| .. |
|
admin
|
FEATURE: Log staff actions for admin onboarding panel steps (#42032)
|
2026-07-24 14:43:01 -07:00 |
|
users
|
FEATURE: Allow HTML for OAuth error message (#41204)
|
2026-06-26 08:35:06 -05:00 |
|
about_controller.rb
|
FEATURE: Localizable /about page fields via its settings page (#41123)
|
2026-06-26 20:41:08 +08:00 |
|
access_control_lists_controller.rb
|
FEATURE: Support users in DAccessControl and backend (#41358)
|
2026-07-15 09:18:06 +10:00 |
|
anonymous_actions_controller.rb
|
FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256)
|
2026-05-26 09:30:38 +02:00 |
|
application_controller.rb
|
DEV: Serialize dashboard sections for flamegraph profiling (#41897)
|
2026-07-23 07:49:58 +08:00 |
|
associated_groups_controller.rb
|
|
|
|
badges_controller.rb
|
FIX: Non-listable and disabled badges exposed via XHR JSON requests (#37869)
|
2026-02-17 16:17:01 +11:00 |
|
bookmarks_controller.rb
|
|
|
|
calendar_subscriptions_controller.rb
|
FEATURE: Add calendar subscription URLs to user preferences (#38598)
|
2026-03-17 10:28:20 -03:00 |
|
categories_controller.rb
|
SECURITY: Stop exposing hidden tag names through category serializers
|
2026-07-28 16:40:22 +02:00 |
|
clicks_controller.rb
|
SECURITY: Missing visibility check in click tracking endpoint (#41140)
|
2026-06-24 15:15:56 +10:00 |
|
composer_controller.rb
|
SECURITY: Respect group member visibility for counts (#41403)
|
2026-07-06 12:48:06 +08:00 |
|
composer_messages_controller.rb
|
SECURITY: Whisper metadata disclosure via stale TopicLinks (#41139)
|
2026-06-24 14:44:27 +10:00 |
|
dev_mode_controller.rb
|
DEV: Add /dev-mode endpoint for MiniProfiler auth cookie (#37027)
|
2026-01-12 10:01:20 +08:00 |
|
directory_columns_controller.rb
|
|
|
|
directory_items_controller.rb
|
SECURITY: Private UserField value disclosure via directory_items order sort side-channel (#41598)
|
2026-07-09 21:52:51 -05:00 |
|
do_not_disturb_controller.rb
|
|
|
|
drafts_controller.rb
|
FIX: Drafts/reviewables API returned 404 when acting on own resource (#39449)
|
2026-05-26 09:29:20 +02:00 |
|
edit_directory_columns_controller.rb
|
DEV: Enable Style/RedundantParentheses rubocop rule (#40095)
|
2026-05-19 15:48:09 +02:00 |
|
email_controller.rb
|
|
|
|
embed_controller.rb
|
FIX: Add visibility check to Embed info (#40896)
|
2026-06-15 10:20:56 -05:00 |
|
emojis_controller.rb
|
FEATURE: Add emoji_picker_pinned_groups for pinning groups in the picker (#41881)
|
2026-07-22 09:51:15 -07:00 |
|
exceptions_controller.rb
|
|
|
|
export_csv_controller.rb
|
DEV: Enable Style/RedundantParentheses rubocop rule (#40095)
|
2026-05-19 15:48:09 +02:00 |
|
extra_locales_controller.rb
|
DEV: Refactor locale bundle loading (#37114)
|
2026-01-16 11:45:14 +00:00 |
|
finish_installation_controller.rb
|
DEV: Enable Style/RedundantBegin rubocop rule (#40096)
|
2026-05-19 18:44:54 +02:00 |
|
form_templates_controller.rb
|
SECURITY: Scope form template endpoints to accessible categories
|
2026-05-19 00:26:04 +01:00 |
|
forums_controller.rb
|
|
|
|
gifs_controller.rb
|
FIX: move klipy gifs request to backend (#41540)
|
2026-07-08 17:18:42 +04:00 |
|
groups_controller.rb
|
FIX: Make auto pseudogroups visible to logged on users (#41498)
|
2026-07-08 09:28:18 +10:00 |
|
hashtags_controller.rb
|
|
|
|
highlight_js_controller.rb
|
|
|
|
home_page_controller.rb
|
|
|
|
inline_onebox_controller.rb
|
|
|
|
invites_controller.rb
|
FIX: Allow logged-in users to redeem invites when new registrations are disabled (#42026)
|
2026-07-25 17:02:30 +02:00 |
|
list_controller.rb
|
FEATURE: explicit default homepage setting (#41785)
|
2026-07-22 16:22:19 -04:00 |
|
metadata_controller.rb
|
FEATURE: Accept shared files via the Web Share Target (#41030)
|
2026-06-18 17:35:09 -03:00 |
|
nested_topics_controller.rb
|
DEV: route nested view through topic route (#40820)
|
2026-06-15 11:42:20 -05:00 |
|
new_invite_controller.rb
|
|
|
|
new_topic_controller.rb
|
|
|
|
notifications_controller.rb
|
FIX: Hide badge notifications for disabled badges or when badges are disabled (#36987)
|
2026-01-07 15:28:43 +08:00 |
|
offline_controller.rb
|
|
|
|
onebox_controller.rb
|
|
|
|
permalinks_controller.rb
|
SECURITY: prevent permalink redirects from leaking restricted slugs
|
2026-01-28 17:11:14 +00:00 |
|
post_action_users_controller.rb
|
UX: Ignored users reactions/likes should not show up (#39672)
|
2026-05-11 15:32:29 -03:00 |
|
post_actions_controller.rb
|
SECURITY: fix is_warning type coercion bypass in PostActionsController
|
2026-03-19 15:21:28 +00:00 |
|
post_localizations_controller.rb
|
UX: Allow user to set post and topic title language when manually creating post translations in modal (#41734)
|
2026-07-16 10:43:39 +08:00 |
|
post_readers_controller.rb
|
SECURITY: Missing post-level authorization allows whisper metadata disclosure
|
2026-03-31 15:12:45 +01:00 |
|
posts_controller.rb
|
SECURITY: PostsController#raw_email leaks raw emails of inaccessible to mods (#41962)
|
2026-07-23 16:33:33 +10:00 |
|
presence_controller.rb
|
|
|
|
published_pages_controller.rb
|
FIX: ensures only staff can check slugs (#37846)
|
2026-02-16 18:23:46 +01:00 |
|
push_notification_controller.rb
|
|
|
|
qunit_controller.rb
|
DEV: Rename EmberCli to EmberAssets (#40938)
|
2026-06-16 12:56:56 +02:00 |
|
reviewable_claimed_topics_controller.rb
|
DEV: Convert ReviewableClaimedTopicsController#destroy response from 403 to 404 (#38339)
|
2026-03-06 15:39:51 -06:00 |
|
reviewable_notes_controller.rb
|
SECURITY: scope reviewable notes to user-visible reviewables
|
2026-02-26 12:22:54 +00:00 |
|
reviewables_controller.rb
|
FIX: Drafts/reviewables API returned 404 when acting on own resource (#39449)
|
2026-05-26 09:29:20 +02:00 |
|
robots_txt_controller.rb
|
DEV: Replace JS build system with Rolldown (#35963)
|
2026-05-29 11:11:55 +01:00 |
|
safe_mode_controller.rb
|
|
|
|
search_controller.rb
|
FIX: exclude 't' shortcut from min length bypass (#37440)
|
2026-02-05 06:58:19 +11:00 |
|
session_controller.rb
|
UX: Improve password manager and full name handling in code login (#41746)
|
2026-07-15 10:43:03 -07:00 |
|
sidebar_sections_controller.rb
|
FIX: Allow manual Community sidebar links to be localized (#41898)
|
2026-07-22 15:57:56 +08:00 |
|
similar_topics_controller.rb
|
FEATURE: First iteration of nested replies (#38888)
|
2026-04-16 08:06:44 -05:00 |
|
site_controller.rb
|
|
|
|
sitemap_controller.rb
|
|
|
|
slugs_controller.rb
|
|
|
|
static_controller.rb
|
FIX: Localize static topic pages … (#41260)
|
2026-06-29 21:34:17 +08:00 |
|
steps_controller.rb
|
|
|
|
stylesheets_controller.rb
|
PERF: Only recompile stylesheets when required (#41735)
|
2026-07-16 12:14:28 +01:00 |
|
svg_sprite_controller.rb
|
DEV: Enable Style/RedundantParentheses rubocop rule (#40095)
|
2026-05-19 15:48:09 +02:00 |
|
tag_groups_controller.rb
|
FIX: Failed updates in tag group controller would be logged (#38333)
|
2026-03-06 17:11:12 -03:00 |
|
tag_localizations_controller.rb
|
FEATURE: Introduce tag localizations with API, without UI yet (#36754)
|
2025-12-18 18:25:58 +08:00 |
|
tag_param_limit.rb
|
SECURITY: Reject too many tags during post creation (#41395)
|
2026-07-03 14:40:27 +08:00 |
|
tags_controller.rb
|
FIX: Allow selecting tags that are only used in personal messages (#41918)
|
2026-07-24 12:27:03 +02:00 |
|
test_requests_controller.rb
|
|
|
|
theme_javascripts_controller.rb
|
DEV: Enable Rails/FilePath rubocop rule (#40097)
|
2026-05-19 19:07:54 +02:00 |
|
topic_localizations_controller.rb
|
UX: Allow user to set post and topic title language when manually creating post translations in modal (#41734)
|
2026-07-16 10:43:39 +08:00 |
|
topic_view_stats_controller.rb
|
|
|
|
topics_controller.rb
|
FIX: Allow selecting tags that are only used in personal messages (#41918)
|
2026-07-24 12:27:03 +02:00 |
|
uploads_controller.rb
|
FIX: Serve inline-safe uploads inline on the local file store (#40739)
|
2026-07-14 18:52:35 +01:00 |
|
user_actions_controller.rb
|
SECURITY: Enforce Guardian checks in UserActionsController#show
|
2026-03-19 15:21:28 +00:00 |
|
user_api_key_clients_controller.rb
|
FIX: Empty-scopes bypass allows untrusted client registration and downstream scope/redirect policy bypass (#37855)
|
2026-02-17 12:39:09 +11:00 |
|
user_api_keys_controller.rb
|
Revert "FIX: Only allow OTPs to be generated from a browser session (#40964)" (#41875)
|
2026-07-22 18:18:02 +03:00 |
|
user_avatars_controller.rb
|
SECURITY: Improve SVG sanitization
|
2026-06-30 16:10:52 +02:00 |
|
user_badges_controller.rb
|
SECURITY: Prevent badge lookup from exposing hidden profiles (#41160)
|
2026-06-25 13:01:03 +08:00 |
|
user_status_controller.rb
|
|
|
|
users_controller.rb
|
SECURITY: An unauthorized user can delete emails of other users including Admins (#41927)
|
2026-07-22 12:16:59 -05:00 |
|
users_email_controller.rb
|
FIX: enforces login for create in user emails controller (#37770)
|
2026-02-12 17:10:43 +01:00 |
|
webhooks_controller.rb
|
SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks
|
2026-06-30 16:10:52 +02:00 |
|
wizard_controller.rb
|
|
|
