discourse-follow/app
Isaac Janzen 793b9aa967
Some checks failed
Discourse Plugin / ci (push) Has been cancelled
SECURITY: Follow feed exposes shared draft topic titles to followers (#187)
## Summary

Prevent the leakage of shared draft topic titles and post content in the follow feed by correctly filtering out topics with associated shared drafts for unauthorized users. The query now explicitly checks the viewer's shared draft visibility before returning posts from followed users.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1405

Co-authored-by: discourse-patch-triage <272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-10 09:57:15 -05:00
..
controllers/follow FIX: Allow users to unfollow suspended/staged/bot users (#176) 2026-03-31 11:36:41 +02:00
models SECURITY: Follow feed exposes shared draft topic titles to followers (#187) 2026-07-10 09:57:15 -05:00
serializers SECURITY: Follow post excerpts are shown for hidden posts (#183) 2026-06-15 12:25:16 -03:00