mirror of
https://github.com/discourse/discourse.git
synced 2026-08-12 05:37:26 +08:00
9a8b16f76aAny user with assign permission could unassign/assign topics/posts they
cannot see (private categories, PMs they're not part of). This is
treated as a bug and not security due to the high status assigners
already have and the limited impact the action has. You would get a 200
and `{ success: true }` response which doesn't leak any important
information. So in practice it could only allow a high trusted user to
be disruptive.
|
||
|---|---|---|
| .. | ||
| controllers/discourse_assign | ||
| jobs | ||
| mailers | ||
| models | ||
| serializers | ||
