Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/spec/services
History
Exact
discoursebot fceb3b9f63
 SECURITY: Stale featured rows expose unlisted topic content [backport 2026.6] (#41811) 
Backport of #41810 to release/2026.6.

---

## Summary

Prevent the exposure of unlisted topic metadata in the categories
response by enforcing live visibility checks on featured topics.
Additionally, the UserSilencer service now correctly removes featured
topic records when bulk-hiding topics from new users, ensuring stale
records do not bypass visibility constraints.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1427

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Bannon Tanner <bannon@discourse.org>
2026-07-17 09:38:33 -05:00
..
admin/search FIX: Enforce can_see_ip checks across admin IP features (#40019) 2026-05-19 11:37:20 +08:00
admin_notices FEATURE: Add problem checks page to admin panel and allow ignoring problem checks (#39103) 2026-04-23 08:28:33 +08:00
categories FIX: Moderators can enable plugins when enable_category_type_setup SiteSetting is enabled (#40349) 2026-06-17 08:37:14 -05:00
category DEV: Refactor category hierarchical search (#37609) 2026-02-13 09:43:56 +01:00
discourse_id FEATURE: Discourse ID setting page (#36316) 2025-12-11 16:04:09 +01:00
email_login_code FEATURE: Sign up with a one-time email code (#40909) 2026-06-23 11:30:18 -07:00
flags
groups DEV: Add descriptive error message when creating requestable group with no owner (#40391) 2026-05-29 11:11:59 +08:00
nested_topic REVERT: "FEATURE: Topic timeline for nested replies view (#40125)" (#40202) 2026-05-20 13:20:46 -05:00
notification/action FEATURE: Notify admins of upcoming changes and log events (#37003) 2026-01-21 12:45:54 +10:00
notifications
problem_check SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks 2026-06-30 16:10:52 +02:00
site_setting UX: Allow more specific enabled for options for upcoming changes (#39916) 2026-05-13 10:22:06 +10:00
site_setting_localizations/about_config FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
tags SECURITY: Don't leak hidden tag names in one-per-topic conflict reasons (#41035) 2026-06-19 11:26:15 -03:00
themes FEATURE: Enable high context topic cards in Horizon by default (#39959) 2026-05-15 10:50:42 +10:00
upcoming_changes FIX: Do not send notifications for upcoming changes not displayed (#40933) 2026-06-17 09:10:49 +10:00
user FEATURE: Bulk suspend users and filter the admin users list by activation (#41227) 2026-06-29 11:26:34 +02:00
user_api_key FEATURE: User API key device authorization flow (#40189) 2026-06-10 16:09:44 -04:00
video_conversion PERF: Run primary and parallel DB setup concurrently in CI (#40319) 2026-05-29 06:46:32 +08:00
access_control_list_manager_spec.rb DEV: Add banned_acl concept to AccessControlList (#41254) 2026-06-29 16:22:30 +10:00
admin_dashboard_engagement_spec.rb FIX: Average daily engaged users KPI instead of summing the period (#40384) 2026-05-29 09:22:13 +08:00
admin_dashboard_highlights_spec.rb FIX: Average daily engaged users KPI instead of summing the period (#40384) 2026-05-29 09:22:13 +08:00
admin_dashboard_search_spec.rb FIX: Exclude anonymous searches from the dashboard search section (#40966) 2026-06-17 14:32:04 +08:00
admin_dashboard_section_configuration_spec.rb DEV: Remove admin_dashboard_search_section_enabled hidden site setting (#41016) 2026-06-18 15:03:25 +08:00
admin_dashboard_section_loader_spec.rb PERF: Parallelize section loading in new dashboard (#40970) 2026-06-17 16:29:10 +08:00
admin_dashboard_site_traffic_spec.rb FEATURE: Add direct traffic KPI to the Site Traffic dashboard (#41274) 2026-06-30 14:30:28 +08:00
anonymous_shadow_creator_spec.rb DEV: Rename anonymous group to anonymous_users (#40435) 2026-06-02 09:29:46 +10:00
auto_silence_spec.rb
badge_granter_spec.rb DEV: Automatically detect and revert translation overrides in specs (#40003) 2026-05-13 22:09:23 +02:00
base_bookmarkable_spec.rb
category_hashtag_data_source_spec.rb FIX: Use unaccent() for category name/slug search (#37622) 2026-02-12 08:43:23 +01:00
color_scheme_revisor_spec.rb
destroy_task_spec.rb
email_settings_exception_handler_spec.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
email_settings_validator_spec.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
email_style_updater_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
external_upload_manager_spec.rb SECURITY: Regular users can route multipart uploads into the admin backup store 2026-06-30 16:10:52 +02:00
flag_sockpuppets_spec.rb
group_action_logger_spec.rb PERF: Add Users to Group Improvements Pt. 2 (#38901) 2026-04-06 09:31:50 -05:00
group_mentions_updater_spec.rb FIX: Sync category description when post content changes outside PostRevisor (#39184) 2026-05-11 16:13:23 +02:00
group_message_spec.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
hashtag_autocomplete_service_spec.rb DEV: Move canonical tag routes to /tag/slug/id keeping /tag/name support (#37055) 2026-02-11 10:21:19 +08:00
heat_settings_updater_spec.rb
hub_push_notification_pusher_spec.rb DEV: Centralize push notification delivery into a single job (#39207) 2026-04-14 11:55:45 -03:00
inline_uploads_multisite_spec.rb
inline_uploads_spec.rb FIX: Prevent backslash accumulation in upload markdown labels (#39461) 2026-06-03 18:10:38 +02:00
locale_normalizer_spec.rb
notification_emailer_spec.rb FIX: Send notification emails for staff-coloured posts (#37712) 2026-02-11 13:26:27 +01:00
post_action_notifier_spec.rb
post_alerter_spec.rb SECURITY: Replying to a whisper lets non-whisperers create staff-only whisper posts 2026-05-19 00:26:04 +01:00
post_bookmarkable_spec.rb
post_owner_changer_spec.rb SECURITY: Ensure moderator can see post/topic before allowing them to change owner 2026-01-28 17:11:14 +00:00
problem_check_spec.rb FIX: Allow only sanitized strings in admin notices (#39796) 2026-05-06 13:40:20 -04:00
push_notification_pusher_spec.rb FIX: Clean up push subscriptions whose endpoint domain no longer resolves (#39804) 2026-05-06 14:37:58 -03:00
random_topic_selector_spec.rb
search_indexer_spec.rb
sidebar_site_settings_backfiller_spec.rb
site_settings_spec.rb FIX: Reject DiscourseConnect SSO payloads when secret is blank (#40830) 2026-06-12 15:17:16 +03:00
staff_action_logger_spec.rb FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
tag_hashtag_data_source_spec.rb FIX: Tag search 500 when content_localization is enabled (#37769) 2026-02-12 23:58:03 +08:00
tag_settings_updater_spec.rb FIX: Clean localized tag names (#38488) 2026-03-12 12:54:50 +08:00
theme_settings_migrations_runner_spec.rb DEV: Add category helper for theme migration (#38816) 2026-03-24 16:50:37 +08:00
themes_spec.rb
topic_bookmarkable_spec.rb
topic_status_updater_spec.rb FEATURE: Exclude small actions from topic counters and unread tracking (#40481) 2026-06-08 08:03:55 +02:00
topic_timestamp_changer_spec.rb
trust_level_granter_spec.rb
user_activator_spec.rb DEV: Change authenticated_with_oauth to use key instead of string. (#38381) 2026-03-10 18:31:32 -03:00
user_anonymizer_spec.rb FIX: Block associated account emails on user delete and anonymize (#37638) 2026-02-09 18:26:35 +01:00
user_authenticator_spec.rb
user_destroyer_spec.rb FIX: Resolve all of a deleted spammer's reviewables (#40780) 2026-06-15 13:34:15 +08:00
user_merger_spec.rb FIX: blocks post action merge for duplicated flags (#36265) 2025-11-26 16:17:57 -03:00
user_notification_schedule_processor_spec.rb
user_password_expirer_spec.rb
user_silencer_spec.rb SECURITY: Stale featured rows expose unlisted topic content [backport 2026.6] (#41811) 2026-07-17 09:38:33 -05:00
user_stat_count_updater_spec.rb
user_suspender_spec.rb FEATURE: Link staff action log entries to originating reviewable (#39519) 2026-04-30 09:15:45 +08:00
user_updater_spec.rb FIX: Reject DiscourseConnect SSO payloads when secret is blank (#40830) 2026-06-12 15:17:16 +03:00
username_changer_spec.rb FIX: Preserve display name in quotes when using the rich text editor (#38078) 2026-02-26 21:04:07 +01:00
username_checker_service_spec.rb
wildcard_domain_checker_spec.rb
wildcard_url_checker_spec.rb DEV: Fix auth redirect validation in user API key flow (#40459) 2026-06-01 15:47:35 -04:00
word_watcher_spec.rb FIX: Watched word with invalid regex crashes markdown cook (#40107) 2026-05-18 16:04:20 +08:00