Martin Brennan 2c45b949ea SECURITY: Filter unread bookmark reminders the user cannot see ... There is an edge case where the following occurs: 1. The user sets a bookmark reminder on a post/topic 2. The post/topic is changed to a PM before or after the reminder fires, and the notification remains unread by the user 3. The user opens their bookmark reminder notification list and they can still see the notification even though they cannot access the topic anymore There is a very low chance for information leaking here, since the only thing that could be exposed is the topic title if it changes to something sensitive. This commit filters the bookmark unread notifications by using the bookmarkable can_see? methods and also prevents sending reminder notifications for bookmarks the user can no longer see.		2023-11-09 13:47:24 +11:00
..
admin	SECURITY: Impose a upper bound on limit params in various controllers	2023-07-28 12:53:46 +01:00
users	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
about_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
application_controller.rb	DEV: Add hidden cross_origin_opener_policy_header site setting (#23346)	2023-10-11 14:51:28 -07:00
associated_groups_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
badges_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
bookmarks_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
bootstrap_controller.rb	FEATURE: Serve RTL versions of admin and plugins CSS bundles for RTL locales (#21876)	2023-06-01 05:27:11 +03:00
categories_controller.rb	FIX: Include more_topic_url in the response to /categories_and_{latest, top} (#21738)	2023-05-25 15:24:48 -03:00
clicks_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
composer_controller.rb	DEV: Remove elder from codebase and also update 'regular' to 'member' (#20065)	2023-01-31 01:41:25 +08:00
composer_messages_controller.rb	DEV: Move distance_of_time_in_words/time_ago_in_words (#21745)	2023-05-25 14:53:59 +02:00
csp_reports_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
directory_columns_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
directory_items_controller.rb	FIX: Validate page/limit params for directory, user-badges and groups (#22877)	2023-07-31 15:00:05 +01:00
do_not_disturb_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
drafts_controller.rb	SECURITY: Limit number of drafts per user and length of draft_key	2023-09-12 15:35:47 -03:00
edit_directory_columns_controller.rb	DEV: Implement staff logs for user columns edits (#21774)	2023-06-07 17:19:58 -05:00
email_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
embed_controller.rb	FEATURE: Update topic/comment embedding parameters (#20181)	2023-02-28 14:31:59 +02:00
exceptions_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
export_csv_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
extra_locales_controller.rb	DEV: Prefer \A and \z over ^ and $ in regexes (#19936)	2023-01-20 12:52:49 -06:00
finish_installation_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
form_templates_controller.rb	DEV: Show form templates in the composer (#21190)	2023-05-29 14:47:18 -07:00
forums_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
groups_controller.rb	FIX: Validate page/limit params for directory, user-badges and groups (#22877)	2023-07-31 15:00:05 +01:00
hashtags_controller.rb	FEATURE: Allow showing hashtag autocomplete results without term (#19219)	2022-12-08 13:47:59 +10:00
highlight_js_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
inline_onebox_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
invites_controller.rb	SECURITY: Handle concurrent invite accepts	2023-07-28 12:53:48 +01:00
list_controller.rb	DEV: Update experimental /filter route with tags support (#20874)	2023-03-30 09:00:42 +08:00
metadata_controller.rb	FIX: Use / for start_url in webmanifest on non-subfolder installs (#20167)	2023-02-03 16:48:05 -03:00
new_topic_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
notifications_controller.rb	SECURITY: Filter unread bookmark reminders the user cannot see	2023-11-09 13:47:24 +11:00
offline_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
onebox_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
permalinks_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
post_action_users_controller.rb	SECURITY: Impose a upper bound on limit params in various controllers	2023-07-28 12:53:46 +01:00
post_actions_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
post_readers_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
posts_controller.rb	SECURITY: Prevent arbitrary topic custom fields from being set	2023-10-16 10:51:28 -04:00
presence_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
published_pages_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
push_notification_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
qunit_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
reviewable_claimed_topics_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
reviewables_controller.rb	FIX: Don't display destroy reviewable button on client (#21226)	2023-04-24 20:22:37 -05:00
robots_txt_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
safe_mode_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
search_controller.rb	FEATURE: rate limit anon searches per second (#19708)	2023-01-27 10:05:27 -08:00
session_controller.rb	FEATURE: add a setting to allowlist DiscourseConnect return path domains (#21110)	2023-04-17 22:53:50 +05:30
sidebar_sections_controller.rb	SECURITY: limit amount of links in custom sidebar section (#22543)	2023-07-11 15:25:01 -06:00
similar_topics_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
site_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
sitemap_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
slugs_controller.rb	FEATURE: Allow changing slug on create channel (#19928)	2023-01-23 14:48:33 +10:00
static_controller.rb	DEV: Allow accessing sourcemaps on /brotli_asset path (#19894)	2023-01-17 12:49:42 +00:00
steps_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
stylesheets_controller.rb	DEV: Fix subfolder setup in dev env (#21983)	2023-06-12 12:49:26 +02:00
svg_sprite_controller.rb	FIX: Searching for svg sprite icons connecting to default database (#21605)	2023-05-17 14:25:06 +08:00
tag_groups_controller.rb	SECURITY: Impose a upper bound on limit params in various controllers	2023-07-28 12:53:46 +01:00
tags_controller.rb	SECURITY: Impose a upper bound on limit params in various controllers	2023-07-28 12:53:46 +01:00
theme_javascripts_controller.rb	DEV: Replace #pluck_first freedom patch with AR #pick in core (#19893)	2023-02-13 12:39:45 +08:00
topics_controller.rb	FIX: Can't dismiss unread posts in topics of a sub-subcategory (#22870)	2023-07-31 11:22:16 +08:00
uploads_controller.rb	FIX: Show gif upload size limit error straight away (#21633)	2023-05-18 10:36:34 +02:00
user_actions_controller.rb	PERF: Preload user information when visiting user messages routes (#21929)	2023-06-05 19:24:22 +08:00
user_api_keys_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
user_avatars_controller.rb	DEV: Enable unless cops	2023-02-21 10:30:48 +01:00
user_badges_controller.rb	FIX: Validate page/limit params for directory, user-badges and groups (#22877)	2023-07-31 15:00:05 +01:00
user_status_controller.rb	FEATURE: User Status API (#19149)	2022-11-24 19:16:28 +04:00
users_controller.rb	SECURITY: Filter unread bookmark reminders the user cannot see	2023-11-09 13:47:24 +11:00
users_email_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
webhooks_controller.rb	FEATURE: Add Mailpace webhook (#21981)	2023-06-08 20:06:20 +03:00
wizard_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00