1.24.1 — Chat online-members read gated like message history

2026-09-08

django-mojo 1.24.1 closes an information disclosure in chat: the online-members endpoint answered any signed-in user for any room, private groupless rooms included, so who was online in a DM could be listed by trying room ids. It now applies the same gate as message history. No consumer action is needed.

Security

• GET /api/chat/room/online now requires an active or muted membership on the room, or — on a group-linked room — the group's chat or manage_chat grant: the gate message history already applied. Before this release any signed-in user could list who was online in a private room by trying room ids.
• A banned member is denied like a non-member; a groupless room admits its members only; on a group-linked room a platform-wide manage_chat grant still reads, exactly as it does for history.

Changed

• The response shape of the online-members read is unchanged, and an unknown room still answers 404 before any gate runs, as every other room read does.