| .. |
|
admin
|
SECURITY: block cross-site backup traversal in multisite local storage [backport 2026.1]
|
2026-05-19 00:26:55 +01:00 |
|
api
|
SECURITY: Stop exposing hidden tag names through category serializers [backport 2026.1]
|
2026-07-28 17:00:54 +02:00 |
|
examples
|
|
|
|
about_controller_spec.rb
|
FIX: crawler view with unicode usernames (#27051)
|
2024-05-16 17:11:24 +02:00 |
|
application_controller_spec.rb
|
SECURITY: Prevent cache poisoning/XSS via color scheme cookies [backport 2026.1]
|
2026-07-28 17:00:54 +02:00 |
|
associate_accounts_controller_spec.rb
|
DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577)
|
2025-07-11 11:16:34 -03:00 |
|
badges_controller_spec.rb
|
DEV: Allow fab! without block (#24314)
|
2023-11-09 16:47:59 -06:00 |
|
bookmarks_controller_spec.rb
|
DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073)
|
2025-10-06 16:11:01 +02:00 |
|
categories_controller_spec.rb
|
SECURITY: Stop exposing hidden tag names through category serializers [backport 2026.1]
|
2026-07-28 17:00:54 +02:00 |
|
clicks_controller_spec.rb
|
SECURITY: Missing visibility check in click tracking endpoint [backport 2026.1] (#41148)
|
2026-06-24 15:47:50 +10:00 |
|
composer_controller_spec.rb
|
SECURITY: Respect group member visibility for counts [backport 2026.1] (#41420)
|
2026-07-06 12:47:49 +08:00 |
|
composer_messages_controller_spec.rb
|
SECURITY: Duplicate lookup reveals restricted topic titles through canonicalized URLs [backport 2026.1]
|
2026-07-28 17:00:54 +02:00 |
|
crawler_hreflang_spec.rb
|
FEATURE: Append locale to links in crawler view if present (#34466)
|
2025-08-22 08:46:33 +08:00 |
|
csp_reports_controller_spec.rb
|
DEV: Don’t replace Rails logger in specs (#29721)
|
2024-11-13 08:47:39 +08:00 |
|
default_headers_spec.rb
|
DEV: Disallow the use of Rails.logger= in RSpec tests (#31920)
|
2025-03-21 08:48:38 +08:00 |
|
dev_mode_controller_spec.rb
|
DEV: Add /dev-mode endpoint for MiniProfiler auth cookie (#37027)
|
2026-01-12 10:01:20 +08:00 |
|
directory_columns_controller_spec.rb
|
DEV: Allow fab! without block (#24314)
|
2023-11-09 16:47:59 -06:00 |
|
directory_items_controller_spec.rb
|
SECURITY: Private UserField value disclosure via directory_items order sort side-channel [backport 2026.1] (#41601)
|
2026-07-09 21:53:32 -05:00 |
|
discourse_id_controller_spec.rb
|
DEV: Add validator for enable_discourse_id setting (#33710)
|
2025-07-21 08:18:36 -04:00 |
|
do_not_disturb_controller_spec.rb
|
DEV: Allow fab! without block (#24314)
|
2023-11-09 16:47:59 -06:00 |
|
drafts_controller_spec.rb
|
DEV: Better protection for drafts
|
2026-01-28 17:11:14 +00:00 |
|
edit_directory_columns_controller_spec.rb
|
DEV: Allow fab! without block (#24314)
|
2023-11-09 16:47:59 -06:00 |
|
email_controller_spec.rb
|
DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577)
|
2025-07-11 11:16:34 -03:00 |
|
embed_controller_spec.rb
|
SECURITY: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing [backport 2026.1]
|
2026-07-31 22:01:42 +01:00 |
|
emojis_controller_spec.rb
|
DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577)
|
2025-07-11 11:16:34 -03:00 |
|
exceptions_controller_spec.rb
|
FIX: Respect forced color mode for logo on server-rendered pages (#37032)
|
2026-01-09 11:33:06 +01:00 |
|
export_csv_controller_spec.rb
|
SECURITY: Prevent moderators from exporting admin-only reports via CSV [backport 2026.1]
|
2026-03-31 15:12:50 +01:00 |
|
extra_locales_controller_spec.rb
|
DEV: Refactor locale bundle loading (#37114)
|
2026-01-16 11:45:14 +00:00 |
|
finish_installation_controller_spec.rb
|
DEV: Allow new instances to be set up directly with Discourse ID (#36731)
|
2025-12-23 12:13:36 -05:00 |
|
form_templates_controller_spec.rb
|
SECURITY: Scope form template endpoints to accessible categories [backport 2026.1]
|
2026-05-19 00:26:55 +01:00 |
|
forums_controller_spec.rb
|
FIX: improve "read only" modes (#33521)
|
2025-07-10 09:08:00 +02:00 |
|
groups_controller_spec.rb
|
SECURITY: Shared-draft titles and excerpts leak through group post serialization [backport 2026.1]
|
2026-07-28 17:00:54 +02:00 |
|
hashtags_controller_spec.rb
|
DEV: add tag hashtag data source style type (#33289)
|
2025-06-20 18:08:47 +04:00 |
|
highlightjs_controller_spec.rb
|
DEV: Simplify CORS logic for public asset routes (#33106)
|
2025-06-09 08:58:27 +01:00 |
|
home_page_controller_spec.rb
|
DEV: Add site description to crawler homepage view (#32845)
|
2025-05-22 08:33:59 +10:00 |
|
inline_onebox_controller_spec.rb
|
SECURITY: Check topic visibility in Oneboxer even when categories match [backport 2026.1]
|
2026-03-31 15:12:50 +01:00 |
|
invites_controller_spec.rb
|
SECURITY: Gate staged user fields on email verification [backport 2026.1]
|
2026-03-31 15:12:50 +01:00 |
|
list_controller_spec.rb
|
SECURITY: Harden ListController top period query against SQL injection [backport 2026.1] (#41723)
|
2026-07-15 12:18:25 +08:00 |
|
metadata_controller_spec.rb
|
SECURITY: Error responses missing Cache-Control header
|
2025-10-28 14:40:41 +08:00 |
|
net_http_header_spec.rb
|
DEV: Add a user agent to all HTTP requests that Discourse makes. (#31555)
|
2025-03-03 16:32:25 +11:00 |
|
net_http_timeout_spec.rb
|
FIX: Set sane default for Net::HTTP when processing a request (#28141)
|
2024-08-06 07:12:42 +08:00 |
|
noscript_escape_spec.rb
|
SECURITY: Properly escape user content within <noscript>
|
2024-01-30 09:10:09 -07:00 |
|
notifications_controller_spec.rb
|
FIX: Hide badge notifications for disabled badges or when badges are disabled (#36987)
|
2026-01-07 15:28:43 +08:00 |
|
offline_controller_spec.rb
|
|
|
|
omniauth_callbacks_controller_spec.rb
|
FIX: Leave username blank during OAuth signup when no valid suggestion exists (#36830)
|
2026-01-08 11:02:35 +01:00 |
|
onebox_controller_spec.rb
|
SECURITY: prevent hidden profile data leak via user onebox
|
2026-03-19 15:46:24 +00:00 |
|
permalinks_controller_spec.rb
|
SECURITY: prevent permalink redirects from leaking restricted slugs
|
2026-01-28 17:11:14 +00:00 |
|
post_action_users_controller_spec.rb
|
SECURITY: hide total_rows for restricted post action types
|
2026-03-19 15:46:24 +00:00 |
|
post_actions_controller_spec.rb
|
SECURITY: fix is_warning type coercion bypass in PostActionsController
|
2026-03-19 15:46:24 +00:00 |
|
post_localizations_controller_spec.rb
|
FEATURE: Allow post authors to localize their own posts (#36178)
|
2025-11-25 11:02:22 +08:00 |
|
post_readers_controller_spec.rb
|
SECURITY: Missing post-level authorization allows whisper metadata disclosure [backport 2026.1]
|
2026-03-31 15:12:50 +01:00 |
|
posts_controller_spec.rb
|
SECURITY: validate oEmbed provider_name against URL host in generic Onebox [backport 2026.1] (#42230)
|
2026-07-31 13:27:25 -05:00 |
|
presence_controller_spec.rb
|
DEV: Call Discourse.redis.flushdb after the end of each test (#29117)
|
2024-10-09 07:19:31 +08:00 |
|
published_pages_controller_spec.rb
|
SECURITY: Leakage of hidden tags to unauthorized users [backport 2026.1] (#42227)
|
2026-07-31 12:39:50 -05:00 |
|
push_notification_controller_spec.rb
|
DEV: Allow fab! without block (#24314)
|
2023-11-09 16:47:59 -06:00 |
|
qunit_controller_spec.rb
|
DEV: Rename theme-transpiler to asset-processor (#35498)
|
2025-10-20 14:16:46 +01:00 |
|
reviewable_claimed_topics_controller_spec.rb
|
DEV: Update spec expectations
|
2026-05-19 00:26:55 +01:00 |
|
reviewable_notes_controller_spec.rb
|
SECURITY: scope reviewable notes to user-visible reviewables
|
2026-02-26 12:24:37 +00:00 |
|
reviewables_controller_spec.rb
|
SECURITY: Respect topic visibility in reviewable score serializer [backport 2026.1]
|
2026-07-28 17:00:54 +02:00 |
|
robots_txt_controller_spec.rb
|
|
|
|
safe_mode_controller_spec.rb
|
DEV: Compile 'common' CSS into own assets (#31416)
|
2025-05-01 10:44:49 +01:00 |
|
search_controller_spec.rb
|
SECURITY: Apply category tag visibility to full-text search [backport 2026.1] (#41673)
|
2026-07-13 15:16:49 -03:00 |
|
session_controller_spec.rb
|
DEV: Finish renaming secure_session to server_session
|
2025-09-23 10:35:02 +02:00 |
|
sidebar_sections_controller_spec.rb
|
FIX: on edit, ensure community section remains at top of sidebar (#36597)
|
2025-12-10 12:26:35 -05:00 |
|
similar_topics_controller_spec.rb
|
DEV: Remove full group refreshes from tests (#25414)
|
2024-01-25 14:28:26 +08:00 |
|
site_controller_spec.rb
|
SECURITY: Anonymous sidebar serialization exposes descriptions of category-restricted tags [backport 2026.1]
|
2026-07-28 17:00:54 +02:00 |
|
sitemap_controller_spec.rb
|
DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073)
|
2025-10-06 16:11:01 +02:00 |
|
slugs_controller_spec.rb
|
DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577)
|
2025-07-11 11:16:34 -03:00 |
|
static_controller_spec.rb
|
SECURITY: Validate sso_destination_url cookie to prevent open redirect [backport 2026.1]
|
2026-03-31 15:12:50 +01:00 |
|
steps_controller_spec.rb
|
UX: One step wizard (#36082)
|
2025-11-25 13:35:32 -05:00 |
|
stylesheets_controller_spec.rb
|
DEV: Fix test incorrectly removing stylesheet cache of other processes (#25103)
|
2024-01-03 13:15:35 +08:00 |
|
svg_sprite_controller_spec.rb
|
DEV: enable raise_error in test envs for deprecated icons in svg_sprite.rb (#30980)
|
2025-02-04 21:21:20 +08:00 |
|
tag_groups_controller_spec.rb
|
DEV: Add tests for parent_tag_name param in TagGroupsController (#37076)
|
2026-01-13 14:46:47 +08:00 |
|
tag_localizations_controller_spec.rb
|
FEATURE: Introduce tag localizations with API, without UI yet (#36754)
|
2025-12-18 18:25:58 +08:00 |
|
tags_controller_spec.rb
|
SECURITY: Don't leak restricted tag group names via tag info [backport 2026.1]
|
2026-05-19 00:26:55 +01:00 |
|
theme_javascripts_controller_spec.rb
|
DEV: Use rollup for theme JS compilation (#33103)
|
2025-07-25 12:02:29 +01:00 |
|
topic_localizations_controller_spec.rb
|
UX: Use inline title editor instead of composer when editing translation (#36847)
|
2025-12-24 00:56:36 +08:00 |
|
topic_view_stats_controller_spec.rb
|
FEATURE: topic_view_stats table with daily fidelity (#27197)
|
2024-05-27 15:25:32 +10:00 |
|
topics_controller_spec.rb
|
SECURITY: DoS vis uncapped Bulk Topic Actions [backport 2026.1] (#42004)
|
2026-07-23 23:07:07 +01:00 |
|
uploads_controller_multisite_spec.rb
|
DEV: Upgrade Rails to version 7.1
|
2024-07-04 10:58:21 +02:00 |
|
uploads_controller_spec.rb
|
SECURITY: Regular users can route multipart uploads into the admin backup store [backport 2026.1]
|
2026-06-30 16:27:06 +02:00 |
|
user_actions_controller_spec.rb
|
SECURITY: Enforce Guardian checks in UserActionsController#show
|
2026-03-19 15:46:24 +00:00 |
|
user_api_key_clients_controller_spec.rb
|
Add user api key client rate limit settings (#30402)
|
2024-12-30 11:10:48 -05:00 |
|
user_api_keys_controller_spec.rb
|
SECURITY: Validate auth_redirect in UserApiKeysController#new to prevent open redirect phishing
|
2026-03-19 15:46:24 +00:00 |
|
user_avatars_controller_spec.rb
|
SECURITY: Improve SVG sanitization [backport 2026.1]
|
2026-06-30 16:27:06 +02:00 |
|
user_badges_controller_spec.rb
|
SECURITY: Prevent badge lookup from exposing hidden profiles [backport 2026.1] (#41163)
|
2026-06-25 14:11:30 +08:00 |
|
user_status_controller_spec.rb
|
FEATURE: Prevent silenced users from liking and using reactions (#37040)
|
2026-01-13 13:59:57 +01:00 |
|
users_controller_spec.rb
|
SECURITY: Prevent topic existence disclosure in profile featuring [backport 2026.1] (#42238)
|
2026-07-31 16:19:21 -03:00 |
|
users_email_controller_spec.rb
|
DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577)
|
2025-07-11 11:16:34 -03:00 |
|
webhooks_controller_spec.rb
|
SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks [backport 2026.1]
|
2026-06-30 16:27:06 +02:00 |
|
wizard_controller_spec.rb
|
DEV: Fix various spec linting issues (#24672)
|
2023-12-04 13:45:19 +01:00 |
