Martin Brennan 3c5fb871c0 SECURITY: Filter unread bookmark reminders the user cannot see ... There is an edge case where the following occurs: 1. The user sets a bookmark reminder on a post/topic 2. The post/topic is changed to a PM before or after the reminder fires, and the notification remains unread by the user 3. The user opens their bookmark reminder notification list and they can still see the notification even though they cannot access the topic anymore There is a very low chance for information leaking here, since the only thing that could be exposed is the topic title if it changes to something sensitive. This commit filters the bookmark unread notifications by using the bookmarkable can_see? methods and also prevents sending reminder notifications for bookmarks the user can no longer see.		2023-11-09 13:39:16 +11:00
..
admin	FEATURE: Theme settings migrations (#24071)	2023-11-02 08:10:15 +03:00
users	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
about_controller.rb	DEV: Prefer nested queries (#23464)	2023-09-25 19:38:54 +03:00
application_controller.rb	FIX: Remove invalid chars from feed XMLs (#24001)	2023-10-19 14:37:37 -03:00
associated_groups_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
badges_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
bookmarks_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
bootstrap_controller.rb	FEATURE: Serve RTL versions of admin and plugins CSS bundles for RTL locales (#21876)	2023-06-01 05:27:11 +03:00
categories_controller.rb	FEATURE: Add dark mode option for category backgrounds (#24003)	2023-10-20 12:48:06 +00:00
clicks_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
composer_controller.rb	UX: hide warning if all users mentioned via group are already invited. (#23557)	2023-09-13 19:21:44 +05:30
composer_messages_controller.rb	DEV: Move distance_of_time_in_words/time_ago_in_words (#21745)	2023-05-25 14:53:59 +02:00
csp_reports_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
directory_columns_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
directory_items_controller.rb	FIX: Validate page/limit params for directory, user-badges and groups (#22877)	2023-07-31 15:00:05 +01:00
do_not_disturb_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
drafts_controller.rb	SECURITY: Limit number of drafts per user and length of draft_key	2023-09-12 15:31:26 -03:00
edit_directory_columns_controller.rb	DEV: Implement staff logs for user columns edits (#21774)	2023-06-07 17:19:58 -05:00
email_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
embed_controller.rb	FEATURE: Update topic/comment embedding parameters (#20181)	2023-02-28 14:31:59 +02:00
exceptions_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
export_csv_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
extra_locales_controller.rb	DEV: Prefer \A and \z over ^ and $ in regexes (#19936)	2023-01-20 12:52:49 -06:00
finish_installation_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
form_templates_controller.rb	DEV: Show form templates in the composer (#21190)	2023-05-29 14:47:18 -07:00
forums_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
groups_controller.rb	FEATURE: Add custom fields to members on group index (#24232)	2023-11-07 10:06:47 -04:00
hashtags_controller.rb	DEV: Remove enable_experimental_hashtag_autocomplete logic (#22820)	2023-08-08 11:18:55 +10:00
highlight_js_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
inline_onebox_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
invites_controller.rb	SECURITY: Handle concurrent invite accepts	2023-07-28 12:53:48 +01:00
list_controller.rb	DEV: Update experimental /filter route with tags support (#20874)	2023-03-30 09:00:42 +08:00
metadata_controller.rb	FIX: Use / for start_url in webmanifest on non-subfolder installs (#20167)	2023-02-03 16:48:05 -03:00
new_topic_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
notifications_controller.rb	SECURITY: Filter unread bookmark reminders the user cannot see	2023-11-09 13:39:16 +11:00
offline_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
onebox_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
permalinks_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
post_action_users_controller.rb	SECURITY: Impose a upper bound on limit params in various controllers	2023-07-28 12:53:46 +01:00
post_actions_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
post_readers_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
posts_controller.rb	DEV: Remove deprecated PostsController#all_reply_ids (#24128)	2023-10-27 12:40:49 +08:00
presence_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
published_pages_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
push_notification_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
qunit_controller.rb	DEV: Stop building test assets in production under Embroider (#23388)	2023-09-11 09:12:37 +01:00
reviewable_claimed_topics_controller.rb	FEATURE: Remove support for legacy navigation menu (#23752)	2023-10-09 07:24:10 +08:00
reviewables_controller.rb	FEATURE: Add Revise... option for queued post reviewable (#23454)	2023-10-13 11:28:31 +10:00
robots_txt_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
safe_mode_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
search_controller.rb	FIX: Search by tag context was broken (#23006)	2023-08-08 15:15:34 -04:00
session_controller.rb	DEV: Add routes and controller actions for passkeys (2/3) (#23587)	2023-10-11 14:36:54 -04:00
sidebar_sections_controller.rb	FIX: reliably reorder link in custom sections (#24188)	2023-11-02 08:46:45 +11:00
similar_topics_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
site_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
sitemap_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
slugs_controller.rb	FEATURE: Allow changing slug on create channel (#19928)	2023-01-23 14:48:33 +10:00
static_controller.rb	DEV: Remove legacy /brotli_asset workaround (#24243)	2023-11-06 15:57:00 +00:00
steps_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
stylesheets_controller.rb	DEV: Fix subfolder setup in dev env (#21983)	2023-06-12 12:49:26 +02:00
svg_sprite_controller.rb	FIX: Searching for svg sprite icons connecting to default database (#21605)	2023-05-17 14:25:06 +08:00
tag_groups_controller.rb	SECURITY: Impose a upper bound on limit params in various controllers	2023-07-28 12:53:46 +01:00
tags_controller.rb	SECURITY: Impose a upper bound on limit params in various controllers	2023-07-28 12:53:46 +01:00
theme_javascripts_controller.rb	DEV: Replace #pluck_first freedom patch with AR #pick in core (#19893)	2023-02-13 12:39:45 +08:00
topics_controller.rb	FIX: Preserve preview_theme_id param on topic redirects (#23965)	2023-10-19 09:32:56 +08:00
uploads_controller.rb	FIX: Show gif upload size limit error straight away (#21633)	2023-05-18 10:36:34 +02:00
user_actions_controller.rb	PERF: Preload user information when visiting user messages routes (#21929)	2023-06-05 19:24:22 +08:00
user_api_keys_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
user_avatars_controller.rb	DEV: Enable unless cops	2023-02-21 10:30:48 +01:00
user_badges_controller.rb	FIX: Validate page/limit params for directory, user-badges and groups (#22877)	2023-07-31 15:00:05 +01:00
user_status_controller.rb	FEATURE: User Status API (#19149)	2022-11-24 19:16:28 +04:00
users_controller.rb	SECURITY: Filter unread bookmark reminders the user cannot see	2023-11-09 13:39:16 +11:00
users_email_controller.rb	WIP: Rename Webauthn to DiscourseWebauthn (#23077)	2023-08-18 08:39:10 -04:00
webhooks_controller.rb	FEATURE: Add Mailpace webhook (#21981)	2023-06-08 20:06:20 +03:00
wizard_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00