Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-12 05:37:26 +08:00
Code Packages Activity Actions
discourse/frontend
History
Exact
Joffrey JAFFEUX 9230af44b2 SECURITY: Restrict raw email in queued post payloads [backport 2026.3] 
Backport of #634 to release/2026.3.

---

`ReviewableQueuedPostSerializer` unconditionally included `payload["raw_email"]` for posts that arrived via incoming email. Category moderation group members reaching the review queue could therefore read the full inbound email source without being in `view_raw_email_allowed_groups`.

The serializer now redacts `raw_email` from the rendered payload unless  the current user is in `view_raw_email_allowed_groups`, mirroring the  existing check used by `Guardian#can_view_raw_email`.

This commit also:
- disables click on envelope when user has no raw email access to prevent a deceptive action
- adds a new `guardian.can_view_raw_emails?` to avoid duplication of this specific logic

https://github.com/discourse/discourse/security/advisories/GHSA-h2jr-whpx-6w63
2026-05-19 00:24:48 +01:00
..
asset-processor DEV: Update esbuild to 0.27.4 (#38957) 2026-03-30 13:13:58 +02:00
custom-proxy DEPS: Bump glob from 13.0.0 to 13.0.6 (#38191) 2026-03-04 12:29:35 +01:00
deprecation-silencer DEV: Update ember-template-compiler paths (#38542) 2026-03-12 17:49:33 +00:00
discourse SECURITY: Restrict raw email in queued post payloads [backport 2026.3] 2026-05-19 00:24:48 +01:00
discourse-i18n DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00
discourse-markdown-it DEV: Update markdown-it from 14.0.0 to 14.1.1 (#38869) 2026-03-25 15:19:15 +01:00
discourse-plugins DEV: Enable rollup plugin compiler by default (#38658) 2026-03-19 11:44:54 +00:00
discourse-types DEPS: Bump @types/node from 25.0.10 to 25.3.3 in the types group (#38391) 2026-03-10 11:12:22 +01:00
ember-cli-progress-ci
pretty-text DEV: Make imports in pretty-text easier for rolldown to handle (#38830) 2026-03-24 17:52:16 +01:00
.npmrc
polyfills.js