Alan Guo Xiang Tan 4cb7472376 SECURITY: Prevent arbitrary topic custom fields from being set ... Why this change? The `PostsController#create` action allows arbitrary topic custom fields to be set by any user that can create a topic. Without any restrictions, this opens us up to potential security issues where plugins may be using topic custom fields in security sensitive areas. What does this change do? 1. This change introduces the `register_editable_topic_custom_field` plugin API which allows plugins to register topic custom fields that are editable either by staff users only or all users. The registered editable topic custom fields are stored in `DiscoursePluginRegistry` and is called by a new method `Topic#editable_custom_fields` which is then used in the `PostsController#create` controller action. When an unpermitted custom fields is present in the `meta_data` params, a 400 response code is returned. 2. Removes all reference to `meta_data` on a topic as it is confusing since we actually mean topic custom fields instead.		2023-10-16 10:34:35 -04:00
..
admin	FEATURE: granular webhooks (#23070)	2023-10-09 03:35:31 +00:00
users	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
about_controller.rb	DEV: Prefer nested queries (#23464)	2023-09-25 19:38:54 +03:00
application_controller.rb	DEV: Prefer nested queries (#23464)	2023-09-25 19:38:54 +03:00
associated_groups_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
badges_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
bookmarks_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
bootstrap_controller.rb	FEATURE: Serve RTL versions of admin and plugins CSS bundles for RTL locales (#21876)	2023-06-01 05:27:11 +03:00
categories_controller.rb	DEV: Switch over category settings to new table - Part 3 (#20657)	2023-09-12 09:51:49 +08:00
clicks_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
composer_controller.rb	UX: hide warning if all users mentioned via group are already invited. (#23557)	2023-09-13 19:21:44 +05:30
composer_messages_controller.rb	DEV: Move distance_of_time_in_words/time_ago_in_words (#21745)	2023-05-25 14:53:59 +02:00
csp_reports_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
directory_columns_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
directory_items_controller.rb	FIX: Validate page/limit params for directory, user-badges and groups (#22877)	2023-07-31 15:00:05 +01:00
do_not_disturb_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
drafts_controller.rb	SECURITY: Limit number of drafts per user and length of draft_key	2023-09-12 15:31:26 -03:00
edit_directory_columns_controller.rb	DEV: Implement staff logs for user columns edits (#21774)	2023-06-07 17:19:58 -05:00
email_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
embed_controller.rb	FEATURE: Update topic/comment embedding parameters (#20181)	2023-02-28 14:31:59 +02:00
exceptions_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
export_csv_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
extra_locales_controller.rb	DEV: Prefer \A and \z over ^ and $ in regexes (#19936)	2023-01-20 12:52:49 -06:00
finish_installation_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
form_templates_controller.rb	DEV: Show form templates in the composer (#21190)	2023-05-29 14:47:18 -07:00
forums_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
groups_controller.rb	FIX: Infinite loading broken on group members list (#23214)	2023-08-24 08:50:20 +08:00
hashtags_controller.rb	DEV: Remove enable_experimental_hashtag_autocomplete logic (#22820)	2023-08-08 11:18:55 +10:00
highlight_js_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
inline_onebox_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
invites_controller.rb	SECURITY: Handle concurrent invite accepts	2023-07-28 12:53:48 +01:00
list_controller.rb	DEV: Update experimental /filter route with tags support (#20874)	2023-03-30 09:00:42 +08:00
metadata_controller.rb	FIX: Use / for start_url in webmanifest on non-subfolder installs (#20167)	2023-02-03 16:48:05 -03:00
new_topic_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
notifications_controller.rb	SECURITY: Impose a upper bound on limit params in various controllers	2023-07-28 12:53:46 +01:00
offline_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
onebox_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
permalinks_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
post_action_users_controller.rb	SECURITY: Impose a upper bound on limit params in various controllers	2023-07-28 12:53:46 +01:00
post_actions_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
post_readers_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
posts_controller.rb	SECURITY: Prevent arbitrary topic custom fields from being set	2023-10-16 10:34:35 -04:00
presence_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
published_pages_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
push_notification_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
qunit_controller.rb	DEV: Stop building test assets in production under Embroider (#23388)	2023-09-11 09:12:37 +01:00
reviewable_claimed_topics_controller.rb	FEATURE: Remove support for legacy navigation menu (#23752)	2023-10-09 07:24:10 +08:00
reviewables_controller.rb	FEATURE: Add Revise... option for queued post reviewable (#23454)	2023-10-13 11:28:31 +10:00
robots_txt_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
safe_mode_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
search_controller.rb	FIX: Search by tag context was broken (#23006)	2023-08-08 15:15:34 -04:00
session_controller.rb	DEV: Add routes and controller actions for passkeys (2/3) (#23587)	2023-10-11 14:36:54 -04:00
sidebar_sections_controller.rb	SECURITY: limit amount of links in custom sidebar section (#22543)	2023-07-11 15:25:01 -06:00
similar_topics_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
site_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
sitemap_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
slugs_controller.rb	FEATURE: Allow changing slug on create channel (#19928)	2023-01-23 14:48:33 +10:00
static_controller.rb	DEV: Allow accessing sourcemaps on /brotli_asset path (#19894)	2023-01-17 12:49:42 +00:00
steps_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
stylesheets_controller.rb	DEV: Fix subfolder setup in dev env (#21983)	2023-06-12 12:49:26 +02:00
svg_sprite_controller.rb	FIX: Searching for svg sprite icons connecting to default database (#21605)	2023-05-17 14:25:06 +08:00
tag_groups_controller.rb	SECURITY: Impose a upper bound on limit params in various controllers	2023-07-28 12:53:46 +01:00
tags_controller.rb	SECURITY: Impose a upper bound on limit params in various controllers	2023-07-28 12:53:46 +01:00
theme_javascripts_controller.rb	DEV: Replace #pluck_first freedom patch with AR #pick in core (#19893)	2023-02-13 12:39:45 +08:00
topics_controller.rb	DEV: Prefer nested queries (#23464)	2023-09-25 19:38:54 +03:00
uploads_controller.rb	FIX: Show gif upload size limit error straight away (#21633)	2023-05-18 10:36:34 +02:00
user_actions_controller.rb	PERF: Preload user information when visiting user messages routes (#21929)	2023-06-05 19:24:22 +08:00
user_api_keys_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
user_avatars_controller.rb	DEV: Enable unless cops	2023-02-21 10:30:48 +01:00
user_badges_controller.rb	FIX: Validate page/limit params for directory, user-badges and groups (#22877)	2023-07-31 15:00:05 +01:00
user_status_controller.rb	FEATURE: User Status API (#19149)	2022-11-24 19:16:28 +04:00
users_controller.rb	SECURITY: Hide user profiles from public	2023-10-16 10:34:32 -04:00
users_email_controller.rb	WIP: Rename Webauthn to DiscourseWebauthn (#23077)	2023-08-18 08:39:10 -04:00
webhooks_controller.rb	FEATURE: Add Mailpace webhook (#21981)	2023-06-08 20:06:20 +03:00
wizard_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00