Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-08 17:53:55 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-policy
History
Exact
Alan Guo Xiang Tan e8669040d1 SECURITY: Validate policy permissions on post save 
The `create_policy_allowed_groups` setting controls who can create
policies, but it only gates the composer UI and the
`post_process_cooked` event handler. It does not prevent unauthorized
users from injecting `[policy]` markup directly into post raw — for
example, by editing a wiki post.

Add `DiscoursePolicy::PostValidator` as an ActiveRecord validation on
`Post`. When policies are added, removed, or modified, both the post
owner and the acting user must belong to `create_policy_allowed_groups`
or the save is rejected. Policies inside blockquotes are ignored.
2026-03-19 15:46:24 +00:00
..
app SECURITY: Add authorization to policy add-users-to-group 2026-03-19 15:46:24 +00:00
assets FEATURE: rich editor extension for the policy plugin (#36631) 2026-01-12 02:17:21 -03:00
config SECURITY: Validate policy permissions on post save 2026-03-19 15:46:24 +00:00
db/migrate DEV: Convert policy_restrict_to_staff_posts to group based access (#36157) 2025-12-02 09:50:18 +08:00
jobs/scheduled FIX: allows check_policy to find mailer class (#35464) 2025-10-17 11:19:33 +02:00
lib SECURITY: Validate policy permissions on post save 2026-03-19 15:46:24 +00:00
spec SECURITY: Validate policy permissions on post save 2026-03-19 15:46:24 +00:00
test/javascripts FEATURE: rich editor extension for the policy plugin (#36631) 2026-01-12 02:17:21 -03:00
package.json DEV: Overhaul typechecking configuration (#35794) 2025-11-12 12:54:34 +00:00
plugin.rb SECURITY: Validate policy permissions on post save 2026-03-19 15:46:24 +00:00
README.md
tsconfig.json DEV: Overhaul typechecking configuration (#35794) 2025-11-12 12:54:34 +00:00

README.md

Discourse Policy Plugin

Confirm your users have seen or done something with reminders

For more information, please see: https://meta.discourse.org/t/discourse-policy/88557