discourse/spec/serializers
Alan Guo Xiang Tan 65820e8ac1
SECURITY: Restrict display of topic titles associated with user badges (#18768) (#18770)
Before this commit, we did not have guardian checks in place to determine if a
topic's title associated with a user badge should be displayed or not.
This means that the topic title of topics with restricted access
could be leaked to anon and users without access if certain conditions
are met. While we will not specify the conditions required, we have internally
assessed that the odds of meeting such conditions are low.

With this commit, we will now apply a guardian check to ensure that the
current user is able to see a topic before the topic's title is included
in the serialized object of a `UserBadge`.
2022-10-27 11:48:00 +08:00
..
about_serializer_spec.rb FIX: do not include contact url & email in client site settings payload (#13004) 2021-05-19 16:15:24 +10:00
admin_plugin_serializer_spec.rb DEV: use #frozen_string_literal: true on all spec 2019-04-30 10:27:42 +10:00
admin_user_list_serializer_spec.rb FIX: Admin user list not showing 2FA icon for only security keys enabled (#8839) 2020-02-03 14:37:46 +10:00
basic_group_serializer_spec.rb FIX: N+1 for admins viewing groups page 2020-09-16 14:58:52 -04:00
basic_group_user_serializer_spec.rb DEV: Prefabrication (test optimization) (#7414) 2019-05-07 13:12:20 +10:00
basic_post_serializer_spec.rb DEV: Move requested_group_id custom field from post to topic (#9127) 2020-03-24 11:12:52 +02:00
basic_user_serializer_spec.rb FIX: correct user serializer user method for extended serializer (#8590) 2019-12-19 09:48:01 -08:00
category_detailed_serializer_spec.rb DEV: Upgrading Discourse to Zeitwerk (#8098) 2019-10-02 14:01:53 +10:00
category_serializer_spec.rb SECURITY: Category group permissions leaked to normal users. 2022-04-08 11:04:59 +02:00
category_upload_serializer_spec.rb DEV: Prefabrication (test optimization) (#7414) 2019-05-07 13:12:20 +10:00
current_user_serializer_spec.rb FEATURE: Display pending posts on user’s page 2021-11-29 10:26:33 +01:00
detailed_user_badge_serializer_spec.rb SECURITY: Restrict display of topic titles associated with user badges (#18768) (#18770) 2022-10-27 11:48:00 +08:00
directory_item_serializer_spec.rb FIX: Always serialize the correct attributes for DirectoryItems (#13510) 2021-06-23 14:55:17 -05:00
emoji_serializer_spec.rb FIX: Don't raise an error if a custom emoji image was deleted 2020-12-09 15:40:40 -05:00
group_show_serializer_spec.rb UX: warn about messages to be orphaned while deleting a group. (#11727) 2021-01-22 03:29:34 +05:30
listable_topic_serializer_spec.rb Code review comments. 2021-06-21 11:06:58 +08:00
new_post_result_serializer_spec.rb Support for custom messages and redirects when creating posts (#8434) 2019-11-29 09:30:54 -05:00
notification_serializer_spec.rb FEATURE: Rename 'Discourse SSO' to DiscourseConnect (#11978) 2021-02-08 10:04:33 +00:00
pending_post_serializer_spec.rb FEATURE: Display pending posts on user’s page 2021-11-29 10:26:33 +01:00
post_revision_serializer_spec.rb DEV: Correct typos and spelling mistakes (#12812) 2021-05-21 11:43:47 +10:00
post_serializer_spec.rb DEV: Remove harded id when fabricating in tests (#18729) (#18730) 2022-10-25 06:33:36 +08:00
reviewable_flagged_post_serializer_spec.rb Fix the actual failing test 2019-11-14 16:20:45 -08:00
reviewable_queued_post_serializer_spec.rb FEATURE: Allow viewing of raw emails for reviewable queued posts (#7910) 2019-07-19 11:56:14 -04:00
reviewable_score_serializer_spec.rb FIX: update translation key to match flag reason. (#14573) 2021-10-11 10:24:41 -03:00
reviewable_serializer_spec.rb Fix the actual failing test 2019-11-14 16:20:45 -08:00
reviewable_user_serializer_spec.rb DEV: use #frozen_string_literal: true on all spec 2019-04-30 10:27:42 +10:00
single_sign_on_record_serializer_spec.rb FIX: do not show SSO last payload to moderators (#12084) 2021-02-15 16:12:06 +05:30
site_serializer_spec.rb DEV: Clean up state leak in Site tests. 2021-06-25 09:17:49 +08:00
suggested_topic_serializer_spec.rb DEV: use #frozen_string_literal: true on all spec 2019-04-30 10:27:42 +10:00
tag_group_serializer_spec.rb FEATURE: Tag synonyms 2019-12-04 13:33:51 -05:00
theme_serializer_spec.rb FIX: add theme field errors (#12880) 2021-04-28 15:00:37 -07:00
topic_link_serializer_spec.rb DEV: use #frozen_string_literal: true on all spec 2019-04-30 10:27:42 +10:00
topic_list_item_serializer_spec.rb FIX: composer problem on the categories page (#9508) 2020-04-22 09:24:54 -07:00
topic_list_serializer_spec.rb DEV: Prefabrication (test optimization) (#7414) 2019-05-07 13:12:20 +10:00
topic_view_details_serializer_spec.rb FIX: Users can remove themselves from a PM even if they can still access it through a group. (#11693) 2021-01-13 11:27:23 -03:00
topic_view_posts_serializer_spec.rb FEATURE: Notify responders of post removal (#15049) 2021-11-24 09:28:20 -06:00
topic_view_serializer_spec.rb FEATURE: ability to add description to tags (#15125) 2021-12-01 09:18:56 +11:00
upload_serializer_spec.rb DEV: Fix rubocop issues (#14715) 2021-10-27 11:39:28 +03:00
user_auth_token_serializer_spec.rb DEV: Prefabrication (test optimization) (#7414) 2019-05-07 13:12:20 +10:00
user_badge_serializer_spec.rb SECURITY: Restrict display of topic titles associated with user badges (#18768) (#18770) 2022-10-27 11:48:00 +08:00
user_bookmark_serializer_spec.rb FIX: Use unread post excerpt for topic-level bookmark excerpt (#14414) 2021-09-22 12:47:36 +10:00
user_card_serializer_spec.rb FEATURE: Display pending posts on user’s page 2021-11-29 10:26:33 +01:00
user_serializer_spec.rb FIX: Wrong scope used for notification levels user serializer (#13039) 2021-05-14 09:45:14 +10:00
user_summary_serializer_spec.rb DEV: Order links by domain and url in spec 2020-08-12 17:46:12 -04:00
web_hook_post_serializer_spec.rb FEATURE: Let users select flair (#13587) 2021-07-08 10:46:21 +03:00
web_hook_topic_view_serializer_spec.rb FEATURE: ability to add description to tags (#15125) 2021-12-01 09:18:56 +11:00
web_hook_user_serializer_spec.rb FIX: Serialize flair group ID for preferences page (#13741) 2021-07-20 13:06:40 +03:00
wizard_serializer_spec.rb UX: Add Styling step to wizard (#14132) 2021-08-25 17:10:12 -04:00