Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-07 13:19:19 +08:00
Code Packages Activity Actions
discourse/config/locales
History
Exact
Nat 61f12e13aa SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks 
Any AWS account holder can subscribe their own SNS topic to a Discourse instance's /webhooks/aws and publish bounce notifications that AWS will sign legitimately. The forged bounces are processed against arbitrary user emails, bumping bounce_score and eventually triggering email revocation..

This fix adds a new `aws_sns_topic_arn_allowlist` site setting. Also hardens Jobs::ProcessSnsNotification against three issues:
- Binds bounces to (message_id, to_address) via find_by, so a legitimately-subscribed SNS publisher can no longer bounce arbitrary recipients we didn't send to.
- Skips duplicate notifications (next if email_log.bounced?) — AWS SNS delivers at-least-once.
- Uses update! instead of update_columns so EmailLog's existing before_save normalizes the bounce status code.

Also add a dashboard problem flags self-hosted admins whose SMTP looks like SES but who haven't set the allowlist yet.

https://github.com/discourse/discourse/security/advisories/GHSA-8f9m-v436-wr3x
2026-06-30 16:10:52 +02:00
..
client.ar.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.be.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.bg.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.bs_BA.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.ca.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.cs.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.da.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.de.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.el.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.en.yml FEATURE: Add direct traffic KPI to the Site Traffic dashboard (#41274) 2026-06-30 14:30:28 +08:00
client.en_GB.yml I18N: Update translations (#40300) 2026-05-26 15:25:51 +02:00
client.es.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.et.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.fa_IR.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.fi.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.fr.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.gl.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.he.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.hr.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.hu.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.hy.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.id.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.it.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.ja.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.ko.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.lt.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.lv.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.nb_NO.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.nl.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.pl_PL.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.pt.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.pt_BR.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.ro.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.ru.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.sk.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.sl.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.sq.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.sr.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.sv.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.sw.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.te.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.th.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.tr_TR.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.ug.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.uk.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.ur.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.vi.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.zh_CN.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
client.zh_TW.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
names.yml UX: Use English as language label where appropriate (#36762) 2025-12-18 13:10:23 -05:00
plurals.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
server.ar.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.be.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.bg.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.bs_BA.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.ca.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.cs.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.da.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.de.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.el.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.en.yml SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks 2026-06-30 16:10:52 +02:00
server.en_GB.yml I18N: Update translations (#40027) 2026-05-17 19:13:55 +02:00
server.es.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.et.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.fa_IR.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.fi.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.fr.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.gl.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.he.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.hr.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.hu.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.hy.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.id.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.it.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.ja.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.ko.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.lt.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.lv.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.nb_NO.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.nl.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.pl_PL.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
server.pt.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.pt_BR.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.ro.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.ru.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.sk.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.sl.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.sq.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.sr.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.sv.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.sw.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.te.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.th.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.tr_TR.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.ug.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.uk.yml I18N: Update translations (#41287) 2026-06-30 15:45:46 +02:00
server.ur.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.vi.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.zh_CN.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
server.zh_TW.yml I18N: Update translations (#41257) 2026-06-29 15:30:28 +02:00
transliterate.ar.yml Create transliterate.ar.yml (#6197) 2018-07-31 14:41:49 +10:00
transliterate.bg.yml FEATURE: Add Bulgarian language 2018-05-29 21:07:17 +02:00
transliterate.de.yml FEATURE: Adds transliteration of German umlauts in slugs 2015-02-27 23:53:58 +01:00
transliterate.el.yml UX: Add transliteration support for the Greek language 2019-04-25 22:49:21 +02:00
transliterate.en.yml FEATURE: Adds transliteration of German umlauts in slugs 2015-02-27 23:53:58 +01:00
transliterate.ru.yml FEATURE: Adds transliteration of German umlauts in slugs 2015-02-27 23:53:58 +01:00
transliterate.ug.yml FEATURE: Add Uyghur language (#27183) 2024-05-27 09:58:18 +02:00
transliterate.vi.yml FIX: i18n integrity specs 2017-02-24 11:35:33 +01:00