github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-12-02 06:33:55 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
473b7d9a4f
discourse/app/services
History
Martin Brennan 2c45b949ea SECURITY: Filter unread bookmark reminders the user cannot see 
There is an edge case where the following occurs:

1. The user sets a bookmark reminder on a post/topic
2. The post/topic is changed to a PM before or after the reminder
   fires, and the notification remains unread by the user
3. The user opens their bookmark reminder notification list
   and they can still see the notification even though they cannot
   access the topic anymore

There is a very low chance for information leaking here, since
the only thing that could be exposed is the topic title if it
changes to something sensitive.

This commit filters the bookmark unread notifications by using
the bookmarkable can_see? methods and also prevents sending
reminder notifications for bookmarks the user can no longer see.
2023-11-09 13:47:24 +11:00
..
notifications DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
spam_rule DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
anonymous_shadow_creator.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
badge_granter.rb DEV: Remove badge_granted_title column from user_profiles (#20476) 2023-03-08 13:37:20 +01:00
base_bookmarkable.rb DEV: Change Bookmarkable registration to DiscoursePluginRegistry (#20556) 2023-03-08 10:39:12 +10:00
category_hashtag_data_source.rb DEV: Introduce enabled? API to hashtag data sources (#22632) 2023-07-18 09:39:01 +10:00
color_scheme_revisor.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
destroy_task.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
email_settings_exception_handler.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
email_settings_validator.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
email_style_updater.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
external_upload_manager.rb DEV: Remove defunct TODOs (#19825) 2023-01-12 09:41:39 +10:00
group_action_logger.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
group_mentions_updater.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
group_message.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
handle_chunk_upload.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
hashtag_autocomplete_service.rb FIX: Termless hashtag search when a type is disabled (#22660) 2023-07-19 10:10:33 +10:00
heat_settings_updater.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
inline_uploads.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
notification_emailer.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
post_action_notifier.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
post_alerter.rb FIX: more performance improvement for PostAlert job (#22487) 2023-07-13 09:02:23 +10:00
post_bookmarkable.rb SECURITY: Filter unread bookmark reminders the user cannot see 2023-11-09 13:47:24 +11:00
post_owner_changer.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
push_notification_pusher.rb DEV: Handle SSL errors in push notification pusher (#22771) 2023-07-25 15:01:02 +08:00
random_topic_selector.rb DEV: Remove Discourse.redis.delete_prefixed (#22103) 2023-06-16 12:44:35 +10:00
registered_bookmarkable.rb DEV: Change Bookmarkable registration to DiscoursePluginRegistry (#20556) 2023-03-08 10:39:12 +10:00
search_indexer.rb FIX: do not allow title stuffing to dominate search (#21464) 2023-05-10 11:47:58 +10:00
sidebar_section_links_updater.rb FIX: Seed all categories and tags configured as defaults for nav menu (#22793) 2023-07-27 10:52:33 +08:00
sidebar_site_settings_backfiller.rb FIX: Update sidebar to be navigation menu (#22101) 2023-06-15 09:31:28 +10:00
site_settings_task.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
staff_action_logger.rb FIX: Keep ReviewableQueuedPosts even with user delete reviewable actions (#22501) 2023-07-18 11:50:31 +00:00
tag_hashtag_data_source.rb DEV: Introduce enabled? API to hashtag data sources (#22632) 2023-07-18 09:39:01 +10:00
themes_install_task.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
topic_bookmarkable.rb SECURITY: Filter unread bookmark reminders the user cannot see 2023-11-09 13:47:24 +11:00
topic_status_updater.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
topic_summarization.rb FEATURE: Regenerate outdated summaries. (#22718) 2023-07-20 15:25:46 -03:00
topic_timestamp_changer.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
tracked_topics_updater.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
trust_level_granter.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
user_action_manager.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
user_activator.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
user_anonymizer.rb FIX: Anonymizing a user clears their user status too (#21673) 2023-05-22 13:18:09 +08:00
user_authenticator.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
user_destroyer.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
user_merger.rb DEV: Remove badge_granted_title column from user_profiles (#20476) 2023-03-08 13:37:20 +01:00
user_notification_renderer.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
user_notification_schedule_processor.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
user_silencer.rb DEV: Enable unless cops 2023-02-21 10:30:48 +01:00
user_stat_count_updater.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
user_updater.rb FIX: Seed all categories and tags configured as defaults for nav menu (#22793) 2023-07-27 10:52:33 +08:00
username_changer.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
username_checker_service.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
web_hook_emitter.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
wildcard_domain_checker.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
wildcard_url_checker.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
word_watcher.rb PERF: improve findAllMatches speed (#22083) 2023-06-13 18:34:28 +02:00