Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-09 21:45:25 +08:00
Code Packages Activity Actions
discourse/plugins
History
Exact
Alan Guo Xiang Tan 36557423ad SECURITY: Validate policy permissions on post save 
The `create_policy_allowed_groups` setting controls who can create
policies, but it only gates the composer UI and the
`post_process_cooked` event handler. It does not prevent unauthorized
users from injecting `[policy]` markup directly into post raw — for
example, by editing a wiki post.

Add `DiscoursePolicy::PostValidator` as an ActiveRecord validation on
`Post`. When policies are added, removed, or modified, both the post
owner and the acting user must belong to `create_policy_allowed_groups`
or the save is rejected. Policies inside blockquotes are ignored.
2026-03-19 17:37:08 +00:00
..
automation I18N: Update translations (#38682) 2026-03-18 12:09:49 +01:00
chat I18N: Update translations (#38682) 2026-03-18 12:09:49 +01:00
checklist FEATURE: consolidate composer toolbar list and add check list (#37336) 2026-02-24 10:08:34 -03:00
discourse-adplugin I18N: Update translations (#38682) 2026-03-18 12:09:49 +01:00
discourse-affiliate I18N: Update translations (#37917) 2026-02-25 09:42:49 -05:00
discourse-ai SECURITY: Unscoped status lookups leak restricted metadata 2026-03-19 17:37:08 +00:00
discourse-apple-auth I18N: Update translations (#38144) 2026-03-03 11:57:12 +01:00
discourse-assign I18N: Update translations (#38682) 2026-03-18 12:09:49 +01:00
discourse-cakeday I18N: Update translations (#38528) 2026-03-12 09:41:44 +01:00
discourse-calendar I18N: Update translations (#38682) 2026-03-18 12:09:49 +01:00
discourse-chat-integration I18N: Update translations (#38710) 2026-03-19 10:06:37 +01:00
discourse-data-explorer I18N: Update translations (#38682) 2026-03-18 12:09:49 +01:00
discourse-details I18N: Update translations (#37917) 2026-02-25 09:42:49 -05:00
discourse-gamification I18N: Update translations (#37917) 2026-02-25 09:42:49 -05:00
discourse-github I18N: Update translations (#38682) 2026-03-18 12:09:49 +01:00
discourse-graphviz SECURITY: Sanitize graphviz SVG anchor links to prevent XSS 2026-03-19 17:37:08 +00:00
discourse-hcaptcha I18N: Update translations (#37917) 2026-02-25 09:42:49 -05:00
discourse-lazy-videos FIX: Remove unnecessary z-index from lazy video containers (#37467) 2026-02-03 13:07:51 +03:00
discourse-local-dates I18N: Update translations (#38682) 2026-03-18 12:09:49 +01:00
discourse-login-with-amazon I18N: Update translations (#38271) 2026-03-10 09:52:18 +01:00
discourse-lti I18N: Update translations (#38271) 2026-03-10 09:52:18 +01:00
discourse-math I18N: Update translations (#38682) 2026-03-18 12:09:49 +01:00
discourse-microsoft-auth I18N: Update translations (#38271) 2026-03-10 09:52:18 +01:00
discourse-narrative-bot I18N: Update translations (#38271) 2026-03-10 09:52:18 +01:00
discourse-oauth2-basic I18N: Update translations (#38271) 2026-03-10 09:52:18 +01:00
discourse-openid-connect I18N: Update translations (#38271) 2026-03-10 09:52:18 +01:00
discourse-patreon I18N: Update translations (#38271) 2026-03-10 09:52:18 +01:00
discourse-policy SECURITY: Validate policy permissions on post save 2026-03-19 17:37:08 +00:00
discourse-post-voting I18N: Update translations (#38682) 2026-03-18 12:09:49 +01:00
discourse-presence I18N: Update translations (#38271) 2026-03-10 09:52:18 +01:00
discourse-reactions I18N: Update translations (#38486) 2026-03-11 09:20:33 +01:00
discourse-rewind I18N: Update translations (#38682) 2026-03-18 12:09:49 +01:00
discourse-rss-polling I18N: Update translations (#37917) 2026-02-25 09:42:49 -05:00
discourse-solved SECURITY: escape solved topic title in stream 2026-03-19 17:37:08 +00:00
discourse-subscriptions I18N: Update translations (#38682) 2026-03-18 12:09:49 +01:00
discourse-templates I18N: Update translations (#38271) 2026-03-10 09:52:18 +01:00
discourse-topic-voting I18N: Update translations (#38682) 2026-03-18 12:09:49 +01:00
discourse-user-notes SECURITY: Unauthorized Post Data Exposure in discourse-user-notes Plugin 2026-03-19 17:37:08 +00:00
discourse-zendesk-plugin SECURITY: Block ticket creation when user can't see the topic 2026-03-19 17:37:08 +00:00
footnote I18N: Update translations (#38682) 2026-03-18 12:09:49 +01:00
poll SECURITY: Fix poll post_id array authorization bypass 2026-03-19 17:37:08 +00:00
spoiler-alert I18N: Update translations (#37917) 2026-02-25 09:42:49 -05:00
styleguide I18N: Update translations (#38271) 2026-03-10 09:52:18 +01:00