github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-01-31 02:49:29 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
bdb81b5346
discourse/spec/services
History
Martin Brennan 3c5fb871c0 SECURITY: Filter unread bookmark reminders the user cannot see 
There is an edge case where the following occurs:

1. The user sets a bookmark reminder on a post/topic
2. The post/topic is changed to a PM before or after the reminder
   fires, and the notification remains unread by the user
3. The user opens their bookmark reminder notification list
   and they can still see the notification even though they cannot
   access the topic anymore

There is a very low chance for information leaking here, since
the only thing that could be exposed is the topic title if it
changes to something sensitive.

This commit filters the bookmark unread notifications by using
the bookmarkable can_see? methods and also prevents sending
reminder notifications for bookmarks the user can no longer see.
2023-11-09 13:39:16 +11:00
..
notifications DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
anonymous_shadow_creator_spec.rb DEV: Change anonymous_posting_min_trust_level to a group-based setting (#24072) 2023-10-25 11:45:10 +10:00
auto_silence_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
badge_granter_spec.rb DEV: Remove badge_granted_title column from user_profiles (#20476) 2023-03-08 13:37:20 +01:00
base_bookmarkable_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
category_hashtag_data_source_spec.rb FIX: Category hashtags weren't always found for sub-sub-categories (#20156) 2023-02-03 12:17:52 +01:00
color_scheme_revisor_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
destroy_task_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
email_settings_exception_handler_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
email_settings_validator_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
email_style_updater_spec.rb DEV: Move to Sass compilation to dart-sass (#19910) 2023-02-07 12:24:57 -03:00
external_upload_manager_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
flag_sockpuppets_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
group_action_logger_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
group_mentions_updater_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
group_message_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
hashtag_autocomplete_service_spec.rb DEV: Remove enable_experimental_hashtag_autocomplete logic (#22820) 2023-08-08 11:18:55 +10:00
heat_settings_updater_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
inline_uploads_multisite_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
inline_uploads_spec.rb DEV: Add failing test for pull-hotlinked codeblocks (#23682) 2023-09-29 09:55:51 +01:00
notification_emailer_spec.rb DEV: Email notification filter plugin API (#24271) 2023-11-08 10:29:00 -06:00
post_action_notifier_spec.rb FIX: do not notify admins on suppressed categories (#20238) 2023-02-14 16:45:06 +11:00
post_alerter_spec.rb FIX: Send push notifications for category/tag watching notifications (#24196) 2023-11-01 10:06:33 -05:00
post_bookmarkable_spec.rb SECURITY: Filter unread bookmark reminders the user cannot see 2023-11-09 13:39:16 +11:00
post_owner_changer_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
push_notification_pusher_spec.rb FEATURE: Improve push notification message for watching_category_or_tag notifications (#24228) 2023-11-06 10:13:23 -06:00
random_topic_selector_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
search_indexer_spec.rb DEV: Remove lazy-yt and replace with lazy-videos (#20722) 2023-03-29 11:54:25 -04:00
sidebar_site_settings_backfiller_spec.rb FIX: Update sidebar to be navigation menu (#22101) 2023-06-15 09:31:28 +10:00
site_settings_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
staff_action_logger_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
tag_hashtag_data_source_spec.rb DEV: Introduce enabled? API to hashtag data sources (#22632) 2023-07-18 09:39:01 +10:00
theme_settings_migrations_runner_spec.rb FEATURE: Theme settings migrations (#24071) 2023-11-02 08:10:15 +03:00
themes_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
topic_bookmarkable_spec.rb SECURITY: Filter unread bookmark reminders the user cannot see 2023-11-09 13:39:16 +11:00
topic_status_updater_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
topic_summarization_spec.rb FIX: TopicSummarization workaround for Postgres' discrete range types (#23105) 2023-08-15 14:16:06 -03:00
topic_timestamp_changer_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
trust_level_granter_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
user_activator_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
user_anonymizer_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
user_authenticator_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
user_destroyer_spec.rb FIX: Delete fast typer reviewable when deleting user (#23162) 2023-08-21 18:03:03 +08:00
user_merger_spec.rb DEV: Replace #pluck_first freedom patch with AR #pick in core (#19893) 2023-02-13 12:39:45 +08:00
user_notification_schedule_processor_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
user_silencer_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
user_stat_count_updater_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
user_updater_spec.rb DEV: Allow plugins to hook into user preferences update process on the server (#21737) 2023-05-26 03:26:38 +03:00
username_changer_spec.rb DEV: Update username in new quote format - Part 1 (#22032) 2023-06-14 16:14:11 +08:00
username_checker_service_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
wildcard_domain_checker_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
wildcard_url_checker_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
word_watcher_spec.rb DEV: Refactor watched words (#24163) 2023-11-01 16:41:10 +02:00