Skip to content

FIX: Screened email list exposes IP addresses to moderators without IP-view permission#39875

Merged
tgxworld merged 2 commits into
mainfrom
patch-1033-screened-email-list-exposes-ip-a-8de0b1
May 11, 2026
Merged

FIX: Screened email list exposes IP addresses to moderators without IP-view permission#39875
tgxworld merged 2 commits into
mainfrom
patch-1033-screened-email-list-exposes-ip-a-8de0b1

Conversation

@SamSaffron
Copy link
Copy Markdown
Member

Edge case where in an outlier case moderators can see ip addresses and should not be allowed to

get "/admin/logs/screened_emails.json"

expect(response.status).to eq(200)
expect(response.parsed_body.first).not_to have_key("ip_address")
Copy link
Copy Markdown
Contributor

@tgxworld tgxworld May 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm abit worried about this assertion because it isn't clear what response.parsed_body.first returns. It would be good to have an additional assertion above to validate the right email is being returned first before we assert that the email's payload doesn't include the ip_address key.

@SamSaffron
Copy link
Copy Markdown
Member Author

@patch-triage can you address tgxworlds comment please

@discourse-patch-triage
Copy link
Copy Markdown
Contributor

Applied suggestions and committed the fix.

Improve test assertion for screened email IP address visibility

  • spec/requests/admin/screened_emails_controller_spec.rb

a6255dc

@SamSaffron
Copy link
Copy Markdown
Member Author

@tgxworld it worked !!! look

@tgxworld
Copy link
Copy Markdown
Contributor

@tgxworld it worked !!! look

nicee!!

@tgxworld tgxworld merged commit 8801cb3 into main May 11, 2026
17 checks passed
@tgxworld tgxworld deleted the patch-1033-screened-email-list-exposes-ip-a-8de0b1 branch May 11, 2026 06:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants