From a8a12eb2d93c874d42f835cec0bdfb0771c55a33 Mon Sep 17 00:00:00 2001 From: Arpit Jalan Date: Sun, 15 Apr 2018 17:59:58 +0530 Subject: [PATCH] SECURITY: do not disclose topic titles on /unsubscribed page to unauthorized users --- app/controllers/email_controller.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/app/controllers/email_controller.rb b/app/controllers/email_controller.rb index f0556f608dd..8fd9e9bbcf6 100644 --- a/app/controllers/email_controller.rb +++ b/app/controllers/email_controller.rb @@ -110,8 +110,10 @@ class EmailController < ApplicationController def unsubscribed @email = params[:email] - raise Discourse::NotFound if !User.find_by_email(params[:email]) + user = User.find_by_email(params[:email]) + raise Discourse::NotFound unless user @topic = Topic.find_by(id: params[:topic_id].to_i) if params[:topic_id] + raise Discourse::NotFound unless Guardian.new(user).can_see?(@topic) end end