0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
discourse/spec/services
discourse-patch-triage[bot] 1f1ded8dd3 SECURITY: Regular users can route multipart uploads into the admin backup store
## Summary

Applies security patch from triage.

## Security advisory

https://github.com/discourse/discourse/security/advisories/GHSA-3mvf-q9rg-w6m7

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1068
- Original commit:

---

🤖 Auto-generated from the patch diff via Patch Triage. Review carefully before merging.
2026-06-30 16:10:52 +02:00
..
admin/search FIX: Enforce can_see_ip checks across admin IP features (#40019) 2026-05-19 11:37:20 +08:00
admin_notices FEATURE: Add problem checks page to admin panel and allow ignoring problem checks (#39103) 2026-04-23 08:28:33 +08:00
categories FIX: Moderators can enable plugins when enable_category_type_setup SiteSetting is enabled (#40349) 2026-06-17 08:37:14 -05:00
category DEV: Refactor category hierarchical search (#37609) 2026-02-13 09:43:56 +01:00
discourse_id FEATURE: Discourse ID setting page (#36316) 2025-12-11 16:04:09 +01:00
email_login_code FEATURE: Sign up with a one-time email code (#40909) 2026-06-23 11:30:18 -07:00
flags
groups DEV: Add descriptive error message when creating requestable group with no owner (#40391) 2026-05-29 11:11:59 +08:00
nested_topic REVERT: "FEATURE: Topic timeline for nested replies view (#40125)" (#40202) 2026-05-20 13:20:46 -05:00
notification/action FEATURE: Notify admins of upcoming changes and log events (#37003) 2026-01-21 12:45:54 +10:00
notifications
problem_check SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks 2026-06-30 16:10:52 +02:00
site_setting UX: Allow more specific enabled for options for upcoming changes (#39916) 2026-05-13 10:22:06 +10:00
site_setting_localizations/about_config FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
tags SECURITY: Don't leak hidden tag names in one-per-topic conflict reasons (#41035) 2026-06-19 11:26:15 -03:00
themes FEATURE: Enable high context topic cards in Horizon by default (#39959) 2026-05-15 10:50:42 +10:00
upcoming_changes FIX: Do not send notifications for upcoming changes not displayed (#40933) 2026-06-17 09:10:49 +10:00
user FEATURE: Bulk suspend users and filter the admin users list by activation (#41227) 2026-06-29 11:26:34 +02:00
user_api_key FEATURE: User API key device authorization flow (#40189) 2026-06-10 16:09:44 -04:00
video_conversion PERF: Run primary and parallel DB setup concurrently in CI (#40319) 2026-05-29 06:46:32 +08:00
access_control_list_manager_spec.rb DEV: Add banned_acl concept to AccessControlList (#41254) 2026-06-29 16:22:30 +10:00
admin_dashboard_engagement_spec.rb FIX: Average daily engaged users KPI instead of summing the period (#40384) 2026-05-29 09:22:13 +08:00
admin_dashboard_highlights_spec.rb FIX: Average daily engaged users KPI instead of summing the period (#40384) 2026-05-29 09:22:13 +08:00
admin_dashboard_search_spec.rb FIX: Exclude anonymous searches from the dashboard search section (#40966) 2026-06-17 14:32:04 +08:00
admin_dashboard_section_configuration_spec.rb DEV: Remove admin_dashboard_search_section_enabled hidden site setting (#41016) 2026-06-18 15:03:25 +08:00
admin_dashboard_section_loader_spec.rb PERF: Parallelize section loading in new dashboard (#40970) 2026-06-17 16:29:10 +08:00
admin_dashboard_site_traffic_spec.rb FEATURE: Add direct traffic KPI to the Site Traffic dashboard (#41274) 2026-06-30 14:30:28 +08:00
anonymous_shadow_creator_spec.rb DEV: Rename anonymous group to anonymous_users (#40435) 2026-06-02 09:29:46 +10:00
auto_silence_spec.rb FIX: Moderator notifications when new post auto-silences a user (#35403) 2025-10-15 16:07:56 +08:00
badge_granter_spec.rb DEV: Automatically detect and revert translation overrides in specs (#40003) 2026-05-13 22:09:23 +02:00
base_bookmarkable_spec.rb
category_hashtag_data_source_spec.rb FIX: Use unaccent() for category name/slug search (#37622) 2026-02-12 08:43:23 +01:00
color_scheme_revisor_spec.rb
destroy_task_spec.rb
email_settings_exception_handler_spec.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
email_settings_validator_spec.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
email_style_updater_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
external_upload_manager_spec.rb SECURITY: Regular users can route multipart uploads into the admin backup store 2026-06-30 16:10:52 +02:00
flag_sockpuppets_spec.rb
group_action_logger_spec.rb PERF: Add Users to Group Improvements Pt. 2 (#38901) 2026-04-06 09:31:50 -05:00
group_mentions_updater_spec.rb FIX: Sync category description when post content changes outside PostRevisor (#39184) 2026-05-11 16:13:23 +02:00
group_message_spec.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
hashtag_autocomplete_service_spec.rb DEV: Move canonical tag routes to /tag/slug/id keeping /tag/name support (#37055) 2026-02-11 10:21:19 +08:00
heat_settings_updater_spec.rb
hub_push_notification_pusher_spec.rb DEV: Centralize push notification delivery into a single job (#39207) 2026-04-14 11:55:45 -03:00
inline_uploads_multisite_spec.rb
inline_uploads_spec.rb FIX: Prevent backslash accumulation in upload markdown labels (#39461) 2026-06-03 18:10:38 +02:00
locale_normalizer_spec.rb
notification_emailer_spec.rb FIX: Send notification emails for staff-coloured posts (#37712) 2026-02-11 13:26:27 +01:00
post_action_notifier_spec.rb
post_alerter_spec.rb SECURITY: Replying to a whisper lets non-whisperers create staff-only whisper posts 2026-05-19 00:26:04 +01:00
post_bookmarkable_spec.rb
post_owner_changer_spec.rb SECURITY: Ensure moderator can see post/topic before allowing them to change owner 2026-01-28 17:11:14 +00:00
problem_check_spec.rb FIX: Allow only sanitized strings in admin notices (#39796) 2026-05-06 13:40:20 -04:00
push_notification_pusher_spec.rb FIX: Clean up push subscriptions whose endpoint domain no longer resolves (#39804) 2026-05-06 14:37:58 -03:00
random_topic_selector_spec.rb
search_indexer_spec.rb FEATURE: Add full-text search for chat messages (#34704) 2025-10-22 11:30:35 +02:00
sidebar_site_settings_backfiller_spec.rb
site_settings_spec.rb FIX: Reject DiscourseConnect SSO payloads when secret is blank (#40830) 2026-06-12 15:17:16 +03:00
staff_action_logger_spec.rb FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
tag_hashtag_data_source_spec.rb FIX: Tag search 500 when content_localization is enabled (#37769) 2026-02-12 23:58:03 +08:00
tag_settings_updater_spec.rb FIX: Clean localized tag names (#38488) 2026-03-12 12:54:50 +08:00
theme_settings_migrations_runner_spec.rb DEV: Add category helper for theme migration (#38816) 2026-03-24 16:50:37 +08:00
themes_spec.rb
topic_bookmarkable_spec.rb
topic_status_updater_spec.rb FEATURE: Exclude small actions from topic counters and unread tracking (#40481) 2026-06-08 08:03:55 +02:00
topic_timestamp_changer_spec.rb
trust_level_granter_spec.rb
user_activator_spec.rb DEV: Change authenticated_with_oauth to use key instead of string. (#38381) 2026-03-10 18:31:32 -03:00
user_anonymizer_spec.rb FIX: Block associated account emails on user delete and anonymize (#37638) 2026-02-09 18:26:35 +01:00
user_authenticator_spec.rb
user_destroyer_spec.rb FIX: Resolve all of a deleted spammer's reviewables (#40780) 2026-06-15 13:34:15 +08:00
user_merger_spec.rb FIX: blocks post action merge for duplicated flags (#36265) 2025-11-26 16:17:57 -03:00
user_notification_schedule_processor_spec.rb
user_password_expirer_spec.rb
user_silencer_spec.rb FIX: Prevent moderators from being auto-silenced (#39709) 2026-05-05 14:54:46 +08:00
user_stat_count_updater_spec.rb
user_suspender_spec.rb FEATURE: Link staff action log entries to originating reviewable (#39519) 2026-04-30 09:15:45 +08:00
user_updater_spec.rb FIX: Reject DiscourseConnect SSO payloads when secret is blank (#40830) 2026-06-12 15:17:16 +03:00
username_changer_spec.rb FIX: Preserve display name in quotes when using the rich text editor (#38078) 2026-02-26 21:04:07 +01:00
username_checker_service_spec.rb
wildcard_domain_checker_spec.rb
wildcard_url_checker_spec.rb DEV: Fix auth redirect validation in user API key flow (#40459) 2026-06-01 15:47:35 -04:00
word_watcher_spec.rb FIX: Watched word with invalid regex crashes markdown cook (#40107) 2026-05-18 16:04:20 +08:00