0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
discourse/app
discoursebot 030e1e3473
SECURITY: Prevent topic existence disclosure in profile featuring [backport 2026.7] (#42236)
Backport of #42235 to release/2026.7.

---

Previously, the profile feature-topic endpoint returned different
responses for missing topics and existing topics the requester could not
access, revealing whether a topic record existed.

This change checks topic visibility before feature eligibility,
returning a not-found response for both missing and inaccessible topics.

Relates to this patch: https://patch.discourse.org/patch-triage/1350

Co-authored-by: Gabriel Grubba <gabriel@discourse.org>
2026-07-31 16:14:37 -03:00
..
assets FIX: Chat browse page on mobile [backport 2026.7] (#42148) 2026-07-31 10:26:24 +10:00
controllers SECURITY: Prevent topic existence disclosure in profile featuring [backport 2026.7] (#42236) 2026-07-31 16:14:37 -03:00
helpers SECURITY: Prevent cache poisoning/XSS via color scheme cookies 2026-07-28 16:40:22 +02:00
jobs PERF: Serve the activity_by_category report from daily rollups (#42046) 2026-07-28 12:53:29 +08:00
mailers FEATURE: Log in with a one-time email code (#40804) 2026-06-17 12:34:48 -07:00
models SECURITY: Stop exposing hidden tag names through category serializers 2026-07-28 16:40:22 +02:00
queries/reports DEV: Remove reporting_improvements upcoming change (#41259) 2026-07-01 07:52:02 +08:00
serializers SECURITY: Stop exposing hidden tag names through category serializers 2026-07-28 16:40:22 +02:00
services SECURITY: Stop exposing hidden tag names through category serializers 2026-07-28 16:40:22 +02:00
views PERF: Avoid HTML escaping preloaded JSON (#41978) 2026-07-24 09:25:06 +08:00