Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 07:23:30 +08:00
Code Packages Activity Actions
discourse/spec/requests/admin
History
Exact
Isaac Janzen 2c8063e078
 FIX: Moderator Can Modify Trust Level of Admin and Staff Accounts (#41992) 
## Summary

Prevent moderators from modifying the trust levels of admin and staff
accounts by enforcing a non-staff target check in the authorization
logic. This ensures that the permission for moderators to manage trust
levels is correctly restricted to non-staff users, protecting staff
accounts from unauthorized demotion or modification.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1168

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-30 10:16:11 -05:00
..
config FIX: Restrict upcoming-changes toggle to registered upcoming-change settings (#42175) 2026-07-30 09:28:04 -05:00
admin_controller_spec.rb
api_controller_spec.rb DEV: Replace Ruby numbered parameters by it where applicable (#37810) 2026-02-13 13:59:07 +01:00
backups_controller_spec.rb FIX: Validate resumableFilename in check_backup_chunk to prevent path traversa... (#42098) 2026-07-28 11:18:14 -05:00
badges_controller_spec.rb FEATURE: Add a granular API key scope to list badges (#41086) 2026-06-22 18:32:02 +02:00
color_schemes_controller_spec.rb
dashboard_controller_spec.rb DEV: Promote dashboard_improvements upcoming change to beta (#42116) 2026-07-29 12:09:26 +08:00
email_controller_spec.rb DEV: Fix job serialization deprecation in email controller (#39311) 2026-04-16 11:42:34 +02:00
email_logs_controller_spec.rb
email_styles_controller_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
email_templates_controller_spec.rb DEV: Remove unnecessary TranslationOverride.delete_all in specs (#40131) 2026-05-19 15:08:24 +02:00
embeddable_hosts_controller_spec.rb DEV: Expand top_tags, topic.tags, etc, to return an array of tag objects instead of tag names (#36678) 2026-02-02 10:03:02 +08:00
embedding_controller_spec.rb
emojis_controller_spec.rb UX: Better admin emoji page sorting & filtering and service refactors (#41892) 2026-07-24 12:01:21 +10:00
form_templates_controller_spec.rb FIX: Form templates page returning 500 error (#39799) 2026-05-06 18:53:52 +02:00
groups_controller_spec.rb UX: Normalize automatic membership email domains (#41434) 2026-07-03 17:22:18 +02:00
impersonate_controller_spec.rb FEATURE: Impersonation countdown (#39871) 2026-05-12 12:12:25 +08:00
onboarding_events_controller_spec.rb FEATURE: Log staff actions for admin onboarding panel steps (#42032) 2026-07-24 14:43:01 -07:00
permalinks_controller_spec.rb
plugins_controller_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
problem_checks_controller_spec.rb FEATURE: Add problem checks page to admin panel and allow ignoring problem checks (#39103) 2026-04-23 08:28:33 +08:00
reports_controller_spec.rb DEV: Remove reporting_improvements upcoming change (#41259) 2026-07-01 07:52:02 +08:00
robots_txt_controller_spec.rb FIX: Log changes to robots.txt by admins (#37901) 2026-02-18 14:20:21 -05:00
screened_emails_controller_spec.rb FIX: Screened email list exposes IP addresses to moderators without IP-view permission (#39875) 2026-05-11 14:47:17 +08:00
screened_ip_addresses_controller_spec.rb DEV: Require admin for allow_admin screened IP mutations (#38545) 2026-03-12 10:43:19 -07:00
screened_urls_controller_spec.rb
search_controller_spec.rb DEV: Refactor admin search index into a service (#38959) 2026-04-01 10:09:10 +10:00
search_logs_spec.rb UX: Focus dashboard search analytics on member searches (#41647) 2026-07-13 12:41:19 +08:00
site_settings_controller_spec.rb UX: Link to required settings from language switcher validation error (#38374) 2026-07-16 15:51:06 -04:00
site_texts_controller_spec.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
staff_action_logs_controller_spec.rb FEATURE: add bootstrap first admin job (#39851) 2026-05-08 16:16:18 -03:00
themes_controller_spec.rb DEV: Improve handling of private theme installs (#41845) 2026-07-24 13:42:41 -04:00
unknown_reviewables_controller_spec.rb
user_fields_controller_spec.rb DEV: add input=date type to custom user field options (#37902) 2026-02-19 07:04:52 +01:00
users_controller_spec.rb FIX: Moderator Can Modify Trust Level of Admin and Staff Accounts (#41992) 2026-07-30 10:16:11 -05:00
versions_controller_spec.rb
watched_words_controller_spec.rb DEV: Don't rely on ObjectSpace in a watched words spec (#39717) 2026-05-05 12:21:41 +02:00
web_hooks_controller_spec.rb FIX: Allow selecting tags when creating or editing webhooks (#37942) 2026-02-20 23:00:50 +08:00