Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-05 13:59:03 +08:00
Code Packages Activity Actions
discourse/spec
History
Exact
discourse-patch-triage[bot] 1f1ded8dd3 SECURITY: Regular users can route multipart uploads into the admin backup store 
## Summary

Applies security patch from triage.

## Security advisory

https://github.com/discourse/discourse/security/advisories/GHSA-3mvf-q9rg-w6m7

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1068
- Original commit:

---

🤖 Auto-generated from the patch diff via Patch Triage. Review carefully before merging.
2026-06-30 16:10:52 +02:00
..
db FIX: Prevent backslash accumulation in upload markdown labels (#39461) 2026-06-03 18:10:38 +02:00
fabricators FEATURE: Access control list UI and backend (#41009) 2026-06-29 09:44:58 +10:00
fixtures DEV: Allow plugins to register admin-panel-specific CSS (#40345) 2026-05-28 11:03:38 +01:00
generator DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
helpers DEV: Track beacon browser pageviews behind dashboard_improvements (#40934) 2026-06-23 10:21:39 +08:00
import_export DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
initializers SECURITY: Harden imagemagick execution 2026-06-30 16:10:52 +02:00
integration FIX: Gate MessageBus groups when closing topic (#40913) 2026-06-15 15:27:07 -05:00
integrity DEV: Add hide_settings metadata to upcoming changes framework (#40990) 2026-06-19 10:25:39 +04:00
jobs SECURITY: Authorize secure-upload hotlink downloads against post user 2026-06-30 16:10:52 +02:00
lib SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks 2026-06-30 16:10:52 +02:00
mailers FIX: allow custom email sender name via translation overrides (#40674) 2026-06-09 14:03:03 +04:00
migrations FIX: Ensure each flag gets a unique name_key (#40899) 2026-06-24 16:37:59 +02:00
models SECURITY: Signup-time primary_group_id assignment grants whisperer access 2026-06-30 16:10:52 +02:00
multisite DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
queries/reports FEATURE: Activity by category section of the new dashboard's engagement section (#40227) 2026-05-22 13:10:38 +08:00
requests SECURITY: Regular users can route multipart uploads into the admin backup store 2026-06-30 16:10:52 +02:00
script DEV: Automatic upcoming change status report and PR creation (#40291) 2026-06-11 15:19:15 +10:00
serializers DEV: Add banned_acl concept to AccessControlList (#41254) 2026-06-29 16:22:30 +10:00
services SECURITY: Regular users can route multipart uploads into the admin backup store 2026-06-30 16:10:52 +02:00
support FEATURE: Show theme d-compat/* refs in admin UI (#40649) 2026-06-17 22:13:45 +01:00
system FEATURE: Add direct traffic KPI to the Site Traffic dashboard (#41274) 2026-06-30 14:30:28 +08:00
tasks DEV: better multisite suppport for migrate gifs (#40792) 2026-06-11 17:51:27 +04:00
views FIX: remove ItemList schema from linkbacks in crawler view (#36608) 2025-12-11 10:41:47 +01:00
rails_helper.rb DEV: Block external requests in system specs via Chrome DNS resolver (#40685) 2026-06-17 12:29:57 +01:00
regenerate_swagger_docs DEV: Add API docs for uploads and API doc watcher (#15387) 2021-12-23 08:40:15 +10:00
swagger_helper.rb DEV: add api docs for discourse-calendar events index endpoint (#35400) 2025-10-16 07:39:08 +08:00