Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-07 13:19:19 +08:00
Code Packages Activity Actions
discourse/frontend
History
Exact
Joffrey JAFFEUX b4499001d0 SECURITY: XSS when editing a malicious post 
A user full name can be evaluated as raw HTML when the following settings are set:
- `display_name_on_posts` => true
- `prioritize_username_in_ux` => false

Editing a post of a malicious user would trigger and XSS. The fix is to escape the content.
2026-02-26 12:22:54 +00:00
..
asset-processor DEV: Rename theme-compiler's entrypoint and compatModules (#37768) 2026-02-12 16:11:43 +01:00
custom-proxy DEV: Upgrade to pnpm v10 (#36289) 2026-01-12 10:43:06 +00:00
deprecation-silencer DEV: Upgrade to pnpm v10 (#36289) 2026-01-12 10:43:06 +00:00
discourse SECURITY: XSS when editing a malicious post 2026-02-26 12:22:54 +00:00
discourse-i18n FIX: Dasherize locale correctly for messageformat setup (#37268) 2026-01-22 13:36:59 +00:00
discourse-markdown-it FIX: Prevent URL anchors from triggering hashtag autocomplete in rich editor (#37306) 2026-01-29 09:42:33 +01:00
discourse-plugins DEV: Refactor plugin JS handling (#37763) 2026-02-19 12:24:04 +00:00
discourse-types DEV: Upgrade to pnpm v10 (#36289) 2026-01-12 10:43:06 +00:00
ember-cli-progress-ci
pretty-text DEV: fix a large amount of typos (#37428) 2026-02-02 16:31:58 +11:00
.npmrc
polyfills.js