mirror of
https://github.com/discourse/discourse.git
synced 2026-08-12 03:37:13 +08:00
5a165bc31fBackport of #40884 to release/2026.1. --- ## Summary This patch updates the channel member list endpoint (GET /chat/api/channels/:channel_id/memberships) to return only public user details instead of exposing other users’ private membership state. It fixes an information disclosure issue where fields like read state, notification settings, mute/follow status, and starred state could be returned for other channel members, with test coverage added to confirm only the user payload is exposed. ## Source - Patch Triage: https://patch.discourse.org/patch-triage/1288 Co-authored-by: discourse-patch-triage <272280883+discourse-patch-triage[bot]@users.noreply.github.com> --------- Co-authored-by: Isaac Janzen <50783505+janzenisaac@users.noreply.github.com> Co-authored-by: discourse-patch-triage[bot] <272280883+discourse-patch-triage[bot]@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| components/chat | ||
| fabricators | ||
| integration | ||
| jobs | ||
| lib | ||
| mailers | ||
| models | ||
| queries/chat | ||
| requests | ||
| serializer | ||
| services | ||
| support | ||
| system | ||
| validators | ||
| plugin_helper.rb | ||
| plugin_spec.rb | ||
