Awesome Privacy

Recent Commits

• Jarek Radosz (10 Feb 26)

  SECURITY: Check for no group assignments in data-explorer queries

• Keegan George (10 Feb 26)

  SECURITY: prevent regular users from promoting topics to banners

• OsamaSayegh (11 Feb 26)

  SECURITY: Check visibility permissions for TL4 changing topic status

• Jarek Radosz (12 Feb 26)

  SECURITY: Prevent TL4 users to post to staff-only categories through a topic timer

• Joffrey JAFFEUX (12 Feb 26)

  SECURITY: harden webooks endpoints Ensures every endpoints now require a valid token. This commit is not deprecating mailpace and directly fixing it like other endpoints which have been deprecated for years now. This SECURITY issue is serious enough to warrant a direct fix.

• Joffrey JAFFEUX (12 Feb 26)

  SECURITY: authentication bypass vulnerability When the patreon_webhook_secret site setting is blank, an attacker can forge valid webhook signatures by computing an HMAC-MD5 with an empty string as the key. Since the request body is known to the sender, the attacker can produce a matching signature and send arbitrary webhook payloads. This allows unauthorized creation, modification, or deletion of Patreon pledge data and triggering patron-to-group synchronization. The `secure_compare` change handles a very theoretical timing attack.

• Joffrey JAFFEUX (13 Feb 26)

  SECURITY: missing post access check in discourse policy Vulnerability in `DiscoursePolicy::PolicyController` — all actions load a post by `params[:post_id]` without checking whether the current user has permission to see that post, allowing interaction with policies on posts in private categories or PMs. Group membership can limit the exploit but was still leaking information, and you could still have a policy group allowed to everyone in a private category.

• Joffrey JAFFEUX (13 Feb 26)

  SECURITY: Filter private user fields in directory items endpoint The directory items endpoint accepted arbitrary user_field_ids without checking field visibility, allowing anonymous users to retrieve private user field values. Now non-staff users can only access public fields (show_on_profile or show_on_user_card), while staff retain access to all fields.

• OsamaSayegh (14 Feb 26)

  SECURITY: Add post visibility check to poll voters endpoint The `/polls/voters.json` endpoint was missing authorization checks to verify if users could access the post containing the poll. This allowed unauthorized users (including anonymous users) to retrieve voter data from polls in posts they don't have access to.

• Joffrey JAFFEUX (16 Feb 26)

  SECURITY: scope reviewable notes to user-visible reviewables The ReviewableNotesController used an unscoped Reviewable.find which allowed category group moderators to create/delete notes on any reviewable, including those in categories they do not moderate. Replace with Reviewable.viewable_by to properly scope the lookup.

• Joffrey JAFFEUX (17 Feb 26)

  SECURITY: prevents whispers to leak in excerpts posts_nearby was checking topic access but then returning all posts regardless of type, including whispers that should only be visible to whisperers. Use Post.secured(guardian) to properly filter post types based on user permissions.

• Martin Brennan (17 Feb 26)

  SECURITY: DM communication-preference bypass when adding members DM communication-preference bypass when adding members via `Chat::AddUsersToChannel` — a user could add targets who have blocked/ignored/muted them to an existing DM channel, bypassing per-recipient PM restrictions that are enforced during DM channel creation.

• Martin Brennan (17 Feb 26)

  SECURITY: Ensure guardian check when creating QueryGroupBookmark Missing `validate_before_create` authorization in Data Explorer's `QueryGroupBookmarkable` allows any logged-in user to create bookmarks for query groups they don't have access to, enabling metadata disclosure via bookmark reminder notifications. Also make sure `validate_before_create` throws NotImplementedError in BaseBookmarkable if not implemented, to prevent similar issues in the future.

• Joffrey JAFFEUX (17 Feb 26)

  SECURITY: SQL injection in PM tag filtering SQL injection in PM tag filtering (`list_private_messages_tag`) allows bypassing tag filter conditions, potentially disclosing unauthorized private message metadata.

• Joffrey JAFFEUX (17 Feb 26)

  SECURITY: XSS when editing a malicious post A user full name can be evaluated as raw HTML when the following settings are set: - `display_name_on_posts` => true - `prioritize_username_in_ux` => false Editing a post of a malicious user would trigger and XSS. The fix is to escape the content.

• David Battersby (16 Feb 26)

  SECURITY: prevent moderators from exporting user Chat DMs

• Joffrey JAFFEUX (17 Feb 26)

  SECURITY: Validate destination topic when moving posts The `move_posts` action only checked `can_move_posts?` on the source topic but never validated write permissions on the destination topic. This allowed TL4 users and category group moderators to move posts into topics in categories where they lack posting privileges (e.g., read-only categories or categories with group-restricted write access). The merge_topic action already correctly called `ensure_can_create_post_on_topic!` on the destination. This applies the same check to move_posts when a destination_topic_id is provided.

• Régis Hanol (26 Feb 26)

  DEV: Add context option to addKeyboardShortcut for scoped bindings (#38077) ItsATrap's _bindSingle splices out existing callbacks when rebinding the same key combo. This means plugins that register shortcuts for keys already bound by Discourse (e.g. j/k/h/l) permanently replace the default handlers — even when the plugin's own guard returns early on non-matching routes. This was introduced by https://github.com/discourse/discourse-kanban/pull/3 which registered vim-style navigation shortcuts that broke j/k site-wide. Add a `context` option to `addShortcut` that accepts either a CSS selector string or a function. Before rebinding, the wrapper captures the previous ItsATrap callback from `_directMap`. At runtime, if the context matches (element exists in DOM / function returns truthy), the new handler fires; otherwise the previous handler fires instead. This naturally supports chaining — multiple plugins binding the same key each capture the previous wrapped callback, forming a fallback chain.

• Loïc Guitaut (26 Feb 26)

  DEV: Bump `latest` branch version on security fixes (#37774) When security fixes are staged for the main branch via the `stage_security_fixes` task, the development version is now automatically incremented (e.g. `2026.2.0-latest` to `2026.2.0-latest.1`). This ensures each security fix batch gets its own tagged version, allowing docker_manager to detect that installations on `latest` need a critical update. To support this, a new `ReleaseUtils::Version` value object encapsulates version parsing, comparison, and manipulation logic that was previously done through ad-hoc string splitting and `Gem::Version` comparisons in release.rake. It understands Discourse's versioning scheme (major.minor.patch-pre.revision) and provides methods like `#next_revision`, `#same_development_cycle?`, and `#next_development_cycle`. All existing rake tasks have been refactored to use `Version` objects, the unused `parse_current_version` helper and `prepare_next_version_branch` task have been removed, and the release specs have been rewritten following RSpec style guide conventions.

• Jarek Radosz (26 Feb 26)

  FIX: Correctly position user cards (#38072) (best viewed with white-space disabled) This partially reverts c333888 * removed unnecessary `schedule("afterRender")` - that was already delayed within `next()` * made `DMenuInstance` accept object as `autoUpdate` option to allow configuring floating-ui; this also replaces the separate `updateOnScroll` option * used `layoutShift: false` on user cards so the one that's triggered via chat avatar doesn't move around on scroll * added type check for `maxWidth` option to fix "unsetpx" bug

• chapoi (26 Feb 26)

  UX: allow horizontal overflow on mobile (#38058) On mobile, we prevent the horizontal overflow from working, making it hard to detect there are hidden items. Example with user nav: <img width="784" height="470" alt="CleanShot 2026-02-25 at 14 28 16@2x" src="https://github.com/user-attachments/assets/46136cc7-1e57-42ce-900a-d6c1bad52250" /> I'm not sure why it was restricted in the first place: it seems like a better solution on mobile as well. https://meta.discourse.org/t/admin-button-on-user-page-is-obscured-on-mobile/315330

• Discourse Translator Bot (26 Feb 26)

  I18N: Update translations (#38076)

• Alan Guo Xiang Tan (26 Feb 26)

  FIX: SMTP banner incorrectly showing on login-required sites (#38074) Follow-up to 9f7d0d34c6dc3892eade6b2619f82935a67e324e On login-required sites, the anonymous site payload omits `email_configured`, so the falsy check in the `GlobalNotice` component treated the missing field as "not configured" and showed the SMTP warning banner on the login page. Switch to a strict `=== false` check.

• Martin Brennan (26 Feb 26)

  UX: Introduce d-table__overview-link (#38070) We were inconsistently linking the name/description for tables in the admin UIs. This introduces a new class, d-table__overview-link, that standardises how these links are applied across the admin UIs, and the guidelines at https://meta.discourse.org/t/creating-consistent-admin-interfaces/326780 will be updated accordingly. <img width="1129" height="561" alt="image" src="https://github.com/user-attachments/assets/e877b105-3042-4df1-bc83-1a4f80719f93" />

• Martin Brennan (26 Feb 26)

  FIX: Redirect data explorer API calls to the new endpoint (#38069) Followup e8287d22b08587fa77dbb72c1c8f2d56304b184d The above commit didn't cover redirecting API calls like POST /admin/plugins/explorer/queries/:id/run. This commit makes sure all the route redirects are there, here is the list: - GET /admin/plugins/explorer — redirect → /admin/plugins/discourse-data-explorer - GET /admin/plugins/explorer/queries — redirect → /admin/plugins/discourse-data-explorer/queries - GET /admin/plugins/explorer/queries/:id — redirect → /admin/plugins/discourse-data-explorer/queries/%{id} - GET /admin/plugins/explorer/schema — query#schema - GET /admin/plugins/explorer/groups — query#groups - POST /admin/plugins/explorer/queries — query#create - PUT /admin/plugins/explorer/queries/:id — query#update - DELETE /admin/plugins/explorer/queries/:id — query#destroy - POST /admin/plugins/explorer/queries/:id/run — query#run Also added specs to cover legacy routes

• chapoi (26 Feb 26)

  DEV: update sort order of plugin reports (#38054) Plugin report groups on the admin reporting page were ordered by the title of whichever report in each plugin happened to come first alphabetically — not by the plugin name itself. This meant the group order was unintuitive and could shift when the interface language changed. See https://meta.discourse.org/t/admin-reporting-analysis-incremental-changes/395768/8 This commit sorts the plugin groups by their display name instead.

• chapoi (26 Feb 26)

  UX: add overflow for FAQ nav pills (#38059) Currently our FAQ page nav-pills can overflow and cause a page shift: <img width="766" height="1424" alt="CleanShot 2026-02-25 at 14 41 16@2x" src="https://github.com/user-attachments/assets/b41ad773-6e68-4988-9a5c-b9d0a9c43293" /> This commit: * removes the gap to save some space (there is enough space due to the button internal padding) * sets an overflow handler

• Natalie Tay (26 Feb 26)

  DEV: Remove dead code n locs (#38050) These are not used any more.

• Martin Brennan (26 Feb 26)

  FEATURE: Remove experimental label & setting toggle for what's new (#38008) We now have upcoming changes which makes the related setting toggle and experimental label for the what's new page redundant. This commit removes both as a first step towards merging these two pages together.

• Martin Brennan (25 Feb 26)

  UX: Use d-table classes instead of legacy d-admin-table (#38048) In https://github.com/discourse/discourse/pull/33531 we introduced the d-table class as a generic alternative to d-admin-table, meant to replace it. However we didn't update https://meta.discourse.org/t/creating-consistent-admin-interfaces/326780 properly, nor did we update all places in the code that used the old CSS classes, so over time we've ended up with a mix of both. This commit updates all admin tables to use the new d-table classes, and removes the old d-admin-table classes, updating templates, CSS, and system specs as necessary. We will remove the admin_table.scss file in a followup PR, since other plugins may be using these classes.