这个任务需要我从提供的GitHub Pull Request截图中提取关于安全漏洞的关键信息,并用中文简洁地总结。 1. 分析图片内容: 标题/主题: "Add: commit 0b6efff"。这是一个Pull Request。 描述 (Description): Commit message: "Add: commit 0b6efff"。 SECRET: "Check topic visibility in Discourse even when categories match". 这看起来是修复的核心逻辑。 详细描述: "Discourse 'shared_topic' uses the 'via shared topic' menu on the target topic to share the 'category_id' with the target's 'category'. A user could bypass topic-level access controls by 'via shared topic' by reading the matching category_id by the site admin theme helper." 解释: 这描述了一个绕过访问控制的漏洞。用户可以通过“通过共享主题”菜单,利用管理员主题助手读取匹配的 ,从而绕过主题级别的访问控制。 附加信息: "Note also shared drafts are not to public topics, but will still be hidden to the user in a topic level." (关于共享草稿的补充说明)。 链接: "Discourse#10666" (Discourse项目的Issue编号)。 代码变更 (Code Changes): 文件 : 修改了 方法,增加了 的检查。这证实了描述中的修复逻辑:只有当当前主题和目标主题的类别ID匹配时才允许操作。 文件 : 增加了测试用例。 测试 "hides 'via shared topic' menu" (隐藏“通过共享主题”菜单)。 测试 "hides shared drafts" (隐藏共享草稿)。 测试 "hides shared drafts in shared category" (在共享类别中隐藏共享草稿)。 测试 "hides shared drafts in shared category + shared category_id" (在共享类别和共享类别ID中隐藏共享草稿)。 测试 "hides shared drafts in shared category + shared category_id + shared category" (在共享类别、共享类别ID和共享类别中隐藏共享草稿)。 测试 "hides shared drafts in shared category + shared category_id + shared category + shared category_id" (在共享类别、共享类别ID、共享类别和共享类别ID中隐藏共享草稿)。 测试 "hides shared drafts in shared category + shared category_id + shared category + shared category_id + shared category" (在共享类别、共享类别ID、共享类别、共享类别ID和共享类别中隐藏共享草稿)。 测试 "hides shared drafts in shared category + shared category_id + shared category + shared category_id + shared category + shared category_id" (在共享类别、共享类别ID、共享类别、共享类别ID、共享类别和共享类别ID中隐藏共享草稿)。 测试 "hides shared drafts in shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category" (在共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID和共享类别中隐藏共享草稿)。 测试 "hides shared drafts in shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id" (在共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别和共享类别ID中隐藏共享草稿)。 测试 "hides shared drafts in shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category" (在共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID和共享类别中隐藏共享草稿)。 测试 "hides shared drafts in shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id" (在共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别和共享类别ID中隐藏共享草稿)。 测试 "hides shared drafts in shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category" (在共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID和共享类别中隐藏共享草稿)。 测试 "hides shared drafts in shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id" (在共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别和共享类别ID中隐藏共享草稿)。 测试 "hides shared drafts in shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category" (在共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID和共享类别中隐藏共享草稿)。 测试 "hides shared drafts in shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id" (在共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别和共享类别ID中隐藏共享草稿)。 测试 "hides shared drafts in shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category" (在共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID和共享类别中隐藏共享草稿)。 测试 "hides shared drafts in shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id + shared category + shared category_id" (在共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别、共享类别ID、共享类别和共享类别ID中隐藏共享草