Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-07 13:19:19 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-calendar/spec
History
Exact
Bannon Tanner cc3e96ab31
 SECURITY: Private event invitee details leak through invitees list endpoint [backport 2026.1] (#42134) 
Backport of #42109 to release/2026.1.
- This one was a hand backport because the file structure is different

Summary
The invitee-list route for private events previously authorized only
host-post visibility, allowing an authenticated viewer to retrieve
attendee identities, RSVP states, and attendance totals that should be
hidden. The fix enforces the same private-event detail policy used by
EventSerializer before returning invitee data, returning a 403 error to
unauthorized viewers.
2026-07-29 11:09:19 -05:00
..
fabricators PERF: removes N+1 when loading events list (#34841) 2025-09-19 09:12:23 +02:00
integration FIX: correctly filter out event attendees (#36459) 2025-12-04 20:02:32 +01:00
jobs FIX: skip topic bump when date is in the past (#36784) 2025-12-18 21:29:06 +01:00
lib FIX: event not found after being edited to earlier date (#36481) 2025-12-08 17:41:46 +01:00
models SECURITY: Group timezone serialization leaks hidden group members [backport 2026.1] (#40876) 2026-06-15 12:51:43 +01:00
requests SECURITY: Private event invitee details leak through invitees list endpoint [backport 2026.1] (#42134) 2026-07-29 11:09:19 -05:00
serializers SECURITY: Group timezone serialization leaks hidden group members [backport 2026.1] (#40876) 2026-06-15 12:51:43 +01:00
services FIX: correctly filter out event attendees (#36459) 2025-12-04 20:02:32 +01:00
system DEV: Fix flaky category calendar color mapping tests (#37256) 2026-01-22 10:38:47 +08:00