LaPhilosophie f6f363662e fix(discord): fail closed for component button auth when no allowlist set ... Salvage of the Discord half of PR #30964 by @LaPhilosophie. Discord component button callbacks (ExecApprovalView, SlashConfirmView, UpdatePromptView, ModelPickerView) bypass the normal message dispatch authorization path. _component_check_auth previously returned True when both the user and role allowlists were empty, so any guild member who could see an approval prompt could click Approve on a dangerous command. Fail closed instead: require DISCORD_ALLOWED_USERS / DISCORD_ALLOWED_ROLES / GATEWAY_ALLOWED_USERS membership, or an explicit DISCORD_ALLOW_ALL_USERS / GATEWAY_ALLOW_ALL_USERS opt-in for deliberately-open deployments. Mirrors the Telegram (#24457) and Matrix fail-closed precedent. The Slack half of #30964 is superseded by PR #33844's helper. Reported via GHSA-mc26-p6fw-7pp6 (@whyiug). Co-authored-by: LaPhilosophie <804436395@qq.com>		2026-06-07 06:21:37 -07:00
..
__init__.py	refactor(gateway): migrate Discord adapter to bundled plugin (full Teams parity)	2026-05-22 14:21:41 -07:00
adapter.py	fix(discord): fail closed for component button auth when no allowlist set	2026-06-07 06:21:37 -07:00
plugin.yaml	refactor(gateway): migrate Discord adapter to bundled plugin (full Teams parity)	2026-05-22 14:21:41 -07:00
voice_mixer.py	feat(discord): voice-channel mixer — ambient idle bed + verbal acks that overlap TTS (#39659)	2026-06-05 03:10:40 -07:00