0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-08 17:53:55 +08:00
discourse/app
discoursebot 5825207471
SECURITY: Prevent topic existence disclosure in profile featuring [backport 2026.6] (#42237)
Backport of #42235 to release/2026.6.

---

Previously, the profile feature-topic endpoint returned different
responses for missing topics and existing topics the requester could not
access, revealing whether a topic record existed.

This change checks topic visibility before feature eligibility,
returning a not-found response for both missing and inaccessible topics.

Relates to this patch: https://patch.discourse.org/patch-triage/1350

Co-authored-by: Gabriel Grubba <gabriel@discourse.org>
2026-07-31 16:18:40 -03:00
..
assets UX: Remove new height variables from foundation modernization [backport 2026.6] (#41985) 2026-07-23 11:11:11 -05:00
controllers SECURITY: Prevent topic existence disclosure in profile featuring [backport 2026.6] (#42237) 2026-07-31 16:18:40 -03:00
helpers SECURITY: Prevent cache poisoning/XSS via color scheme cookies [backport 2026.6] 2026-07-28 17:05:36 +02:00
jobs SECURITY: Authorize secure-upload hotlink downloads against post user 2026-06-30 16:10:52 +02:00
mailers FEATURE: Log in with a one-time email code (#40804) 2026-06-17 12:34:48 -07:00
models FIX: Skip dominant color calculation when the upload file is missing [backport 2026.6] (#42167) 2026-07-30 16:58:07 +01:00
queries/reports FIX: Enforce can_see_ip checks across admin IP features (#40019) 2026-05-19 11:37:20 +08:00
serializers SECURITY: Respect topic visibility in reviewable score serializer [backport 2026.6] 2026-07-28 17:05:36 +02:00
services SECURITY: Stop exposing hidden tag names through category serializers [backport 2026.6] 2026-07-28 17:05:36 +02:00
views FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00