Roman Rizzi 628b293ff5 SECURITY: Onebox templates' HTML injections (stable). ...

The use of triple-curlies on Mustache templates opens the possibility for HTML injections.

2023-11-09 13:47:23 +11:00

..

fabricators

FIX: Keep ReviewableQueuedPosts even with user delete reviewable actions (#22501)

2023-07-18 11:50:31 +00:00

fixtures

SECURITY: Onebox templates' HTML injections (stable).

2023-11-09 13:47:23 +11:00

helpers

DEV: Replace #pluck_first freedom patch with AR #pick in core (#19893)

2023-02-13 12:39:45 +08:00

import_export

DEV: Apply syntax_tree formatting to spec/*

2023-01-09 11:49:28 +00:00

initializers

DEV: Fix test (#22018)

2023-06-08 16:12:13 -05:00

integration

DEV: Update the rubocop-discourse gem

2023-06-26 11:41:52 +02:00

integrity

DEV: Update TranslateAccelerator missing translation string (#22158)

2023-06-16 15:28:03 +01:00

jobs

SECURITY: escape display names

2023-11-09 13:47:20 +11:00

lib

SECURITY: Onebox templates' HTML injections (stable).

2023-11-09 13:47:23 +11:00

mailers

FIX: Order tags shown in email subject by topics count and name (#22586)

2023-07-13 15:39:58 +08:00

models

SECURITY: SSRF vulnerability in TopicEmbed

2023-11-09 13:47:21 +11:00

multisite

DEV: Remove Discourse.redis.delete_prefixed (#22103)

2023-06-16 12:44:35 +10:00

requests

SECURITY: Prevent arbitrary topic custom fields from being set

2023-10-16 10:51:28 -04:00

script/import_scripts

DEV: Fix flaky core backend spec (#22650)

2023-07-18 07:01:19 +08:00

serializers

FIX: Missing pending queued posts from topic view (#22838)

2023-07-28 16:16:23 +00:00

services

FEATURE: Regenerate outdated summaries. (#22718)

2023-07-20 15:25:46 -03:00

support

DEV: Assert that user has been signed in successfully in system tests (#22892)

2023-08-01 09:06:56 +08:00

system

FEATURE: Count only approved flagged posts in user pages (#22799)

2023-07-31 13:33:10 +08:00

tasks

DEV: Introduce version_bump rake tasks (#22817)

2023-07-31 16:05:13 +01:00

views

DEV: Fix random typos (#22078)

2023-06-13 22:02:21 +02:00

rails_helper.rb

SECURITY: Reduce maximum size of SVG sprite cache to prevent DoS

2023-09-12 15:35:45 -03:00

regenerate_swagger_docs

DEV: Add API docs for uploads and API doc watcher (#15387)

2021-12-23 08:40:15 +10:00

swagger_helper.rb

DEV: Apply syntax_tree formatting to spec/*

2023-01-09 11:49:28 +00:00