Fix missing source information in group notifications#19247
Draft
geetxnshgoyal wants to merge 2 commits intoopenSUSE:masterfrom
Draft
Fix missing source information in group notifications#19247geetxnshgoyal wants to merge 2 commits intoopenSUSE:masterfrom
geetxnshgoyal wants to merge 2 commits intoopenSUSE:masterfrom
Conversation
geetxnshgoyal
force-pushed
the
group-notification-source-missing
branch
from
27223b4 to
0b4f5d6
Compare
geetxnshgoyal
force-pushed
the
group-notification-source-missing
branch
5 times, most recently
from
bdca20f to
b5a4645
Compare
This change modifies Group#replace_members to manually add/remove users via add_user/remove_user instead of using the users.replace association. This allows us to handle race conditions in add_user where a user might be added concurrently. We also added explicit users.reload in replace_members to unsure the in-memory association remains consistent. Additionally, we added tests to cover the race condition handling in add_user.
geetxnshgoyal
force-pushed
the
group-notification-source-missing
branch
from
f0d3bcb to
b53a3cd
Compare
This update resolves a moderate severity SSRF vulnerability (GHSA-33mh-2634-fwr2) in Faraday < 2.14.1.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #19003
Problem
Group notifications for adding or removing members were missing the originator information (
payload[:who]), leading to notifications that displayed "Someone" as the source of the action.Solution
This PR ensures the originator's login is captured and displayed in group notifications by utilizing the existing thread-local
User.session.Key Changes:
Group#delete_userto correctly populate thewhofield inEvent::RemovedUserFromGroupevents usingUser.session&.login.NotificationGroup#link_textto display the originator's name while maintaining the existing sentence structure.NotificationGroup#descriptionto empty, as the primary action details (who, whom, and group name) are now included in the main notification heading.