Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-11 02:59:07 +08:00
Code Packages Activity Actions
discourse/app/controllers
History
Exact
Penar Musaraj 473288219e SECURITY: Do not leak PM post edits to moderators 
The Post Edits admin report (/admin/reports/post_edits) leaked the first
40 characters of raw post content from private messages and secure
categories to moderators who shouldn't have access.
2026-03-19 15:21:28 +00:00
..
admin SECURITY: Do not leak PM post edits to moderators 2026-03-19 15:21:28 +00:00
users DEV: Fix invite-only OAuth signup bypass via non-invite origin routes (#38646) 2026-03-17 09:19:09 -05:00
about_controller.rb DEV: Revert guardian changes (#24742) 2023-12-06 16:37:32 +10:00
application_controller.rb FIX: Validate auth_redirect against registered client in delegated auth (#38400) 2026-03-10 13:36:16 +08:00
associated_groups_controller.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
badges_controller.rb FIX: Non-listable and disabled badges exposed via XHR JSON requests (#37869) 2026-02-17 16:17:01 +11:00
bookmarks_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
bootstrap_controller.rb DEV: Refactor plugin JS handling (#37763) 2026-02-19 12:24:04 +00:00
calendar_subscriptions_controller.rb FEATURE: Add calendar subscription URLs to user preferences (#38598) 2026-03-17 10:28:20 -03:00
categories_controller.rb FEATURE: Gate Support category type creation behind upcoming change (#38571) 2026-03-17 09:54:00 +10:00
clicks_controller.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
composer_controller.rb SECURITY: Hidden group membership can be inferred via allowed_names and user_reasons 2026-03-19 15:21:28 +00:00
composer_messages_controller.rb DEV: Move distance_of_time_in_words/time_ago_in_words (#21745) 2023-05-25 14:53:59 +02:00
dev_mode_controller.rb DEV: Add /dev-mode endpoint for MiniProfiler auth cookie (#37027) 2026-01-12 10:01:20 +08:00
directory_columns_controller.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
directory_items_controller.rb SECURITY: exclude_groups enables private group membership inference without authorization 2026-03-19 15:21:28 +00:00
do_not_disturb_controller.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
drafts_controller.rb DEV: Expand top_tags, topic.tags, etc, to return an array of tag objects instead of tag names (#36678) 2026-02-02 10:03:02 +08:00
edit_directory_columns_controller.rb DEV: Implement staff logs for user columns edits (#21774) 2023-06-07 17:19:58 -05:00
email_controller.rb FEATURE: implement RFC 8058 for email unsubscribe (#33392) 2025-07-01 11:01:13 +10:00
embed_controller.rb DEV: Gate Reply-count endpoint for non-public embedded topics (#38498) 2026-03-11 07:39:00 -07:00
emojis_controller.rb DEV: discourse-emojis gem (#31408) 2025-03-03 13:09:08 +01:00
exceptions_controller.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
export_csv_controller.rb FIX: Missing requires_login — authentication relies solely on guardian call (#37716) 2026-02-11 12:25:58 +01:00
extra_locales_controller.rb DEV: Refactor locale bundle loading (#37114) 2026-01-16 11:45:14 +00:00
finish_installation_controller.rb FIX: Redirect to wizard when setting up new instance using Discourse ID (#36993) 2026-01-07 10:19:17 -05:00
form_templates_controller.rb DEV: Rename experimental_ upcoming change settings (#37589) 2026-02-10 10:34:37 +10:00
forums_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
groups_controller.rb SECURITY: Staff can modify any user's group notification level 2026-03-19 15:21:28 +00:00
hashtags_controller.rb FEATURE: Async load of category and chat hashtags (#25526) 2024-02-12 12:07:14 +02:00
highlight_js_controller.rb FEATURE: User fields required for existing users - Part 2 (#27172) 2024-06-25 19:32:18 +08:00
home_page_controller.rb DEV: Show login-required splash in root route (take 2) (#32629) 2025-05-14 11:25:43 -04:00
inline_onebox_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
invites_controller.rb SECURITY: Private message invite can see topic 2026-03-19 15:21:28 +00:00
list_controller.rb SECURITY: remove list_target_user from ListController 2026-03-19 15:21:28 +00:00
metadata_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
new_invite_controller.rb FEATURE: Add invite link to the sidebar (#29448) 2024-10-30 05:31:14 +03:00
new_topic_controller.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
notifications_controller.rb FIX: Hide badge notifications for disabled badges or when badges are disabled (#36987) 2026-01-07 15:28:43 +08:00
offline_controller.rb FEATURE: User fields required for existing users - Part 2 (#27172) 2024-06-25 19:32:18 +08:00
onebox_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
pageview_controller.rb FEATURE: User fields required for existing users - Part 2 (#27172) 2024-06-25 19:32:18 +08:00
permalinks_controller.rb SECURITY: prevent permalink redirects from leaking restricted slugs 2026-01-28 17:11:14 +00:00
post_action_users_controller.rb SECURITY: hide total_rows for restricted post action types 2026-03-19 15:21:28 +00:00
post_actions_controller.rb SECURITY: fix is_warning type coercion bypass in PostActionsController 2026-03-19 15:21:28 +00:00
post_localizations_controller.rb FIX: Also check if user can see post or topic prior to letting them localize it (#36749) 2025-12-18 02:12:58 +08:00
post_readers_controller.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
posts_controller.rb SECURITY: check revision visibility on posts endpoint 2026-03-19 15:21:28 +00:00
presence_controller.rb FIX: improve "read only" modes (#33521) 2025-07-10 09:08:00 +02:00
published_pages_controller.rb FIX: ensures only staff can check slugs (#37846) 2026-02-16 18:23:46 +01:00
push_notification_controller.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
qunit_controller.rb DEV: Refactor plugin JS handling (#37763) 2026-02-19 12:24:04 +00:00
reviewable_claimed_topics_controller.rb DEV: Convert ReviewableClaimedTopicsController#destroy response from 403 to 404 (#38339) 2026-03-06 15:39:51 -06:00
reviewable_notes_controller.rb SECURITY: scope reviewable notes to user-visible reviewables 2026-02-26 12:22:54 +00:00
reviewables_controller.rb SECURITY: XSS in review queue via highlightWatchedWords 2026-03-19 15:21:28 +00:00
robots_txt_controller.rb DEV: Update link to comment in robots.txt as 'allow' is allowed (#33227) 2025-06-18 13:30:26 +08:00
safe_mode_controller.rb FIX: Set X-Robots-Tag header to prevent indexing of /safe-mode (#32329) 2025-04-16 16:51:32 +10:00
search_controller.rb FIX: exclude 't' shortcut from min length bypass (#37440) 2026-02-05 06:58:19 +11:00
session_controller.rb FIX: Passkey login not outputting error messages with suspended user and screened IP checks (#37827) 2026-02-16 09:28:03 -05:00
sidebar_sections_controller.rb FIX: raise 404 when sidebar section doesn't exist (#37675) 2026-02-10 15:47:49 +01:00
similar_topics_controller.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
site_controller.rb SECURITY: Preload data only when rendering application layout 2025-02-04 13:32:30 -03:00
sitemap_controller.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
slugs_controller.rb FEATURE: Allow changing slug on create channel (#19928) 2023-01-23 14:48:33 +10:00
static_controller.rb DEV: Add verification for CDN fallback assets to prevent directory traversal (#38297) 2026-03-05 16:58:50 -03:00
steps_controller.rb UX: One step wizard (#36082) 2025-11-25 13:35:32 -05:00
stylesheets_controller.rb DEV: Public color_scheme requests can disclose non-user-selectable theme color definitions and raw SCSS (#38497) 2026-03-11 07:56:27 -07:00
svg_sprite_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
tag_groups_controller.rb FIX: Failed updates in tag group controller would be logged (#38333) 2026-03-06 17:11:12 -03:00
tag_localizations_controller.rb FEATURE: Introduce tag localizations with API, without UI yet (#36754) 2025-12-18 18:25:58 +08:00
tags_controller.rb SECURITY: Prevent users from editing or synonymizing hidden tags they can't see 2026-03-19 15:21:28 +00:00
test_requests_controller.rb DEV: Add a user agent to all HTTP requests that Discourse makes. (#31555) 2025-03-03 16:32:25 +11:00
theme_javascripts_controller.rb DEV: Manually fix Rails/UnusedRenderContent offenses (#34418) 2025-08-22 11:42:12 +02:00
topic_localizations_controller.rb UX: Use inline title editor instead of composer when editing translation (#36847) 2025-12-24 00:56:36 +08:00
topic_view_stats_controller.rb FEATURE: topic_view_stats table with daily fidelity (#27197) 2024-05-27 15:25:32 +10:00
topics_controller.rb FIX: Handle blank-slug topics in full app embed mode (#38668) 2026-03-17 15:37:00 -03:00
uploads_controller.rb FIX: Multisite prevent anons from downloading files (#37979) 2026-02-24 10:49:14 +10:00
user_actions_controller.rb SECURITY: Enforce Guardian checks in UserActionsController#show 2026-03-19 15:21:28 +00:00
user_api_key_clients_controller.rb FIX: Empty-scopes bypass allows untrusted client registration and downstream scope/redirect policy bypass (#37855) 2026-02-17 12:39:09 +11:00
user_api_keys_controller.rb SECURITY: Validate auth_redirect in UserApiKeysController#new to prevent open redirect phishing 2026-03-19 15:21:28 +00:00
user_avatars_controller.rb PERF: extract shared DiskCacheEviction utility for disk caches (#37842) 2026-02-16 12:24:38 +01:00
user_badges_controller.rb FIX: enforces logged in, in badges actions (#37666) 2026-02-10 12:00:56 +01:00
user_status_controller.rb FEATURE: User Status API (#19149) 2022-11-24 19:16:28 +04:00
users_controller.rb FIX: Handle nil starts_at in ICS feeds and default to recent events (#38669) 2026-03-17 16:09:45 -03:00
users_email_controller.rb FIX: enforces login for create in user emails controller (#37770) 2026-02-12 17:10:43 +01:00
webhooks_controller.rb SECURITY: harden webooks endpoints 2026-02-26 12:22:54 +00:00
wizard_controller.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00