Andrei Prigorshnev b609f6c11c

FIX: restrict other user's notification routes (#14442) ...

It was possible to see notifications of other users using routes:
- notifications/responses
- notifications/likes-received
- notifications/mentions
- notifications/edits

We weren't showing anything private (like notifications about private messages), only things that're publicly available in other places. But anyway, it feels strange that it's possible to look at notifications of someone else. Additionally, there is a risk that we can unintentionally leak something on these pages in the future.

This commit restricts these routes.

2021-09-29 16:24:28 +04:00

..

admin

FEATURE: Use second factor for admin confirmation (#14293)

2021-09-14 15:19:28 +03:00

users

FEATURE: Allow linking an existing account during external-auth signup

2021-08-10 15:07:40 +01:00

about_controller.rb

Revert "Revert "Merge branch 'master' of https://github.com/discourse/discourse""

2020-05-23 00:56:13 -04:00

application_controller.rb

PERF: Avoid additional database query when viewing own user. (#14239)

2021-09-06 10:38:07 +08:00

badges_controller.rb

UX: Add image uploader widget for uploading badge images (#12377)

2021-03-17 08:55:23 +03:00

bookmarks_controller.rb

FEATURE: Topic-level bookmarks (#14353)

2021-09-21 08:45:47 +10:00

bootstrap_controller.rb

FIX: allows authentication data to be present in bootstrap (#13885)

2021-07-29 15:01:11 +02:00

categories_controller.rb

FIX: Update only passed custom fields (#14357)

2021-09-17 13:37:56 +03:00

clicks_controller.rb

DEV: enable frozen string literal on all files

2019-05-13 09:31:32 +08:00

composer_messages_controller.rb

DEV: Upgrading Discourse to Zeitwerk (#8098)

2019-10-02 14:01:53 +10:00

csp_reports_controller.rb

DEV: Only include "report-sample" CSP directive when reporting is enabled (#9337)

2020-04-02 11:16:38 -04:00

directory_columns_controller.rb

DEV: Plugin API to add directory columns (#13440)

2021-06-22 13:00:04 -05:00

directory_items_controller.rb

FIX: Include user_field_ids in pagination URL for directory items (#13569)

2021-06-29 14:43:38 -05:00

do_not_disturb_controller.rb

DEV: Replace 'processed' column on notifications with new table (#11864)

2021-01-27 10:29:24 -06:00

drafts_controller.rb

FEATURE: Cook drafts excerpt in user activity (#14315)

2021-09-14 15:18:01 +03:00

edit_directory_columns_controller.rb

FIX: Always serialize the correct attributes for DirectoryItems (#13510)

2021-06-23 14:55:17 -05:00

email_controller.rb

FIX: set mailing_list_mode to false when unsubscribing from all (#10354)

2020-08-03 16:59:54 +10:00

embed_controller.rb

UX: display correct replies count in embedded comments view. (#14175)

2021-08-30 10:37:53 +05:30

exceptions_controller.rb

FEATURE: Add site setting to show more detailed 404 errors. (#8014)

2019-10-08 14:15:08 +03:00

export_csv_controller.rb

DEV: Switch to new ExportUserArchive job

2020-08-28 11:46:53 -07:00

extra_locales_controller.rb

Replace base_uri with base_path (#10879)

2020-10-09 12:51:24 +01:00

finish_installation_controller.rb

DEV: update rubocop to version 0.77

2019-12-10 11:48:39 +11:00

forums_controller.rb

FEATURE: Allow a cluster_name to be configured and used for /srv/status (#12365)

2021-03-15 15:41:59 +11:00

groups_controller.rb

FEATURE: allow plugins to extend Groups (#14216)

2021-09-06 10:18:51 +10:00

hashtags_controller.rb

DEV: Merge category and tag hashtags code paths (#10216)

2020-07-13 19:13:17 +03:00

highlight_js_controller.rb

DEV: apply allow origin response header for CDN requests. (#11893)

2021-01-29 07:44:49 +05:30

inline_onebox_controller.rb

FIX: Make inline oneboxes work with secured topics in secured contexts (#8895)

2020-02-12 12:11:28 +02:00

invites_controller.rb

FEATURE: Create notification for redeemed invite (#14146)

2021-08-26 10:43:56 +03:00

list_controller.rb

PERF: Revert all inboxes from messages route. (#14445)

2021-09-28 11:58:04 +08:00

metadata_controller.rb

DEV: Upgrade Rails to 6.1.3.1 (#12688)

2021-04-21 12:36:32 +03:00

notifications_controller.rb

FIX: Typo in NotificationsController#index not caught by tests.

2020-07-22 09:22:26 +08:00

offline_controller.rb

DEV: enable frozen string literal on all files

2019-05-13 09:31:32 +08:00

onebox_controller.rb

DEV: Add more debugging context to onebox generation

2020-10-22 12:50:22 +08:00

permalinks_controller.rb

FIX: Check for permalinks before showing the 404 page

2020-03-23 16:31:07 -07:00

post_action_users_controller.rb

FEATURE: Allow category group moderators to delete topics (#11069)

2020-11-05 12:18:26 -05:00

post_actions_controller.rb

FEATURE: Admins can flag posts so they can review them later. (#12311)

2021-03-11 08:21:24 -03:00

post_readers_controller.rb

DEV: '= true' is not necessary

2019-12-03 11:32:45 -03:00

posts_controller.rb

FIX: Deprecated method should still behave the same. (#14067)

2021-08-19 09:58:26 +08:00

presence_controller.rb

DEV: Introduce PresenceChannel API for core and plugin use

2021-08-27 16:26:06 +01:00

published_pages_controller.rb

FIX: Do not enable published page if secure media enabled (#11131)

2020-11-06 10:33:19 +10:00

push_notification_controller.rb

DEV: enable frozen string literal on all files

2019-05-13 09:31:32 +08:00

qunit_controller.rb

DEV: Fix theme qunit error messages (#14420)

2021-09-22 20:00:19 +02:00

reviewable_claimed_topics_controller.rb

FEATURE: Allow group moderators to close/archive topics

2020-07-14 12:36:19 -04:00

reviewables_controller.rb

FEATURE: Show stale reviewable to other clients (#13114)

2021-05-26 09:47:35 +10:00

robots_txt_controller.rb

FIX: Do not block uploads path in robots.txt (#12349)

2021-03-11 09:36:49 -05:00

safe_mode_controller.rb

FEATURE: Always disable customizations on the /safe-mode route (#9052)

2020-02-28 10:53:11 +00:00

search_controller.rb

FIX: global setting needs to be coerced to float (#11162)

2020-11-09 16:46:52 +11:00

session_controller.rb

FIX: log proper error message when SSO nonce verification fails (#14077)

2021-08-18 18:44:12 +05:30

similar_topics_controller.rb

PERF: Avoid parsing Post#cooked with Nokogiri for every search.

2020-07-24 10:43:09 +08:00

site_controller.rb

DEV: Include login_required attribute in basic info endpoint (#14064)

2021-08-17 14:05:51 -04:00

static_controller.rb

DEV: Upgrade Rails to 6.1.3.1 (#12688)

2021-04-21 12:36:32 +03:00

steps_controller.rb

DEV: Upgrading Discourse to Zeitwerk (#8098)

2019-10-02 14:01:53 +10:00

stylesheets_controller.rb

DEV: Fix stylesheet manager flaky spec (#13846)

2021-07-26 14:22:54 +10:00

svg_sprite_controller.rb

FIX: Use absolute URL when redirecting SVG sprite path.

2021-06-30 11:25:05 +08:00

tag_groups_controller.rb

FIX: Allow finding non-lowercase tag groups (#12787)

2021-04-21 19:15:53 +02:00

tags_controller.rb

FIX: Better and more secure validation of periods for TopicQuery

2021-07-23 14:24:44 -04:00

theme_javascripts_controller.rb

FEATURE: Allow theme tests to be run in production (take 2) (#12845)

2021-04-28 23:12:08 +03:00

topics_controller.rb

Partially revert "PERF: Improve query performance all inbox private messages. (#14304)" (#14344)

2021-09-15 11:32:10 +08:00

uploads_controller.rb

DEV: Add instrumentation for uploads (#14397)

2021-09-22 08:43:02 +10:00

user_actions_controller.rb

FIX: restrict other user's notification routes (#14442)

2021-09-29 16:24:28 +04:00

user_api_keys_controller.rb

FEATURE: Rename 'Discourse SSO' to DiscourseConnect (#11978)

2021-02-08 10:04:33 +00:00

user_avatars_controller.rb

DEV: apply allow origin response header for CDN requests. (#11893)

2021-01-29 07:44:49 +05:30

user_badges_controller.rb

FIX: simplify and improve choosing favorite badges (#13743)

2021-07-16 11:13:00 +08:00

users_controller.rb

DEV: Ignore bookmarks.topic_id column and remove references to it in code (#14289)

2021-09-15 10:16:54 +10:00

users_email_controller.rb

DEV: Correct typos and spelling mistakes (#12812)

2021-05-21 11:43:47 +10:00

webhooks_controller.rb

FEATURE: IMAP delete email sync for group inboxes (#10392)

2020-08-12 10:16:26 +10:00

wizard_controller.rb

DEV: Upgrading Discourse to Zeitwerk (#8098)

2019-10-02 14:01:53 +10:00