discourse-follow/spec
discourse-patch-triage[bot] 3c3987b7a1
SECURITY: Follow feed exposes shared draft topic titles to followers [backport 2026.5] (#188)
Backport of #187 to d-compat/2026.5.

---

## Summary

Prevent the leakage of shared draft topic titles and post content in the follow feed by correctly filtering out topics with associated shared drafts for unauthorized users. The query now explicitly checks the viewer's shared draft visibility before returning posts from followed users.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1405

Co-authored-by: discourse-patch-triage <272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-10 10:14:41 -05:00
..
integration DEV: Update linting and add types (#167) 2026-01-28 11:49:36 +00:00
lib FIX: Allow users to unfollow suspended/staged/bot users (#176) 2026-03-31 11:36:41 +02:00
models DEV: Update linting and add types (#167) 2026-01-28 11:49:36 +00:00
requests SECURITY: Follow feed exposes shared draft topic titles to followers [backport 2026.5] (#188) 2026-07-10 10:14:41 -05:00
serializers FIX: Allow users to unfollow suspended/staged/bot users (#176) 2026-03-31 11:36:41 +02:00
system DEV: Update linting and add types (#167) 2026-01-28 11:49:36 +00:00