugin bundles during qunit test (#33678) 2025-07-21 21:00:48 +01:00
package.json DEV: Overhaul typechecking configuration (#35794) 2025-11-12 12:54:34 +00:00
plugin.rb DEV: Remove obsolete feature checks (#36175) 2025-11-23 20:57:46 +01:00
README.md
tsconfig.json DEV: Overhaul typechecking configuration (#35794) 2025-11-12 12:54:34 +00:00

README.md

This plugin is still in active development and may change frequently

Documentation

The Discourse Chat plugin adds chat functionality to your Discourse so it can natively support both long-form and short-form communication needs of your online community.

For user documentation, see Discourse Chat.

For developer documentation, see Discourse Documentation.