IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-11-25 10:20:58 -06:00
Code Issues Packages Projects Releases Wiki Activity
8cf2f909f5
discourse/spec/services
History
Daniel Waterworth 8cade1e825
SECURITY: Prevent large staff actions causing DoS 
This commit operates at three levels of abstraction:

 1. We want to prevent user history rows from being unbounded in size.
    This commit adds rails validations to limit the sizes of columns on
    user_histories,

 2. However, we don't want to prevent certain actions from being
    completed if these columns are too long. In those cases, we truncate
    the values that are given and store the truncated versions,

 3. For endpoints that perform staff actions, we can further control
    what is permitted by explicitly validating the params that are given
    before attempting the action,
2024-03-15 14:24:04 +08:00
..
notifications DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
problem_check DEV: Move non scheduled problem checks to classes (#26122) 2024-03-14 10:55:01 +08:00
anonymous_shadow_creator_spec.rb DEV: Automatically update groups for test users with explicit TL (#25415) 2024-01-29 17:52:02 +08:00
auto_silence_spec.rb DEV: Convert min_trust_to_flag_posts setting to groups (#24864) 2023-12-13 17:18:42 +08:00
badge_granter_spec.rb DEV: Convert min_trust_to_create_topic to groups (#24740) 2023-12-13 14:50:13 +11:00
base_bookmarkable_spec.rb FIX: Show deleted bookmark reminders in user bookmarks menu (#25905) 2024-02-29 09:03:49 +10:00
category_hashtag_data_source_spec.rb FEATURE: Async load of category and chat hashtags (#25526) 2024-02-12 12:07:14 +02:00
color_scheme_revisor_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
destroy_task_spec.rb DEV: Fix various rubocop lints (#24749) 2023-12-06 23:25:00 +01:00
email_settings_exception_handler_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
email_settings_validator_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
email_style_updater_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
external_upload_manager_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
flag_sockpuppets_spec.rb DEV: Fix Lint/BooleanSymbol (#24747) 2023-12-06 13:19:09 +01:00
group_action_logger_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
group_mentions_updater_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
group_message_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
hashtag_autocomplete_service_spec.rb FEATURE: Async load of category and chat hashtags (#25526) 2024-02-12 12:07:14 +02:00
heat_settings_updater_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
inline_uploads_multisite_spec.rb DEV: Fix various rubocop lints (#24749) 2023-12-06 23:25:00 +01:00
inline_uploads_spec.rb DEV: Fix various rubocop lints (#24749) 2023-12-06 23:25:00 +01:00
notification_emailer_spec.rb FIX: Avoid sending user emails if @ mentioning a staged user in a topic (#26102) 2024-03-13 11:05:34 +08:00
post_action_notifier_spec.rb DEV: Convert min_trust_to_create_topic to groups (#24740) 2023-12-13 14:50:13 +11:00
post_alerter_spec.rb FIX: Avoid sending user emails if @ mentioning a staged user in a topic (#26102) 2024-03-13 11:05:34 +08:00
post_bookmarkable_spec.rb FIX: Show deleted bookmark reminders in user bookmarks menu (#25905) 2024-02-29 09:03:49 +10:00
post_owner_changer_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
push_notification_pusher_spec.rb DEV: Add modifiers for plugins to customize push notification translation arguments (#25889) 2024-02-27 14:03:55 -06:00
random_topic_selector_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
search_indexer_spec.rb DEV: Remove lazy-yt and replace with lazy-videos (#20722) 2023-03-29 11:54:25 -04:00
sidebar_site_settings_backfiller_spec.rb DEV: Fix various spec linting issues (#24672) 2023-12-04 13:45:19 +01:00
site_settings_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
staff_action_logger_spec.rb SECURITY: Prevent large staff actions causing DoS 2024-03-15 14:24:04 +08:00
tag_hashtag_data_source_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
theme_settings_migrations_runner_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
themes_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
topic_bookmarkable_spec.rb FIX: Show deleted bookmark reminders in user bookmarks menu (#25905) 2024-02-29 09:03:49 +10:00
topic_status_updater_spec.rb DEV: Convert min_trust_to_create_topic to groups (#24740) 2023-12-13 14:50:13 +11:00
topic_summarization_spec.rb FEATURE: Prefer topic_embed's cached content when summarizing (#25190) 2024-01-09 14:00:01 -03:00
topic_timestamp_changer_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
trust_level_granter_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
user_activator_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
user_anonymizer_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
user_authenticator_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
user_destroyer_spec.rb DEV: Convert min_trust_to_post_links to groups (#25298) 2024-01-18 14:08:40 +08:00
user_merger_spec.rb DEV: Use freeze_time_safe in more places (#25949) 2024-03-01 10:07:35 +10:00
user_notification_schedule_processor_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
user_silencer_spec.rb DEV: update syntax tree to latest (#24623) 2023-11-29 16:38:07 +11:00
user_stat_count_updater_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
user_updater_spec.rb DEV: Change min_trust_level_to_allow_profile_background to trust level setting (#25721) 2024-02-19 10:47:47 +10:00
username_changer_spec.rb DEV: Update username in new quote format - Part 1 (#22032) 2023-06-14 16:14:11 +08:00
username_checker_service_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
wildcard_domain_checker_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
wildcard_url_checker_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
word_watcher_spec.rb DEV: Refactor watched words (#24163) 2023-11-01 16:41:10 +02:00