0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-07 13:19:19 +08:00
discourse/app/services
discourse-patch-triage[bot] 1f1ded8dd3 SECURITY: Regular users can route multipart uploads into the admin backup store
## Summary

Applies security patch from triage.

## Security advisory

https://github.com/discourse/discourse/security/advisories/GHSA-3mvf-q9rg-w6m7

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1068
- Original commit:

---

🤖 Auto-generated from the patch diff via Patch Triage. Review carefully before merging.
2026-06-30 16:10:52 +02:00
..
admin/search FIX: Enforce can_see_ip checks across admin IP features (#40019) 2026-05-19 11:37:20 +08:00
admin_notices
categories FIX: Moderators can enable plugins when enable_category_type_setup SiteSetting is enabled (#40349) 2026-06-17 08:37:14 -05:00
category
concerns FIX: Average daily engaged users KPI instead of summing the period (#40384) 2026-05-29 09:22:13 +08:00
discourse_id
email_login_code FEATURE: Sign up with a one-time email code (#40909) 2026-06-23 11:30:18 -07:00
flags
groups DEV: Add descriptive error message when creating requestable group with no owner (#40391) 2026-05-29 11:11:59 +08:00
nested_topic REVERT: "FEATURE: Topic timeline for nested replies view (#40125)" (#40202) 2026-05-20 13:20:46 -05:00
notification/action
notifications
problem_check SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks 2026-06-30 16:10:52 +02:00
site_setting DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
site_setting_localizations/about_config FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
spam_rule
tags SECURITY: Don't leak hidden tag names in one-per-topic conflict reasons (#41035) 2026-06-19 11:26:15 -03:00
themes DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
upcoming_changes FIX: Do not send notifications for upcoming changes not displayed (#40933) 2026-06-17 09:10:49 +10:00
user FEATURE: Bulk suspend users and filter the admin users list by activation (#41227) 2026-06-29 11:26:34 +02:00
user_api_key FEATURE: User API key device authorization flow (#40189) 2026-06-10 16:09:44 -04:00
video_conversion DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
access_control_list_manager.rb DEV: Add banned_acl concept to AccessControlList (#41254) 2026-06-29 16:22:30 +10:00
admin_dashboard_engagement.rb FIX: Average daily engaged users KPI instead of summing the period (#40384) 2026-05-29 09:22:13 +08:00
admin_dashboard_highlights.rb FIX: Average daily engaged users KPI instead of summing the period (#40384) 2026-05-29 09:22:13 +08:00
admin_dashboard_search.rb FIX: Exclude anonymous searches from the dashboard search section (#40966) 2026-06-17 14:32:04 +08:00
admin_dashboard_section_configuration.rb DEV: Remove admin_dashboard_search_section_enabled hidden site setting (#41016) 2026-06-18 15:03:25 +08:00
admin_dashboard_section_loader.rb PERF: Parallelize section loading in new dashboard (#40970) 2026-06-17 16:29:10 +08:00
admin_dashboard_site_traffic.rb FEATURE: Add direct traffic KPI to the Site Traffic dashboard (#41274) 2026-06-30 14:30:28 +08:00
anonymous_shadow_creator.rb FEATURE: Anonymous shadow sessions can outlive suspension of the master account (#40156) 2026-05-20 12:07:56 +08:00
badge_granter.rb
base_bookmarkable.rb
category_hashtag_data_source.rb
color_scheme_revisor.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
destroy_task.rb DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
email_settings_exception_handler.rb
email_settings_validator.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
email_style_updater.rb
external_upload_manager.rb SECURITY: Regular users can route multipart uploads into the admin backup store 2026-06-30 16:10:52 +02:00
group_action_logger.rb
group_mentions_updater.rb FIX: Sync category description when post content changes outside PostRevisor (#39184) 2026-05-11 16:13:23 +02:00
group_message.rb
handle_chunk_upload.rb
hashtag_autocomplete_service.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
heat_settings_updater.rb
hub_push_notification_pusher.rb
inline_uploads.rb FIX: Prevent backslash accumulation in upload markdown labels (#39461) 2026-06-03 18:10:38 +02:00
locale_normalizer.rb
notification_emailer.rb
post_action_notifier.rb
post_alerter.rb DEV: Enable some minor rubocop rules (#40094) 2026-05-19 15:29:38 +02:00
post_bookmarkable.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
post_owner_changer.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
push_notification_pusher.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
random_topic_selector.rb
registered_bookmarkable.rb
search_indexer.rb DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
sidebar_section_links_updater.rb
sidebar_site_settings_backfiller.rb
site_setting_update_existing_users.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
site_settings_task.rb
staff_action_logger.rb FEATURE: Access control list UI and backend (#41009) 2026-06-29 09:44:58 +10:00
tag_hashtag_data_source.rb
tag_settings_updater.rb FIX: Tag settings can reassign hidden synonym tags by ID (#39778) 2026-05-07 11:01:51 +10:00
theme_settings_migrations_runner.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
themes_install_task.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
topic_bookmarkable.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
topic_status_updater.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
topic_timestamp_changer.rb
tracked_topics_updater.rb
trust_level_granter.rb
user_action_manager.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
user_activator.rb FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256) 2026-05-26 09:30:38 +02:00
user_anonymizer.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
user_authenticator.rb
user_destroyer.rb FIX: Resolve all of a deleted spammer's reviewables (#40780) 2026-06-15 13:34:15 +08:00
user_merger.rb
user_notification_renderer.rb
user_notification_schedule_processor.rb
user_password_expirer.rb
user_silencer.rb FIX: Prevent moderators from being auto-silenced (#39709) 2026-05-05 14:54:46 +08:00
user_stat_count_updater.rb
user_suspender.rb FEATURE: Anonymous shadow sessions can outlive suspension of the master account (#40156) 2026-05-20 12:07:56 +08:00
user_updater.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
username_changer.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
username_checker_service.rb
web_hook_emitter.rb
wildcard_domain_checker.rb
wildcard_url_checker.rb DEV: Fix auth redirect validation in user API key flow (#40459) 2026-06-01 15:47:35 -04:00
word_watcher.rb FIX: Watched word with invalid regex crashes markdown cook (#40107) 2026-05-18 16:04:20 +08:00