Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-post-voting
History
Exact
discoursebot 4df0e54f59
 SECURITY: Reviewable conversations expose post-voting flag PM excerpts to category moderators outside the PM [backport 2026.5] (#41530) 
Backport of #41527 to release/2026.5.

---

## Summary

Prevent unauthorized access to private message excerpts in reviewable
responses by ensuring companion conversations are only serialized when
the viewer has permission to see the underlying topic. The patch also
ensures category moderators receive legitimate access to post-voting
flag conversations by including the relevant moderation groups in the
private message recipient list.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1282

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Isaac Janzen <50783505+janzenisaac@users.noreply.github.com>
2026-07-07 15:38:07 -05:00
..
app DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
assets DEV: Remove enable_simplified_category_creation old code (#40108) 2026-05-27 10:04:46 +10:00
config I18N: Update translations (#41120) 2026-06-23 17:52:17 +02:00
db/migrate
extensions DEV: Disable post voting plugin on nested replies topics (#40305) 2026-05-27 09:09:00 -05:00
lib SECURITY: Reviewable conversations expose post-voting flag PM excerpts to category moderators outside the PM [backport 2026.5] (#41530) 2026-07-07 15:38:07 -05:00
spec SECURITY: Reviewable conversations expose post-voting flag PM excerpts to category moderators outside the PM [backport 2026.5] (#41530) 2026-07-07 15:38:07 -05:00
test/javascripts/acceptance DEV: Remove enable_simplified_category_creation old code (#40108) 2026-05-27 10:04:46 +10:00
package.json DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00
plugin.rb FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256) 2026-05-26 09:30:38 +02:00
README.md
tsconfig.json DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00

README.md

Discourse Post Voting

Discourse Post Voting allows the creation of topics with votable posts.

image

Please refer to https://meta.discourse.org/t/227808 for more info!

Contributions

Special thanks to Pavilion for building https://github.com/paviliondev/discourse-question-answer which this plugin took inspirations from.