Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-reactions
History
Exact
Isaac Janzen 633dcfe5ef
 SECURITY: anonymous users can read hidden real names via reaction-user endpoints [backport 2026.5] (#41934) 
Backport of #41931 to release/2026.5.

---

## Summary

Fix anonymous disclosure of hidden full names of reactors and likers via
reaction-user APIs when `enable_names` setting is disabled. The
`CustomReactionsController` now conditionally includes the `name` field
only when `enable_names` is enabled, ensuring the invariant that hidden
full names are not exposed to unauthenticated users.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1451

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-22 14:11:20 -05:00
..
app SECURITY: anonymous users can read hidden real names via reaction-user endpoints [backport 2026.5] (#41934) 2026-07-22 14:11:20 -05:00
assets FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256) 2026-05-26 09:30:38 +02:00
config I18N: Update translations (#40788) 2026-06-11 12:09:30 +02:00
db FEATURE: Promote discourse_reactions_allow_any_emoji out of experimental (#35589) 2025-10-24 16:51:18 +10:00
lib DEV: NameError when resolving reactions serializer helpers 2026-05-26 13:04:29 +08:00
public/images/upcoming_changes UX: post reply count position change (#39606) 2026-05-11 11:43:54 +04:00
spec SECURITY: anonymous users can read hidden real names via reaction-user endpoints [backport 2026.5] (#41934) 2026-07-22 14:11:20 -05:00
test/javascripts DEV: cache post reactions results (#39533) 2026-05-06 14:04:04 +04:00
package.json DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00
plugin.rb FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256) 2026-05-26 09:30:38 +02:00
README.md
tsconfig.json DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00

README.md

Discourse Reactions

Discourse-reactions is a plugin that allows user to add their reactions to the post.

For more information, please see: https://meta.discourse.org/t/discourse-reactions-beyond-likes/183261