Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
discourse/app/controllers
History
Martin Brennan 3c5fb871c0 SECURITY: Filter unread bookmark reminders the user cannot see 
There is an edge case where the following occurs:

1. The user sets a bookmark reminder on a post/topic
2. The post/topic is changed to a PM before or after the reminder
   fires, and the notification remains unread by the user
3. The user opens their bookmark reminder notification list
   and they can still see the notification even though they cannot
   access the topic anymore

There is a very low chance for information leaking here, since
the only thing that could be exposed is the topic title if it
changes to something sensitive.

This commit filters the bookmark unread notifications by using
the bookmarkable can_see? methods and also prevents sending
reminder notifications for bookmarks the user can no longer see.
 		2023-11-09 13:39:16 +11:00
..
admin FEATURE: Theme settings migrations (#24071) 2023-11-02 08:10:15 +03:00
users DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
about_controller.rb DEV: Prefer nested queries (#23464) 2023-09-25 19:38:54 +03:00
application_controller.rb FIX: Remove invalid chars from feed XMLs (#24001) 2023-10-19 14:37:37 -03:00
associated_groups_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
badges_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
bookmarks_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
bootstrap_controller.rb FEATURE: Serve RTL versions of admin and plugins CSS bundles for RTL locales (#21876) 2023-06-01 05:27:11 +03:00
categories_controller.rb FEATURE: Add dark mode option for category backgrounds (#24003) 2023-10-20 12:48:06 +00:00
clicks_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
composer_controller.rb UX: hide warning if all users mentioned via group are already invited. (#23557) 2023-09-13 19:21:44 +05:30
composer_messages_controller.rb DEV: Move distance_of_time_in_words/time_ago_in_words (#21745) 2023-05-25 14:53:59 +02:00
csp_reports_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
directory_columns_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
directory_items_controller.rb FIX: Validate page/limit params for directory, user-badges and groups (#22877) 2023-07-31 15:00:05 +01:00
do_not_disturb_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
drafts_controller.rb SECURITY: Limit number of drafts per user and length of `draft_key` 2023-09-12 15:31:26 -03:00
edit_directory_columns_controller.rb DEV: Implement staff logs for user columns edits (#21774) 2023-06-07 17:19:58 -05:00
email_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
embed_controller.rb FEATURE: Update topic/comment embedding parameters (#20181) 2023-02-28 14:31:59 +02:00
exceptions_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
export_csv_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
extra_locales_controller.rb DEV: Prefer \A and \z over ^ and $ in regexes (#19936) 2023-01-20 12:52:49 -06:00
finish_installation_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
form_templates_controller.rb DEV: Show form templates in the composer (#21190) 2023-05-29 14:47:18 -07:00
forums_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
groups_controller.rb FEATURE: Add custom fields to members on group index (#24232) 2023-11-07 10:06:47 -04:00
hashtags_controller.rb DEV: Remove enable_experimental_hashtag_autocomplete logic (#22820) 2023-08-08 11:18:55 +10:00
highlight_js_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
inline_onebox_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
invites_controller.rb SECURITY: Handle concurrent invite accepts 2023-07-28 12:53:48 +01:00
list_controller.rb DEV: Update experimental `/filter` route with tags support (#20874) 2023-03-30 09:00:42 +08:00
metadata_controller.rb FIX: Use `/` for start_url in webmanifest on non-subfolder installs (#20167) 2023-02-03 16:48:05 -03:00
new_topic_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
notifications_controller.rb SECURITY: Filter unread bookmark reminders the user cannot see 2023-11-09 13:39:16 +11:00
offline_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
onebox_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
permalinks_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
post_action_users_controller.rb SECURITY: Impose a upper bound on limit params in various controllers 2023-07-28 12:53:46 +01:00
post_actions_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
post_readers_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
posts_controller.rb DEV: Remove deprecated PostsController#all_reply_ids (#24128) 2023-10-27 12:40:49 +08:00
presence_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
published_pages_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
push_notification_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
qunit_controller.rb DEV: Stop building test assets in production under Embroider (#23388) 2023-09-11 09:12:37 +01:00
reviewable_claimed_topics_controller.rb FEATURE: Remove support for legacy navigation menu (#23752) 2023-10-09 07:24:10 +08:00
reviewables_controller.rb FEATURE: Add Revise... option for queued post reviewable (#23454) 2023-10-13 11:28:31 +10:00
robots_txt_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
safe_mode_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
search_controller.rb FIX: Search by tag context was broken (#23006) 2023-08-08 15:15:34 -04:00
session_controller.rb DEV: Add routes and controller actions for passkeys (2/3) (#23587) 2023-10-11 14:36:54 -04:00
sidebar_sections_controller.rb FIX: reliably reorder link in custom sections (#24188) 2023-11-02 08:46:45 +11:00
similar_topics_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
site_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
sitemap_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
slugs_controller.rb FEATURE: Allow changing slug on create channel (#19928) 2023-01-23 14:48:33 +10:00
static_controller.rb DEV: Remove legacy `/brotli_asset` workaround (#24243) 2023-11-06 15:57:00 +00:00
steps_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
stylesheets_controller.rb DEV: Fix subfolder setup in dev env (#21983) 2023-06-12 12:49:26 +02:00
svg_sprite_controller.rb FIX: Searching for svg sprite icons connecting to default database (#21605) 2023-05-17 14:25:06 +08:00
tag_groups_controller.rb SECURITY: Impose a upper bound on limit params in various controllers 2023-07-28 12:53:46 +01:00
tags_controller.rb SECURITY: Impose a upper bound on limit params in various controllers 2023-07-28 12:53:46 +01:00
theme_javascripts_controller.rb DEV: Replace #pluck_first freedom patch with AR #pick in core (#19893) 2023-02-13 12:39:45 +08:00
topics_controller.rb FIX: Preserve `preview_theme_id` param on topic redirects (#23965) 2023-10-19 09:32:56 +08:00
uploads_controller.rb FIX: Show gif upload size limit error straight away (#21633) 2023-05-18 10:36:34 +02:00
user_actions_controller.rb PERF: Preload user information when visiting user messages routes (#21929) 2023-06-05 19:24:22 +08:00
user_api_keys_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
user_avatars_controller.rb DEV: Enable `unless` cops 2023-02-21 10:30:48 +01:00
user_badges_controller.rb FIX: Validate page/limit params for directory, user-badges and groups (#22877) 2023-07-31 15:00:05 +01:00
user_status_controller.rb FEATURE: User Status API (#19149) 2022-11-24 19:16:28 +04:00
users_controller.rb SECURITY: Filter unread bookmark reminders the user cannot see 2023-11-09 13:39:16 +11:00
users_email_controller.rb WIP: Rename Webauthn to DiscourseWebauthn (#23077) 2023-08-18 08:39:10 -04:00
webhooks_controller.rb FEATURE: Add Mailpace webhook (#21981) 2023-06-08 20:06:20 +03:00
wizard_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00