discourse/plugins/chat
Martin Brennan 2c45b949ea SECURITY: Filter unread bookmark reminders the user cannot see
There is an edge case where the following occurs:

1. The user sets a bookmark reminder on a post/topic
2. The post/topic is changed to a PM before or after the reminder
   fires, and the notification remains unread by the user
3. The user opens their bookmark reminder notification list
   and they can still see the notification even though they cannot
   access the topic anymore

There is a very low chance for information leaking here, since
the only thing that could be exposed is the topic title if it
changes to something sensitive.

This commit filters the bookmark unread notifications by using
the bookmarkable can_see? methods and also prevents sending
reminder notifications for bookmarks the user can no longer see.
2023-11-09 13:47:24 +11:00
..
app SECURITY: Add permissions to MessageBus in chat (stable) 2023-10-16 10:51:23 -04:00
assets FIX: when using arrow to bottom fetch from newest (#22860) 2023-07-28 19:31:28 +02:00
config Update translations (#24079) 2023-10-24 15:53:39 +02:00
db DEV: Remove experimental setting row for chat threads (#22730) 2023-07-27 15:29:28 +02:00
lib SECURITY: Filter unread bookmark reminders the user cannot see 2023-11-09 13:47:24 +11:00
public
spec SECURITY: Filter unread bookmark reminders the user cannot see 2023-11-09 13:47:24 +11:00
test/javascripts FEATURE: thread pagination (#22624) 2023-07-27 09:57:03 +02:00
plugin.rb FEATURE: thread pagination (#22624) 2023-07-27 09:57:03 +02:00
README.md DEV: Chat service object initial implementation (#19814) 2023-02-13 13:09:57 +01:00

This plugin is still in active development and may change frequently

Documentation

The Discourse Chat plugin adds chat functionality to your Discourse so it can natively support both long-form and short-form communication needs of your online community.

For user documentation, see Discourse Chat.

For developer documentation, see Discourse Documentation.