thread/post links can leak partial thread-title for non-viewable threads

[XFFA.IR Bot]

A small corner case touching threads/XXXX/post-YYY with a valid thread id but invalid post id can cause XF to issue a redirect to the thread without checking if this thread is visible. This will then leak a url-normalized copy of the thread name.

PHP:

    public function actionPost(ParameterBag $params)
    {
...
        /** @var \XF\Entity\Post $post */
        $post = $this->em()->find('XF:post', $postId, $with);
        if (!$post)
        {
            $thread =...

Read more