discourse/spec/requests
Osama Sayegh 976aca68f6
FEATURE: Restrict profile visibility of low-trust users (#29981)
We've seen in some communities abuse of user profile where bios and other fields are used in malicious ways, such as malware distribution. A common pattern between all the abuse cases we've seen is that the malicious actors tend to have 0 posts and have a low trust level.

To eliminate this abuse vector, or at least make it much less effective, we're making the following changes to user profiles:

1. Anonymous, TL0 and TL1 users cannot see any user profiles for users with 0 posts except for staff users
2. Anonymous and TL0 users can only see profiles of TL1 users and above

Users can always see their own profile, and they can still hide their profiles via the "Hide my public profile" preference. Staff can always see any user's profile.

Internal topic: t/142853.
2024-12-09 13:07:59 +03:00
..
admin UX: Improve error when trying to edit globally shadowed setting (#30092) 2024-12-04 13:41:32 +10:00
api DEV: Update create user w/ custom fields api docs (#30133) 2024-12-05 12:28:48 -07:00
examples
about_controller_spec.rb
application_controller_spec.rb DEV: Include controller namespace in X-Discourse-Route (#29783) 2024-11-29 17:11:17 +11:00
associate_accounts_controller_spec.rb
badges_controller_spec.rb
bookmarks_controller_spec.rb DEV: Call Discourse.redis.flushdb after the end of each test (#29117) 2024-10-09 07:19:31 +08:00
categories_controller_spec.rb FIX: Filter out secured categories first (#29916) 2024-11-28 17:09:16 +02:00
clicks_controller_spec.rb
composer_controller_spec.rb
composer_messages_controller_spec.rb
csp_reports_controller_spec.rb DEV: Don’t replace Rails logger in specs (#29721) 2024-11-13 08:47:39 +08:00
directory_columns_controller_spec.rb
directory_items_controller_spec.rb FEATURE: Add links to searchable user fields in users directory and user profile (#29338) 2024-11-06 13:35:30 -04:00
do_not_disturb_controller_spec.rb
drafts_controller_spec.rb FIX: better edit conflict handling (#29789) 2024-12-03 10:12:04 +01:00
edit_directory_columns_controller_spec.rb
email_controller_spec.rb
embed_controller_spec.rb DEV: Upgrade Rails to version 7.1 2024-07-04 10:58:21 +02:00
exceptions_controller_spec.rb
export_csv_controller_spec.rb
extra_locales_controller_spec.rb DEV: Upgrade the MessageFormat library (JS) 2024-07-10 09:51:25 +02:00
finish_installation_controller_spec.rb
form_templates_controller_spec.rb
forums_controller_spec.rb
groups_controller_spec.rb FEATURE: Allow add group member endpoint to skip invite emails (#29962) 2024-11-27 11:33:09 -06:00
hashtags_controller_spec.rb
highlightjs_controller_spec.rb
inline_onebox_controller_spec.rb
invites_controller_spec.rb DEV: Call Discourse.redis.flushdb after the end of each test (#29117) 2024-10-09 07:19:31 +08:00
list_controller_spec.rb FEATURE: Restrict profile visibility of low-trust users (#29981) 2024-12-09 13:07:59 +03:00
metadata_controller_spec.rb
net_http_timeout_spec.rb FIX: Set sane default for Net::HTTP when processing a request (#28141) 2024-08-06 07:12:42 +08:00
noscript_escape_spec.rb
notifications_controller_spec.rb Add dedicated user_api_key_clients table to allow for 1:many use cases (#28119) 2024-11-08 12:05:03 -05:00
offline_controller_spec.rb
omniauth_callbacks_controller_spec.rb DEV: Call Discourse.redis.flushdb after the end of each test (#29117) 2024-10-09 07:19:31 +08:00
onebox_controller_spec.rb
permalinks_controller_spec.rb FIX: Permalink.create didn't work as expected anymore (#29895) 2024-11-22 21:11:26 +01:00
post_action_users_controller_spec.rb
post_actions_controller_spec.rb
post_readers_controller_spec.rb
posts_controller_spec.rb FEATURE: Restrict profile visibility of low-trust users (#29981) 2024-12-09 13:07:59 +03:00
presence_controller_spec.rb DEV: Call Discourse.redis.flushdb after the end of each test (#29117) 2024-10-09 07:19:31 +08:00
published_pages_controller_spec.rb
push_notification_controller_spec.rb
qunit_controller_spec.rb
reviewable_claimed_topics_controller_spec.rb FEATURE: Support designating multiple groups as mods on category (#28655) 2024-09-04 04:38:46 +03:00
reviewables_controller_spec.rb FIX: Rejection email sent even if reject reason too long (#27529) 2024-06-19 11:07:23 +10:00
robots_txt_controller_spec.rb
safe_mode_controller_spec.rb
search_controller_spec.rb DEV: Call Discourse.redis.flushdb after the end of each test (#29117) 2024-10-09 07:19:31 +08:00
session_controller_spec.rb FIX: staff only mode blocks admin password resets (#29289) 2024-10-21 09:29:37 +02:00
sidebar_sections_controller_spec.rb DEV: remap all core icons for fontawesome 6 upgrade (#28715) 2024-09-13 16:50:52 +01:00
similar_topics_controller_spec.rb
site_controller_spec.rb DEV: Resolve stat registration flaky tests (#29084) 2024-10-04 13:49:22 +01:00
sitemap_controller_spec.rb
slugs_controller_spec.rb DEV: Call Discourse.redis.flushdb after the end of each test (#29117) 2024-10-09 07:19:31 +08:00
static_controller_spec.rb FIX: Do not ignore redirects containing "/login" in the path (#29960) 2024-11-27 11:22:45 -05:00
steps_controller_spec.rb
stylesheets_controller_spec.rb
svg_sprite_controller_spec.rb DEV: make the build less flaky (#29288) 2024-10-18 20:07:55 +02:00
tag_groups_controller_spec.rb FEATURE: Log tag group changes in staff action log (#28787) 2024-09-09 10:50:48 +08:00
tags_controller_spec.rb DEV: Ignore invalid tag parameter in TagsController (#28557) 2024-08-27 12:06:54 -04:00
theme_javascripts_controller_spec.rb
topic_view_stats_controller_spec.rb FEATURE: topic_view_stats table with daily fidelity (#27197) 2024-05-27 15:25:32 +10:00
topics_controller_spec.rb DEV: Allow freeze_original argument in topics controller & JS transformer (#30120) 2024-12-05 08:31:05 -06:00
uploads_controller_multisite_spec.rb DEV: Upgrade Rails to version 7.1 2024-07-04 10:58:21 +02:00
uploads_controller_spec.rb FIX: Extension-less secure uploads (#29914) 2024-11-25 12:18:21 +00:00
user_actions_controller_spec.rb FEATURE: Restrict profile visibility of low-trust users (#29981) 2024-12-09 13:07:59 +03:00
user_api_key_clients_controller_spec.rb Require permitted scopes when registering a client (#29718) 2024-11-19 15:28:04 -05:00
user_api_keys_controller_spec.rb Require permitted scopes when registering a client (#29718) 2024-11-19 15:28:04 -05:00
user_avatars_controller_spec.rb
user_badges_controller_spec.rb FEATURE: Restrict profile visibility of low-trust users (#29981) 2024-12-09 13:07:59 +03:00
user_status_controller_spec.rb
users_controller_spec.rb FEATURE: Restrict profile visibility of low-trust users (#29981) 2024-12-09 13:07:59 +03:00
users_email_controller_spec.rb
webhooks_controller_spec.rb
wizard_controller_spec.rb