Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-11 02:59:07 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-policy
History
Exact
Joffrey JAFFEUX 751b77ee50 SECURITY: missing post access check in discourse policy 
Vulnerability in `DiscoursePolicy::PolicyController` — all actions load a post by `params[:post_id]` without checking whether the current user has permission to see that post, allowing interaction with policies on posts in private categories or PMs.

Group membership can limit the exploit but was still leaking information, and you could still have a policy group allowed to everyone in a private category.
2026-02-26 12:22:54 +00:00
..
app SECURITY: missing post access check in discourse policy 2026-02-26 12:22:54 +00:00
assets FEATURE: rich editor extension for the policy plugin (#36631) 2026-01-12 02:17:21 -03:00
config I18N: Update translations (#37917) 2026-02-25 09:42:49 -05:00
db/migrate DEV: Convert policy_restrict_to_staff_posts to group based access (#36157) 2025-12-02 09:50:18 +08:00
jobs/scheduled FIX: allows check_policy to find mailer class (#35464) 2025-10-17 11:19:33 +02:00
lib DEV: Clean up scope resolution operators in plugins (#34979) 2025-09-30 14:36:34 +02:00
spec SECURITY: missing post access check in discourse policy 2026-02-26 12:22:54 +00:00
test/javascripts FEATURE: rich editor extension for the policy plugin (#36631) 2026-01-12 02:17:21 -03:00
package.json DEV: Overhaul typechecking configuration (#35794) 2025-11-12 12:54:34 +00:00
plugin.rb DEV: Support deprecating site settings in plugins (#36371) 2025-12-03 13:30:35 +08:00
README.md
tsconfig.json DEV: Overhaul typechecking configuration (#35794) 2025-11-12 12:54:34 +00:00

README.md

Discourse Policy Plugin

Confirm your users have seen or done something with reminders

For more information, please see: https://meta.discourse.org/t/discourse-policy/88557