| .. |
|
admin
|
FEATURE: Bulk suspend users and filter the admin users list by activation (#41227)
|
2026-06-29 11:26:34 +02:00 |
|
api
|
SECURITY: Stop exposing hidden tag names through category serializers [backport 2026.6]
|
2026-07-28 17:05:36 +02:00 |
|
examples
|
|
|
|
about_controller_spec.rb
|
FEATURE: Localizable /about page fields via its settings page (#41123)
|
2026-06-26 20:41:08 +08:00 |
|
anonymous_actions_controller_spec.rb
|
FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256)
|
2026-05-26 09:30:38 +02:00 |
|
application_controller_spec.rb
|
SECURITY: Prevent cache poisoning/XSS via color scheme cookies [backport 2026.6]
|
2026-07-28 17:05:36 +02:00 |
|
associate_accounts_controller_spec.rb
|
|
|
|
badges_controller_spec.rb
|
FEATURE: Add a granular API key scope to list badges (#41086)
|
2026-06-22 18:32:02 +02:00 |
|
bookmarks_controller_spec.rb
|
|
|
|
calendar_subscriptions_controller_spec.rb
|
FEATURE: Add calendar subscription URLs to user preferences (#38598)
|
2026-03-17 10:28:20 -03:00 |
|
categories_controller_spec.rb
|
SECURITY: Stop exposing hidden tag names through category serializers [backport 2026.6]
|
2026-07-28 17:05:36 +02:00 |
|
clicks_controller_spec.rb
|
SECURITY: Missing visibility check in click tracking endpoint (#41140)
|
2026-06-24 15:15:56 +10:00 |
|
composer_controller_spec.rb
|
SECURITY: Respect group member visibility for counts [backport 2026.6] (#41408)
|
2026-07-06 12:47:57 +08:00 |
|
composer_messages_controller_spec.rb
|
SECURITY: Duplicate lookup reveals restricted topic titles through canonicalized URLs [backport 2026.6]
|
2026-07-28 17:05:36 +02:00 |
|
crawler_hreflang_spec.rb
|
FIX: Use hyphens instead of underscores for hreflang tags (#39884)
|
2026-05-19 21:18:46 +08:00 |
|
default_headers_spec.rb
|
|
|
|
dev_mode_controller_spec.rb
|
|
|
|
directory_columns_controller_spec.rb
|
|
|
|
directory_items_controller_spec.rb
|
SECURITY: Private UserField value disclosure via directory_items order sort side-channel [backport 2026.6] (#41599)
|
2026-07-09 21:52:59 -05:00 |
|
discourse_id_controller_spec.rb
|
FIX: Revocation endpoint is blocked when login_required is enabled, preventing session invalidation (#37859)
|
2026-02-17 09:12:14 -05:00 |
|
do_not_disturb_controller_spec.rb
|
|
|
|
drafts_controller_spec.rb
|
FIX: Drafts/reviewables API returned 404 when acting on own resource (#39449)
|
2026-05-26 09:29:20 +02:00 |
|
edit_directory_columns_controller_spec.rb
|
|
|
|
email_controller_spec.rb
|
|
|
|
embed_controller_spec.rb
|
SECURITY: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing [backport 2026.6]
|
2026-07-31 22:01:41 +01:00 |
|
emojis_controller_spec.rb
|
FEATURE: Locale-specific emoji search aliases (#39089)
|
2026-04-06 14:08:46 -03:00 |
|
exceptions_controller_spec.rb
|
|
|
|
export_csv_controller_spec.rb
|
FIX: Suspicious login IPs bypass the moderator IP-visibility setting (#40154)
|
2026-05-22 13:22:32 +08:00 |
|
extra_locales_controller_spec.rb
|
|
|
|
finish_installation_controller_spec.rb
|
|
|
|
form_templates_controller_spec.rb
|
SECURITY: Scope form template endpoints to accessible categories
|
2026-05-19 00:26:04 +01:00 |
|
forums_controller_spec.rb
|
|
|
|
groups_controller_spec.rb
|
SECURITY: Shared-draft titles and excerpts leak through group post serialization [backport 2026.6]
|
2026-07-28 17:05:36 +02:00 |
|
hashtags_controller_spec.rb
|
|
|
|
highlightjs_controller_spec.rb
|
|
|
|
home_page_controller_spec.rb
|
FEATURE: Allow fallback home routes for crawlers for custom homepage sites (#41234)
|
2026-06-29 09:57:40 -04:00 |
|
inline_onebox_controller_spec.rb
|
SECURITY: Check topic visibility in Oneboxer even when categories match
|
2026-03-31 15:12:45 +01:00 |
|
invites_controller_spec.rb
|
FIX: Reject DiscourseConnect SSO payloads when secret is blank (#40830)
|
2026-06-12 15:17:16 +03:00 |
|
list_controller_spec.rb
|
SECURITY: Harden ListController top period query against SQL injection [backport 2026.6] (#41721)
|
2026-07-15 12:18:05 +08:00 |
|
metadata_controller_spec.rb
|
FEATURE: Accept shared files via the Web Share Target (#41030)
|
2026-06-18 17:35:09 -03:00 |
|
nested_topics_controller_spec.rb
|
DEV: route nested view through topic route (#40820)
|
2026-06-15 11:42:20 -05:00 |
|
net_http_header_spec.rb
|
|
|
|
net_http_timeout_spec.rb
|
|
|
|
noscript_escape_spec.rb
|
|
|
|
notifications_controller_spec.rb
|
|
|
|
offline_controller_spec.rb
|
|
|
|
omniauth_callbacks_controller_spec.rb
|
FEATURE: Allow HTML for OAuth error message (#41204)
|
2026-06-26 08:35:06 -05:00 |
|
onebox_controller_spec.rb
|
SECURITY: prevent hidden profile data leak via user onebox
|
2026-03-19 15:21:28 +00:00 |
|
permalinks_controller_spec.rb
|
|
|
|
post_action_users_controller_spec.rb
|
UX: Ignored users reactions/likes should not show up (#39672)
|
2026-05-11 15:32:29 -03:00 |
|
post_actions_controller_spec.rb
|
SECURITY: fix is_warning type coercion bypass in PostActionsController
|
2026-03-19 15:21:28 +00:00 |
|
post_localizations_controller_spec.rb
|
|
|
|
post_readers_controller_spec.rb
|
SECURITY: Missing post-level authorization allows whisper metadata disclosure
|
2026-03-31 15:12:45 +01:00 |
|
posts_controller_spec.rb
|
SECURITY: validate oEmbed provider_name against URL host in generic Onebox [backport 2026.6] (#42223)
|
2026-07-31 12:41:36 -05:00 |
|
presence_controller_spec.rb
|
|
|
|
published_pages_controller_spec.rb
|
SECURITY: Leakage of hidden tags to unauthorized users [backport 2026.6] (#42226)
|
2026-07-31 12:39:46 -05:00 |
|
push_notification_controller_spec.rb
|
|
|
|
qunit_controller_spec.rb
|
DEV: Cache AssetProcessor code in development (#38036)
|
2026-02-25 11:24:41 +00:00 |
|
reviewable_claimed_topics_controller_spec.rb
|
SECURITY: Require topic visibility for category group moderator actions
|
2026-05-19 00:26:04 +01:00 |
|
reviewable_notes_controller_spec.rb
|
SECURITY: scope reviewable notes to user-visible reviewables
|
2026-02-26 12:22:54 +00:00 |
|
reviewables_controller_spec.rb
|
SECURITY: Respect topic visibility in reviewable score serializer [backport 2026.6]
|
2026-07-28 17:05:36 +02:00 |
|
robots_txt_controller_spec.rb
|
|
|
|
safe_mode_controller_spec.rb
|
|
|
|
search_controller_spec.rb
|
SECURITY: Apply category tag visibility to full-text search [backport 2026.6] (#41671)
|
2026-07-13 15:53:31 -03:00 |
|
session_controller_spec.rb
|
FEATURE: Sign up with a one-time email code (#40909)
|
2026-06-23 11:30:18 -07:00 |
|
sidebar_sections_controller_spec.rb
|
FIX: raise 404 when sidebar section doesn't exist (#37675)
|
2026-02-10 15:47:49 +01:00 |
|
similar_topics_controller_spec.rb
|
|
|
|
site_controller_spec.rb
|
SECURITY: Anonymous sidebar serialization exposes descriptions of category-restricted tags [backport 2026.6]
|
2026-07-28 17:05:36 +02:00 |
|
sitemap_controller_spec.rb
|
|
|
|
slugs_controller_spec.rb
|
|
|
|
static_controller_spec.rb
|
FIX: Localize static topic pages … (#41260)
|
2026-06-29 21:34:17 +08:00 |
|
steps_controller_spec.rb
|
|
|
|
stylesheets_controller_spec.rb
|
DEV: Allow plugins to register admin-panel-specific CSS (#40345)
|
2026-05-28 11:03:38 +01:00 |
|
svg_sprite_controller_spec.rb
|
|
|
|
tag_groups_controller_spec.rb
|
FIX: Prevent tag group from saving if private + no group selected (#39599)
|
2026-04-29 12:10:45 +08:00 |
|
tag_localizations_controller_spec.rb
|
FIX: Clean localized tag names (#38488)
|
2026-03-12 12:54:50 +08:00 |
|
tags_controller_spec.rb
|
FIX: Ensure /tag/bad-slug/:id/edit routes to edit page (#41115)
|
2026-06-23 18:58:50 +08:00 |
|
theme_javascripts_controller_spec.rb
|
PERF: Move theme settings from js bundle to preload data (#40137)
|
2026-06-08 16:04:56 +01:00 |
|
topic_localizations_controller_spec.rb
|
|
|
|
topic_view_stats_controller_spec.rb
|
|
|
|
topics_controller_spec.rb
|
SECURITY: DoS vis uncapped Bulk Topic Actions [backport 2026.6] (#42002)
|
2026-07-23 23:07:22 +01:00 |
|
uploads_controller_multisite_spec.rb
|
FIX: Multisite prevent anons from downloading files (#37979)
|
2026-02-24 10:49:14 +10:00 |
|
uploads_controller_spec.rb
|
SECURITY: Regular users can route multipart uploads into the admin backup store
|
2026-06-30 16:10:52 +02:00 |
|
user_actions_controller_spec.rb
|
FIX: Prevent hidden excerpts in user actions (#40028)
|
2026-05-14 18:35:39 +05:30 |
|
user_api_key_clients_controller_spec.rb
|
FIX: Empty-scopes bypass allows untrusted client registration and downstream scope/redirect policy bypass (#37855)
|
2026-02-17 12:39:09 +11:00 |
|
user_api_keys_controller_spec.rb
|
Revert "FIX: Only allow OTPs to be generated from a browser session (#40964)" (#41875) (#41920)
|
2026-07-22 18:56:56 +03:00 |
|
user_avatars_controller_spec.rb
|
SECURITY: Improve SVG sanitization
|
2026-06-30 16:10:52 +02:00 |
|
user_badges_controller_spec.rb
|
SECURITY: Prevent badge lookup from exposing hidden profiles (#41160)
|
2026-06-25 13:01:03 +08:00 |
|
user_status_controller_spec.rb
|
FIX: Post serialization exposes hidden-profile user status messages (#40885)
|
2026-06-15 09:25:47 -05:00 |
|
users_controller_spec.rb
|
SECURITY: Prevent topic existence disclosure in profile featuring [backport 2026.6] (#42237)
|
2026-07-31 16:18:40 -03:00 |
|
users_email_controller_spec.rb
|
DEV: CSRF Token Not Invalidated After Password Reset (#40998)
|
2026-06-17 16:07:30 -04:00 |
|
webhooks_controller_spec.rb
|
SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks
|
2026-06-30 16:10:52 +02:00 |
|
wizard_controller_spec.rb
|
|
|
