mirror of
https://github.com/discourse/discourse.git
synced 2026-08-05 10:42:34 +08:00
aea3519079
Backport of #732 to release/2026.5. --- Any AWS account holder can subscribe their own SNS topic to a Discourse instance's /webhooks/aws and publish bounce notifications that AWS will sign legitimately. The forged bounces are processed against arbitrary user emails, bumping bounce_score and eventually triggering email revocation.. This fix adds a new `aws_sns_topic_arn_allowlist` site setting. Also hardens Jobs::ProcessSnsNotification against three issues: - Binds bounces to (message_id, to_address) via find_by, so a legitimately-subscribed SNS publisher can no longer bounce arbitrary recipients we didn't send to. - Skips duplicate notifications (next if email_log.bounced?) — AWS SNS delivers at-least-once. - Uses update! instead of update_columns so EmailLog's existing before_save normalizes the bounce status code. Also add a dashboard problem flags self-hosted admins whose SMTP looks like SES but who haven't set the allowlist yet. https://github.com/discourse/discourse/security/advisories/GHSA-8f9m-v436-wr3x |
||
|---|---|---|
| .. | ||
| environments | ||
| imagemagick | ||
| initializers | ||
| locales | ||
| application.rb | ||
| boot.rb | ||
| cdn.yml.sample | ||
| database.yml | ||
| deploy.rb.sample | ||
| dev_defaults.yml | ||
| discourse.config.sample | ||
| discourse.pill.sample | ||
| discourse_defaults.conf | ||
| environment.rb | ||
| logrotate.conf | ||
| multisite.yml.production-sample | ||
| nginx.sample.conf | ||
| official_plugins.json | ||
| pitchfork.conf.rb | ||
| projections.json | ||
| routes.rb | ||
| sidekiq.yml | ||
| site_settings.yml | ||
| spring.rb | ||
| thin.yml.sample | ||
| unicorn_launcher | ||
