Exact

Exact Union RegExp

Nat 1d5a509654 SECURITY: Prevent 'Explain' feature from exposing hidden posts [backport 2026.1] ... Backport of #642 to release/2026.1. --- The AI 'Explain' feature builds a prompt that includes the reply-to post's raw content, but only checks `can_see?` on the post being explained, not the parent. If post B replies to a hidden post A, a user who triggers explain on post B gets post A's content fed into the prompt (potentially surfaced in the AI response). This is a problem if the hidden post contains sensitive content like credentials that were hidden by a mod but not yet redacted. This PR ensures we check replies are also `can_see?` and escapes interpolated values with `ERB::Util.html_escape` to prevent post content from breaking out of the prompt's XML tag structure (e.g. raw containing `</context><replyTo>injected</replyTo>`) <img width="600" alt="Screenshot 2026-04-29 at 6 32 12 PM" src="https://github.com/user-attachments/assets/e1cd535b-bd0f-4411-ab34-582d66fbf518" /> https://github.com/discourse/discourse/security/advisories/GHSA-7h76-fwxc-j586		2026-05-19 00:26:55 +01:00
..
controllers	SECURITY: restrict visibility of ai bot conversations [backport 2026.1]	2026-05-19 00:26:55 +01:00
helpers/discourse_ai/ai_bot
jobs	SECURITY: Prevent 'Explain' feature from exposing hidden posts [backport 2026.1]	2026-05-19 00:26:55 +01:00
mailers
models	SECURITY: Stored XSS via Shared AI Conversation Onebox	2026-03-19 15:46:24 +00:00
serializers	DEV: migrate enabled_chat_bot column to a setting (#36707)	2025-12-17 09:26:19 -08:00
services	SECURITY: Force regeneration for edit-outdated summaries and block stale fallback [backport 2026.1]	2026-03-31 15:12:50 +01:00
views