0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-08 17:53:55 +08:00
discourse/spec
discourse-patch-triage[bot] 6fc7e6cf04 SECURITY: Signup-time primary_group_id assignment grants whisperer access [backport 2026.4]
Backport of #698 to release/2026.4.

---

## Summary

Applies security patch from triage.

## Security advisory

https://github.com/discourse/discourse/security/advisories/GHSA-vmwq-jvxx-jwfx

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/978
- Original commit:

---

🤖 Auto-generated from the patch diff via Patch Triage. Review carefully before merging.
2026-06-30 16:16:31 +02:00
..
db DEV: Silence expected error/debug output in core specs (#39247) 2026-04-14 11:04:10 +02:00
fabricators FEATURE: Add problem checks page to admin panel and allow ignoring problem checks (#39103) 2026-04-23 08:28:33 +08:00
fixtures FIX: Better handling of github_folder onebox w/o opengraph tags (#39142) 2026-04-08 11:49:57 +02:00
generator DEV: Remove deprecated trust level access settings (#36414) 2025-12-11 11:09:29 +10:00
helpers FIX: Make twitter card meta data translatable (#39150) 2026-04-08 18:40:21 +02:00
import_export
initializers SECURITY: Harden imagemagick execution [backport 2026.4] 2026-06-30 16:16:31 +02:00
integration FEATURE: add modifier to restrict theme color schemes (#38796) 2026-03-26 09:03:11 -04:00
integrity FEATURE: Allow upcoming changes to control site setting defaults (#38815) 2026-04-08 13:05:44 +10:00
jobs SECURITY: Authorize secure-upload hotlink downloads against post user [backport 2026.4] 2026-06-30 16:16:31 +02:00
lib SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks [backport 2026.4] 2026-06-30 16:16:31 +02:00
mailers FEATURE: better email subject lines (#36040) 2026-04-24 15:14:10 +04:00
models SECURITY: Signup-time primary_group_id assignment grants whisperer access [backport 2026.4] 2026-06-30 16:16:31 +02:00
multisite DEV: Fix spec cleanup issues for upcoming changes (#39024) 2026-04-01 14:15:02 +10:00
queries/reports UX: Add more reports to legacy, removing them from the reports page (#38688) 2026-03-18 22:18:47 +08:00
requests SECURITY: Signup-time primary_group_id assignment grants whisperer access [backport 2026.4] 2026-06-30 16:16:31 +02:00
script/import_scripts
serializers SECURITY: Prevent expired invite details from leaking [backport 2026.4] (#41192) 2026-06-25 22:02:04 +08:00
services SECURITY: Regular users can route multipart uploads into the admin backup store [backport 2026.4] 2026-06-30 16:16:31 +02:00
support DEV: Fix flaky select-kit test selectors (#39577) 2026-04-27 12:42:10 +02:00
system DEV: Restore ember-this-fallback runtime components [backport 2026.4] (#39663) 2026-04-30 16:13:02 +01:00
tasks DEV: Silence expected error/debug output in core specs (#39247) 2026-04-14 11:04:10 +02:00
views FIX: remove ItemList schema from linkbacks in crawler view (#36608) 2025-12-11 10:41:47 +01:00
rails_helper.rb DEV: Restore and fix composer body test (#39510) 2026-04-27 00:18:31 +02:00
regenerate_swagger_docs
swagger_helper.rb