Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-11 02:59:07 +08:00
Code Packages Activity Actions
discourse/spec
History
Exact
Joffrey JAFFEUX abf8da5dc7 SECURITY: Enforce moderators_view_ips on screened IP CSV export 
The `can_export_entity?` guardian method allowed moderators to export
screened IP addresses via CSV regardless of the `moderators_view_ips`
site setting. While the admin UI correctly enforced this restriction,
the export endpoint did not, allowing moderators to bypass it.

This adds a `can_see_ip?` check for the `screened_ip` entity,
mirroring the existing `can_see_emails?` check for `screened_email`.
2026-03-19 17:37:08 +00:00
..
db/migrate DEV: Add slugs to tag model (#36985) 2026-01-08 11:03:01 +08:00
fabricators SECURITY: Add guardian check on PM to topic conversion 2026-01-28 17:11:14 +00:00
fixtures DEV: Add Block API for declarative, validated UI extension points (#36810) 2026-02-25 17:36:43 -03:00
generator DEV: Remove deprecated trust level access settings (#36414) 2025-12-11 11:09:29 +10:00
helpers FIX: add og:image:type to OpenGraph tags (#37854) 2026-02-17 16:05:00 +01:00
import_export DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
initializers FEATURE: Notify admins of upcoming changes and log events (#37003) 2026-01-21 12:45:54 +10:00
integration FIX: do not use public IP address space for tests 2025-12-16 09:35:01 -05:00
integrity DEV: Replace Ruby numbered parameters by it where applicable (#37810) 2026-02-13 13:59:07 +01:00
jobs FIX: Allow "watching first post" notification to fire when tags edit notifications are disabled (#37935) 2026-02-20 16:59:53 +08:00
lib SECURITY: Enforce moderators_view_ips on screened IP CSV export 2026-03-19 17:37:08 +00:00
mailers FIX: Use post author username as fallback in notification emails (#37659) 2026-02-10 14:42:23 +01:00
models SECURITY: fix loose hostname matching in spam host allowlist 2026-03-19 17:37:08 +00:00
multisite FEATURE: Notify admins of upcoming changes and log events (#37003) 2026-01-21 12:45:54 +10:00
queries/reports UX: Admin dashboard & reports improvements (#37598) 2026-02-24 09:20:38 +08:00
requests SECURITY: Private message invite can see topic 2026-03-19 17:37:08 +00:00
script/import_scripts
serializers SECURITY: Hide IP from flagged regular users 2026-03-19 17:37:08 +00:00
services SECURITY: Enforce edit permissions and audit trail in TriggerPostAction 2026-03-19 17:37:08 +00:00
support DEV: Add support for d-compat branches in plugins/themes (#37984) 2026-02-24 17:44:27 +01:00
system SECURITY: XSS in review queue via highlightWatchedWords 2026-03-19 17:37:08 +00:00
tasks DEV: Bump latest branch version on security fixes (#37774) 2026-02-26 11:10:55 +01:00
views FIX: remove ItemList schema from linkbacks in crawler view (#36608) 2025-12-11 10:41:47 +01:00
rails_helper.rb DEV: Clean up ThemeSettingsMigration records in test suite setup (#37376) 2026-01-30 00:24:13 +01:00
regenerate_swagger_docs
swagger_helper.rb DEV: add api docs for discourse-calendar events index endpoint (#35400) 2025-10-16 07:39:08 +08:00