Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 00:15:24 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-reactions
History
Exact
discourse-patch-triage[bot] 5e51c6ab90 SECURITY: GroupPostSerializer leaks hidden full names through reaction post association [backport 2026.1] 
Backport of #671 to release/2026.1.

---

GroupPostSerializer declared include_user_long_name? as the predicate
  for its :name attribute, but AMS looks for include_name?. The misnamed
  predicate was never called, so object.user.name was always serialized
  regardless of SiteSetting.enable_names.

https://github.com/discourse/discourse/security/advisories/GHSA-h3mq-9r6w-h33j
2026-05-19 00:26:55 +01:00
..
app FEATURE: Prevent silenced users from liking and using reactions (#37040) 2026-01-13 13:59:57 +01:00
assets FIX: reactions z-index fix (#37038) 2026-01-14 11:03:19 -06:00
config I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
db FEATURE: Promote discourse_reactions_allow_any_emoji out of experimental (#35589) 2025-10-24 16:51:18 +10:00
lib FEATURE: Prevent silenced users from liking and using reactions (#37040) 2026-01-13 13:59:57 +01:00
spec SECURITY: GroupPostSerializer leaks hidden full names through reaction post association [backport 2026.1] 2026-05-19 00:26:55 +01:00
test/javascripts FIX: discourse-reactions rollback not working (#36989) 2026-01-08 14:23:59 +10:00
package.json DEV: Overhaul typechecking configuration (#35794) 2025-11-12 12:54:34 +00:00
plugin.rb DEV: Add op_reactions_data to suggested topics (#36755) 2025-12-17 09:40:56 -06:00
README.md
tsconfig.json DEV: Overhaul typechecking configuration (#35794) 2025-11-12 12:54:34 +00:00

README.md

Discourse Reactions

Discourse-reactions is a plugin that allows user to add their reactions to the post.

For more information, please see: https://meta.discourse.org/t/discourse-reactions-beyond-likes/183261