Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/config/locales
History
Exact
Nat aea3519079 SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks [backport 2026.5] 
Backport of #732 to release/2026.5.

---

Any AWS account holder can subscribe their own SNS topic to a Discourse instance's /webhooks/aws and publish bounce notifications that AWS will sign legitimately. The forged bounces are processed against arbitrary user emails, bumping bounce_score and eventually triggering email revocation..

This fix adds a new `aws_sns_topic_arn_allowlist` site setting. Also hardens Jobs::ProcessSnsNotification against three issues:
- Binds bounces to (message_id, to_address) via find_by, so a legitimately-subscribed SNS publisher can no longer bounce arbitrary recipients we didn't send to.
- Skips duplicate notifications (next if email_log.bounced?) — AWS SNS delivers at-least-once.
- Uses update! instead of update_columns so EmailLog's existing before_save normalizes the bounce status code.

Also add a dashboard problem flags self-hosted admins whose SMTP looks like SES but who haven't set the allowlist yet.

https://github.com/discourse/discourse/security/advisories/GHSA-8f9m-v436-wr3x
2026-06-30 16:17:06 +02:00
..
client.ar.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.be.yml I18N: Update translations (#40868) 2026-06-15 17:24:50 +02:00
client.bg.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.bs_BA.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.ca.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.cs.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.da.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.de.yml I18N: Update translations (#40868) 2026-06-15 17:24:50 +02:00
client.el.yml I18N: Update translations (#40822) 2026-06-12 16:19:30 +02:00
client.en.yml UX: Redesign custom date range picker on new admin dashboard (#40355) 2026-05-28 14:14:30 +08:00
client.en_GB.yml I18N: Update translations (#40300) 2026-05-26 15:25:51 +02:00
client.es.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.et.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.fa_IR.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.fi.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.fr.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.gl.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.he.yml I18N: Update translations (#40439) 2026-06-01 21:00:28 +02:00
client.hr.yml I18N: Update translations (#40599) 2026-06-07 21:04:45 +02:00
client.hu.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.hy.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.id.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.it.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.ja.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.ko.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.lt.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.lv.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.nb_NO.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.nl.yml I18N: Update translations (#40439) 2026-06-01 21:00:28 +02:00
client.pl_PL.yml I18N: Update translations (#40439) 2026-06-01 21:00:28 +02:00
client.pt.yml I18N: Update translations (#40439) 2026-06-01 21:00:28 +02:00
client.pt_BR.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.ro.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.ru.yml I18N: Update translations (#41120) 2026-06-23 17:52:17 +02:00
client.sk.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.sl.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.sq.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.sr.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.sv.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.sw.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.te.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.th.yml I18N: Update translations (#40439) 2026-06-01 21:00:28 +02:00
client.tr_TR.yml I18N: Update translations (#40941) 2026-06-16 16:34:09 +02:00
client.ug.yml I18N: Update translations (#41286) 2026-06-30 15:45:32 +02:00
client.uk.yml I18N: Update translations (#40439) 2026-06-01 21:00:28 +02:00
client.ur.yml I18N: Update translations (#41120) 2026-06-23 17:52:17 +02:00
client.vi.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
client.zh_CN.yml I18N: Update translations (#41286) 2026-06-30 15:45:32 +02:00
client.zh_TW.yml I18N: Update translations (#40361) 2026-05-28 10:50:51 +02:00
names.yml UX: Use English as language label where appropriate (#36762) 2025-12-18 13:10:23 -05:00
plurals.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
server.ar.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.be.yml I18N: Update translations (#40788) 2026-06-11 12:09:30 +02:00
server.bg.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.bs_BA.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.ca.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.cs.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.da.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.de.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.el.yml I18N: Update translations (#40822) 2026-06-12 16:19:30 +02:00
server.en.yml SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks [backport 2026.5] 2026-06-30 16:17:06 +02:00
server.en_GB.yml I18N: Update translations (#40027) 2026-05-17 19:13:55 +02:00
server.es.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.et.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.fa_IR.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.fi.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.fr.yml I18N: Update translations (#40941) 2026-06-16 16:34:09 +02:00
server.gl.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.he.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.hr.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.hu.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.hy.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.id.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.it.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.ja.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.ko.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.lt.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.lv.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.nb_NO.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.nl.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.pl_PL.yml I18N: Update translations (#41120) 2026-06-23 17:52:17 +02:00
server.pt.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.pt_BR.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.ro.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.ru.yml I18N: Update translations (#40788) 2026-06-11 12:09:30 +02:00
server.sk.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.sl.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.sq.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.sr.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.sv.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.sw.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.te.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.th.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.tr_TR.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.ug.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.uk.yml I18N: Update translations (#41286) 2026-06-30 15:45:32 +02:00
server.ur.yml I18N: Update translations (#41120) 2026-06-23 17:52:17 +02:00
server.vi.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
server.zh_CN.yml I18N: Update translations (#41120) 2026-06-23 17:52:17 +02:00
server.zh_TW.yml I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
transliterate.ar.yml Create transliterate.ar.yml (#6197) 2018-07-31 14:41:49 +10:00
transliterate.bg.yml FEATURE: Add Bulgarian language 2018-05-29 21:07:17 +02:00
transliterate.de.yml FEATURE: Adds transliteration of German umlauts in slugs 2015-02-27 23:53:58 +01:00
transliterate.el.yml UX: Add transliteration support for the Greek language 2019-04-25 22:49:21 +02:00
transliterate.en.yml FEATURE: Adds transliteration of German umlauts in slugs 2015-02-27 23:53:58 +01:00
transliterate.ru.yml FEATURE: Adds transliteration of German umlauts in slugs 2015-02-27 23:53:58 +01:00
transliterate.ug.yml FEATURE: Add Uyghur language (#27183) 2024-05-27 09:58:18 +02:00
transliterate.vi.yml FIX: i18n integrity specs 2017-02-24 11:35:33 +01:00