Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-09 21:45:25 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-data-explorer
History
Exact
discoursebot 272088dd71
 SECURITY: Group report details expose raw Data Explorer SQL to non-admin group members [backport 2026.5] (#40949) 
Backport of #40919 to release/2026.5.

---

## Summary

Prevent the exposure of raw Data Explorer SQL to non-admin group members
when viewing report details. The sql attribute is now correctly gated to
administrators within the query details serializer.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1290
- Affected file:
https://github.com/discourse/discourse/blob/main/plugins/discourse-data-explorer/app/serializers/discourse_data_explorer/query_details_serializer.rb

---

🤖 Auto-generated from the patch diff via Patch Triage. Review carefully
before merging.

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Bannon Tanner <bannon@discourse.org>
2026-06-16 14:13:43 -05:00
..
admin/assets/javascripts/admin UX: improve data explorer SQL editor for small screens (#40343) 2026-05-27 13:39:17 -04:00
app SECURITY: Group report details expose raw Data Explorer SQL to non-admin group members [backport 2026.5] (#40949) 2026-06-16 14:13:43 -05:00
assets UX: improve data explorer SQL editor for small screens (#40343) 2026-05-27 13:39:17 -04:00
config I18N: Update translations (#40822) 2026-06-12 16:19:30 +02:00
db/migrate DEV: Check & resolve sequence issues during db:check_structure_dump (#40118) 2026-05-18 15:23:41 +01:00
lib FIX: Prevent hidden Data Explorer queries leaking via bookmarks (#40327) 2026-05-27 17:25:30 +10:00
spec SECURITY: Group report details expose raw Data Explorer SQL to non-admin group members [backport 2026.5] (#40949) 2026-06-16 14:13:43 -05:00
test/javascripts UI: Update manual data explorer query page (step 3/n) (#40190) 2026-05-21 01:24:30 +08:00
package.json DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00
plugin.rb DEV: Scaffold backend for the new admin dashboard Reports section (#40017) 2026-05-20 09:53:26 +03:00
README.md
tsconfig.json DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00

README.md

Data Explorer Plugin

This plugin allows admins to run SQL queries against the live Discourse database, including parameterized queries and formatting for several common column types.

For more information, please see: https://meta.discourse.org/t/data-explorer-plugin/32566