discourse/app/assets
Alan Guo Xiang Tan 42d2cb2d4e
SECURITY: Hide PM count for tags by default (#20061) (#20090)
Currently `Topic#pm_topic_count` is a count of all personal messages tagged for a given tag. As a result, any user with access to PM tags can poll a sensitive tag to determine if a new personal message has been created using that tag even if the user does not have access to the personal message. We classify this as a minor leak in sensitive information.

With this commit, `Topic#pm_topic_count` is hidden from users by default unless the `display_personal_messages_tag_counts` site setting is enabled.
2023-02-01 06:43:58 +08:00
..
images FIX: fallback to default push notification icon if none exists (#16961) 2022-06-01 12:00:05 +10:00
javascripts SECURITY: Hide PM count for tags by default (#20061) (#20090) 2023-02-01 06:43:58 +08:00
stylesheets FIX: Fix margin on mini-tag-chooser (#19953) 2023-01-25 13:48:49 +02:00