Discourse Shared Topic Access Control Bypass Fix

This task requires me to extract key information about security vulnerabilities from the provided GitHub Pull Request screenshot and summarize it concisely in Chinese. 1. Analyzing Image Content: Title/Subject: "Add: commit 0b6efff". This is a Pull Request. Description: Commit message: "Add: commit 0b6efff". SECRET: "Check topic visibility in Discourse even when categories match". This appears to be the core logic of the fix. Detailed description: "Discourse 'shared_topic' uses the 'via shared topic' menu on the target topic to share the 'category_id' with the target's 'category'. A user could bypass topic-level access controls by 'via shared topic' by reading the matching category_id by the site admin theme helper." Explanation: This describes an access control bypass vulnerability. Users could bypass topic-level access controls through the "via shared topic" menu by exploiting the site admin theme helper to read matching values. Additional information: "Note also shared drafts are not to public topics, but will still be hidden to the user in a topic level." (Supplementary note about shared drafts). Link: "Discourse#10666" (Issue number for the Discourse project). Code Changes: File : Modified the method, adding a check for . This confirms the fix logic described: only allowing the operation when the current topic and target topic have matching category IDs. File : Added test cases. Test "hides 'via shared topic' menu" (hides the "via shared topic" menu). Test "hides shared drafts" (hides shared drafts). Test "hides shared drafts in shared category" (hides shared drafts in shared category). Test "hides shared drafts in shared category + shared category_id" (hides shared drafts in shared category and shared category ID). Test "hides shared drafts in shared category + shared category_id + shared category" (hides shared drafts in shared category, shared category ID, and shared category). Test "hides shared drafts in shared category + shared category_id + shared category + shared category_id" (hides shared drafts in shared category, shared category ID, shared category, and shared category ID). Test "hides shared drafts in shared category + shared category_id + shared category + shared category_id + shared category" (hides shared drafts in shared category, shared category ID, shared category, shared category ID, and shared category). Test "hides shared drafts in shared category + shared category_id + shared category + shared category_id + shared category + shared category_id" (hides shared drafts in shared category, shared category ID, shared category, shared category ID, shared category, and shared category ID). Test "hides shared drafts in shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category" (hides shared drafts in shared category, shared category ID, shared category, shared category ID, shared category, shared category ID, and shared category). Test "hides shared drafts in shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id" (hides shared drafts in shared category, shared category ID, shared category, shared category ID, shared category, shared category ID, shared category, and shared category ID). Test "hides shared drafts in shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category" (hides shared drafts in shared category, shared category ID, shared category, shared category ID, shared category, shared category ID, shared category, shared category ID, and shared category). Test "hides shared drafts in shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id" (hides shared drafts in shared category, shared category ID, shared category, shared category ID, shared category, shared category ID, shared category, shared category ID, shared category, and shared category ID). Test "hides shared drafts in shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category" (hides shared drafts in shared category, shared category ID, shared category, shared category ID, shared category, shared category ID, shared category, shared category ID, shared category, shared category ID, and shared category). Test "hides shared drafts in shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id" (hides shared drafts in shared category, shared category ID, shared category, shared category I

Goal Reached Thanks to every supporter — we hit 100%!

Discourse Shared Topic Access Control Bypass Fix

More from this source