Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-07 13:19:19 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-calendar/app
History
Exact
discoursebot db94300baf
 SECURITY: Remove stale invitee access for users removed from invited groups on private events [backport 2026.7] (#42190) 
Backport of #42187 to release/2026.7.

---

## Summary

Correctly restrict private calendar event access to current group
members. The patch replaces stale invitee-row authorization with active
invited-group membership checks across event detail serialization,
attendance searches, RSVP mutations, and livestream chat metadata, and
prunes stale invitee records when a user is removed from a group.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1377

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Chris Alberti <christo@discourse.org>
2026-07-31 15:19:51 -05:00
..
controllers FEATURE: render links to event topics as interactive cards (#40953) 2026-07-17 10:36:54 -04:00
models SECURITY: Remove stale invitee access for users removed from invited groups on private events [backport 2026.7] (#42190) 2026-07-31 15:19:51 -05:00
serializers SECURITY: Remove stale invitee access for users removed from invited groups on private events [backport 2026.7] (#42190) 2026-07-31 15:19:51 -05:00
services SECURITY: Private event invitee details leak through invitees list endpoint [backport 2026.7] (#42111) 2026-07-29 10:32:01 -05:00
views/discourse_post_event/events FIX: Treat all-day calendar events as date-only (#41203) 2026-06-29 11:30:38 +02:00