0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 04:02:30 +08:00
discourse/app
discoursebot 0a1e6c5598
SECURITY: Prevent topic existence disclosure in profile featuring [backport 2026.1] (#42238)
Backport of #42235 to release/2026.1.

---

Previously, the profile feature-topic endpoint returned different
responses for missing topics and existing topics the requester could not
access, revealing whether a topic record existed.

This change checks topic visibility before feature eligibility,
returning a not-found response for both missing and inaccessible topics.

Relates to this patch: https://patch.discourse.org/patch-triage/1350

Co-authored-by: Gabriel Grubba <gabriel@discourse.org>
2026-07-31 16:19:21 -03:00
..
assets UX: Improve post stream scrolling stability and layout control [backport 2026.1] (#38318) 2026-03-06 10:06:47 -06:00
controllers SECURITY: Prevent topic existence disclosure in profile featuring [backport 2026.1] (#42238) 2026-07-31 16:19:21 -03:00
helpers SECURITY: Prevent cache poisoning/XSS via color scheme cookies [backport 2026.1] 2026-07-28 17:00:54 +02:00
jobs SECURITY: Authorize secure-upload hotlink downloads against post user [backport 2026.1] 2026-06-30 16:27:06 +02:00
mailers UX: improve sender name in emails (#36974) 2026-01-06 15:41:01 +04:00
models FIX: Skip dominant color calculation when the upload file is missing [backport 2026.1] (#42168) 2026-07-30 17:54:11 +02:00
queries/reports FEATURE: Add admin-only reports and centralize report visibility logic 2026-01-28 17:11:14 +00:00
serializers SECURITY: Stop exposing hidden tag names through category serializers [backport 2026.1] 2026-07-28 17:00:54 +02:00
services SECURITY: Stale featured rows expose unlisted topic content [backport 2026.1] (#41813) 2026-07-17 09:40:52 -05:00
views FIX: Strip HTML from category og:description meta tag (#37322) 2026-01-27 18:16:35 +11:00