Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-09 21:45:25 +08:00
Code Packages Activity Actions
discourse/spec/services
History
Exact
discoursebot fceb3b9f63
 SECURITY: Stale featured rows expose unlisted topic content [backport 2026.6] (#41811) 
Backport of #41810 to release/2026.6.

---

## Summary

Prevent the exposure of unlisted topic metadata in the categories
response by enforcing live visibility checks on featured topics.
Additionally, the UserSilencer service now correctly removes featured
topic records when bulk-hiding topics from new users, ensuring stale
records do not bypass visibility constraints.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1427

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Bannon Tanner <bannon@discourse.org>
2026-07-17 09:38:33 -05:00
..
admin/search FIX: Enforce can_see_ip checks across admin IP features (#40019) 2026-05-19 11:37:20 +08:00
admin_notices FEATURE: Add problem checks page to admin panel and allow ignoring problem checks (#39103) 2026-04-23 08:28:33 +08:00
categories FIX: Moderators can enable plugins when enable_category_type_setup SiteSetting is enabled (#40349) 2026-06-17 08:37:14 -05:00
category DEV: Refactor category hierarchical search (#37609) 2026-02-13 09:43:56 +01:00
discourse_id FEATURE: Discourse ID setting page (#36316) 2025-12-11 16:04:09 +01:00
email_login_code FEATURE: Sign up with a one-time email code (#40909) 2026-06-23 11:30:18 -07:00
flags DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
groups DEV: Add descriptive error message when creating requestable group with no owner (#40391) 2026-05-29 11:11:59 +08:00
nested_topic REVERT: "FEATURE: Topic timeline for nested replies view (#40125)" (#40202) 2026-05-20 13:20:46 -05:00
notification/action FEATURE: Notify admins of upcoming changes and log events (#37003) 2026-01-21 12:45:54 +10:00
notifications FEATURE: Consolidate link notifications (#26567) 2024-04-09 11:53:37 -06:00
problem_check SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks 2026-06-30 16:10:52 +02:00
site_setting UX: Allow more specific enabled for options for upcoming changes (#39916) 2026-05-13 10:22:06 +10:00
site_setting_localizations/about_config FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
tags SECURITY: Don't leak hidden tag names in one-per-topic conflict reasons (#41035) 2026-06-19 11:26:15 -03:00
themes FEATURE: Enable high context topic cards in Horizon by default (#39959) 2026-05-15 10:50:42 +10:00
upcoming_changes FIX: Do not send notifications for upcoming changes not displayed (#40933) 2026-06-17 09:10:49 +10:00
user FEATURE: Bulk suspend users and filter the admin users list by activation (#41227) 2026-06-29 11:26:34 +02:00
user_api_key FEATURE: User API key device authorization flow (#40189) 2026-06-10 16:09:44 -04:00
video_conversion PERF: Run primary and parallel DB setup concurrently in CI (#40319) 2026-05-29 06:46:32 +08:00
access_control_list_manager_spec.rb DEV: Add banned_acl concept to AccessControlList (#41254) 2026-06-29 16:22:30 +10:00
admin_dashboard_engagement_spec.rb FIX: Average daily engaged users KPI instead of summing the period (#40384) 2026-05-29 09:22:13 +08:00
admin_dashboard_highlights_spec.rb FIX: Average daily engaged users KPI instead of summing the period (#40384) 2026-05-29 09:22:13 +08:00
admin_dashboard_search_spec.rb FIX: Exclude anonymous searches from the dashboard search section (#40966) 2026-06-17 14:32:04 +08:00
admin_dashboard_section_configuration_spec.rb DEV: Remove admin_dashboard_search_section_enabled hidden site setting (#41016) 2026-06-18 15:03:25 +08:00
admin_dashboard_section_loader_spec.rb PERF: Parallelize section loading in new dashboard (#40970) 2026-06-17 16:29:10 +08:00
admin_dashboard_site_traffic_spec.rb FEATURE: Add direct traffic KPI to the Site Traffic dashboard (#41274) 2026-06-30 14:30:28 +08:00
anonymous_shadow_creator_spec.rb DEV: Rename anonymous group to anonymous_users (#40435) 2026-06-02 09:29:46 +10:00
auto_silence_spec.rb FIX: Moderator notifications when new post auto-silences a user (#35403) 2025-10-15 16:07:56 +08:00
badge_granter_spec.rb DEV: Automatically detect and revert translation overrides in specs (#40003) 2026-05-13 22:09:23 +02:00
base_bookmarkable_spec.rb FIX: Show deleted bookmark reminders in user bookmarks menu (#25905) 2024-02-29 09:03:49 +10:00
category_hashtag_data_source_spec.rb FIX: Use unaccent() for category name/slug search (#37622) 2026-02-12 08:43:23 +01:00
color_scheme_revisor_spec.rb FEATURE: Ability to set palettes as default on theme (#34480) 2025-08-27 09:09:34 +08:00
destroy_task_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
email_settings_exception_handler_spec.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
email_settings_validator_spec.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
email_style_updater_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
external_upload_manager_spec.rb SECURITY: Regular users can route multipart uploads into the admin backup store 2026-06-30 16:10:52 +02:00
flag_sockpuppets_spec.rb DEV: Fix Lint/BooleanSymbol (#24747) 2023-12-06 13:19:09 +01:00
group_action_logger_spec.rb PERF: Add Users to Group Improvements Pt. 2 (#38901) 2026-04-06 09:31:50 -05:00
group_mentions_updater_spec.rb FIX: Sync category description when post content changes outside PostRevisor (#39184) 2026-05-11 16:13:23 +02:00
group_message_spec.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
hashtag_autocomplete_service_spec.rb DEV: Move canonical tag routes to /tag/slug/id keeping /tag/name support (#37055) 2026-02-11 10:21:19 +08:00
heat_settings_updater_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
hub_push_notification_pusher_spec.rb DEV: Centralize push notification delivery into a single job (#39207) 2026-04-14 11:55:45 -03:00
inline_uploads_multisite_spec.rb DEV: Fix various rubocop lints (#24749) 2023-12-06 23:25:00 +01:00
inline_uploads_spec.rb FIX: Prevent backslash accumulation in upload markdown labels (#39461) 2026-06-03 18:10:38 +02:00
locale_normalizer_spec.rb FIX: Show localization for regionless locale if they exist (#33702) 2025-07-21 15:45:14 +08:00
notification_emailer_spec.rb FIX: Send notification emails for staff-coloured posts (#37712) 2026-02-11 13:26:27 +01:00
post_action_notifier_spec.rb DEV: Convert min_trust_to_create_topic to groups (#24740) 2023-12-13 14:50:13 +11:00
post_alerter_spec.rb SECURITY: Replying to a whisper lets non-whisperers create staff-only whisper posts 2026-05-19 00:26:04 +01:00
post_bookmarkable_spec.rb DEV: Remove unnecessary rails_helper requiring (#26364) 2024-03-26 11:32:01 +01:00
post_owner_changer_spec.rb SECURITY: Ensure moderator can see post/topic before allowing them to change owner 2026-01-28 17:11:14 +00:00
problem_check_spec.rb FIX: Allow only sanitized strings in admin notices (#39796) 2026-05-06 13:40:20 -04:00
push_notification_pusher_spec.rb FIX: Clean up push subscriptions whose endpoint domain no longer resolves (#39804) 2026-05-06 14:37:58 -03:00
random_topic_selector_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
search_indexer_spec.rb FEATURE: Add full-text search for chat messages (#34704) 2025-10-22 11:30:35 +02:00
sidebar_site_settings_backfiller_spec.rb DEV: Hand-pick Rails/WhereNot autofixes (#35117) 2025-10-03 13:29:22 +02:00
site_settings_spec.rb FIX: Reject DiscourseConnect SSO payloads when secret is blank (#40830) 2026-06-12 15:17:16 +03:00
staff_action_logger_spec.rb FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
tag_hashtag_data_source_spec.rb FIX: Tag search 500 when content_localization is enabled (#37769) 2026-02-12 23:58:03 +08:00
tag_settings_updater_spec.rb FIX: Clean localized tag names (#38488) 2026-03-12 12:54:50 +08:00
theme_settings_migrations_runner_spec.rb DEV: Add category helper for theme migration (#38816) 2026-03-24 16:50:37 +08:00
themes_spec.rb DEV: Fix constant redefinition warnings when running specs (#29837) 2024-11-20 15:17:36 +11:00
topic_bookmarkable_spec.rb DEV: Remove unnecessary rails_helper requiring (#26364) 2024-03-26 11:32:01 +01:00
topic_status_updater_spec.rb FEATURE: Exclude small actions from topic counters and unread tracking (#40481) 2026-06-08 08:03:55 +02:00
topic_timestamp_changer_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
trust_level_granter_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
user_activator_spec.rb DEV: Change authenticated_with_oauth to use key instead of string. (#38381) 2026-03-10 18:31:32 -03:00
user_anonymizer_spec.rb FIX: Block associated account emails on user delete and anonymize (#37638) 2026-02-09 18:26:35 +01:00
user_authenticator_spec.rb FIX: do not enforce 2fa when an account is created with OAuth (#28625) 2024-08-29 11:19:04 +10:00
user_destroyer_spec.rb FIX: Resolve all of a deleted spammer's reviewables (#40780) 2026-06-15 13:34:15 +08:00
user_merger_spec.rb FIX: blocks post action merge for duplicated flags (#36265) 2025-11-26 16:17:57 -03:00
user_notification_schedule_processor_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
user_password_expirer_spec.rb DEV: Migrate user passwords data to UserPassword table (#28746) 2024-10-10 09:23:06 +08:00
user_silencer_spec.rb SECURITY: Stale featured rows expose unlisted topic content [backport 2026.6] (#41811) 2026-07-17 09:38:33 -05:00
user_stat_count_updater_spec.rb DEV: Don’t replace Rails logger in specs (#29721) 2024-11-13 08:47:39 +08:00
user_suspender_spec.rb FEATURE: Link staff action log entries to originating reviewable (#39519) 2026-04-30 09:15:45 +08:00
user_updater_spec.rb FIX: Reject DiscourseConnect SSO payloads when secret is blank (#40830) 2026-06-12 15:17:16 +03:00
username_changer_spec.rb FIX: Preserve display name in quotes when using the rich text editor (#38078) 2026-02-26 21:04:07 +01:00
username_checker_service_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
wildcard_domain_checker_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
wildcard_url_checker_spec.rb DEV: Fix auth redirect validation in user API key flow (#40459) 2026-06-01 15:47:35 -04:00
word_watcher_spec.rb FIX: Watched word with invalid regex crashes markdown cook (#40107) 2026-05-18 16:04:20 +08:00