CodeCow/zulip
1
0
Fork 0
mirror of https://github.com/zulip/zulip.git synced 2026-06-12 21:00:58 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity
2.1.x
zulip/zerver/lib
History
Mateusz Mandera fa07539016 CVE-2020-14215: Fix validation in PreregistrationUser queries. 
The most import change here is the one in maybe_send_to_registration
codepath, as the insufficient validation there could lead to fetching
an expired PreregistrationUser that was invited as an administrator
admin even years ago, leading to this registration ending up in the
new user being a realm administrator.

Combined with the buggy migration in
0198_preregistrationuser_invited_as.py, this led to users incorrectly
joining as organizations administrators by accident.  But even without
that bug, this issue could have allowed a user who was invited as an
administrator but then had that invitation expire and then joined via
social authentication incorrectly join as an organization administrator.

The second change is in ConfirmationEmailWorker, where this wasn't a
security problem, but if the server was stopped for long enough, with
some invites to send out email for in the queue, then after starting it
up again, the queue worker would send out emails for invites that
had already expired.

Backported to the 2.1.x series by tabbott.
2020-06-16 23:16:06 -07:00
..
bugdown CVE-2020-10935: Fix XSS vulnerability in local link rewriting. 2020-04-01 13:35:31 -07:00
url_preview url_preview: Fix parsing of open graph tags. 2019-12-12 15:24:38 -08:00
webhooks webhooks: Log unexpected webhook events separately. 2019-07-22 18:20:53 -07:00
__init__.py [manual] Rename Django app from zephyr to zerver. 2013-08-06 07:39:36 -04:00
actions.py CVE-2020-14215: Fix validation in PreregistrationUser queries. 2020-06-16 23:16:06 -07:00
addressee.py addressee: Clean up type ignores. 2019-08-09 16:39:16 -07:00
alert_words.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
attachments.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
avatar_hash.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
avatar.py avatars: Fix gravatar URLs with EMAIL_ADDRESS_VISIBILITY_ADMINS. 2019-11-05 12:33:20 -08:00
bot_config.py mypy: Remove type ignores for python 3 stubs now present in typeshed. 2019-08-06 23:24:56 -07:00
bot_lib.py streams: Refactor multi-option helpers into separate functions. 2019-02-12 11:10:26 -08:00
bot_storage.py python: Stop importing Length from the wrong file. 2019-02-02 17:09:10 -08:00
bulk_create.py models: Add recipient foreign key in UserProfile and Stream. 2019-12-09 15:14:41 -08:00
cache_helpers.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
cache.py cache: Validate keys before passing them to memcached. 2020-01-13 17:33:41 -08:00
camo.py camo: Clean up type ignores. 2019-08-09 16:39:16 -07:00
ccache.py str_utils: Move force_bytes into ccache.py. 2018-05-15 19:07:32 -07:00
context_managers.py zerver/lib: Use python 3 syntax for typing. 2017-11-21 20:45:52 -08:00
create_user.py models: Add recipient foreign key in UserProfile and Stream. 2019-12-09 15:14:41 -08:00
db.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
debug.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
dev_ldap_directory.py ldap: Fix development environment configuration. 2019-11-08 14:00:24 -08:00
digest.py digest: Switch from emails to user IDs for logging. 2019-11-15 17:07:52 -08:00
display_recipient.py display_recipient: Deduplicate list of display_recipient fields. 2019-08-20 12:22:37 -07:00
domains.py domains: Fix typing for validate_domain. 2019-07-29 15:18:24 -07:00
email_mirror_helpers.py stream settings: Use the .show-sender version of email address. 2019-09-05 11:48:32 -07:00
email_mirror.py email_mirror: Handle encoded attachment filenames. 2020-02-19 12:08:55 -08:00
email_notifications.py email_notifications: Fix missing translation tags on sender. 2020-02-19 12:28:26 -08:00
emoji.py decorator: Extract OrganizationAdministratorRequired common exception. 2019-11-18 15:10:56 -08:00
error_notify.py lint: Fix code that evaded our lint checks for string % non-tuple. 2019-04-23 15:21:37 -07:00
events.py server: Sort user_ids in recent PM conversations. 2020-01-16 12:25:11 -08:00
exceptions.py api: Return a JsonableError if API key of invalid format is given. 2020-01-13 17:34:01 -08:00
export.py models: Add MissedMessageEmailAddress class. 2020-01-13 17:35:34 -08:00
external_accounts.py custom fields: Add default external account custom fields. 2019-08-28 15:35:53 -07:00
fix_unreads.py logging: Switch various logging code paths to use user IDs. 2019-11-15 17:24:01 -08:00
generate_test_data.py test-backend: Move test_messages.json to var/<uuid>/test-backend. 2019-06-24 12:23:09 -07:00
hotspots.py docs: Mention bug in ALWAYS_SEND_ALL_HOTSPOTS feature. 2019-02-27 10:21:30 -08:00
html_diff.py mypy: Remove type: ignores that are unnecessary with new mypy. 2017-11-25 10:06:28 -08:00
html_to_text.py html_to_text: Add delimiters between text from different elements. 2019-05-01 17:35:20 -07:00
i18n.py i18n: Move static/locale back to locale. 2019-07-02 14:57:55 -07:00
import_realm.py import: Make sure the internal realm is created before import. 2020-04-15 16:43:47 -07:00
initial_password.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
integrations.py integrations: Add AlertManager webhook. 2020-03-25 11:39:05 -07:00
logging_util.py settings: Define logging paths with, like, normal human variables. 2019-11-13 12:38:35 -08:00
management.py management: Fix password reset emails being sent to deactivated users. 2019-08-14 10:50:45 -07:00
mdiff.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
mention.py bugdown: Store if message has wildcards in MentionData. 2019-12-02 12:12:35 -08:00
message.py server: Sort user_ids in recent PM conversations. 2020-01-16 12:25:11 -08:00
migrate.py migrate, create_large_indexes: Use CREATE INDEX IF NOT EXISTS. 2019-06-26 11:01:30 -07:00
mobile_auth_otp.py lint: Fix code that evaded our lint checks for string % non-tuple. 2019-04-23 15:21:37 -07:00
name_restrictions.py signup: Add opayq.com to disposable domain whitelist. 2018-08-13 10:56:47 -07:00
narrow.py search: Add streams:public to search entire history of public streams. 2019-08-22 13:40:49 -07:00
onboarding.py api: Use new endpoint for handling reactions. 2019-08-16 14:36:15 -07:00
openapi.py openapi: Fix handling of parameters passed via the URL/path. 2019-08-19 15:06:08 -07:00
outgoing_webhook.py mypy: Upgrade from 0.730 to 0.740. 2019-11-13 12:38:45 -08:00
parallel.py zerver/lib: Use python 3 syntax for typing. 2017-11-18 16:09:04 -08:00
profile.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
push_notifications.py push_notifs: Improve handling of errors when talking to the bouncer. 2019-12-04 09:58:22 -08:00
queue.py queue: Update error callback signatures for Pika 1.1. 2019-11-20 17:23:48 -08:00
rate_limiter.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
realm_description.py html_to_text: Add delimiters between text from different elements. 2019-05-01 17:35:20 -07:00
realm_icon.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
realm_logo.py realm_logo: Remove redundant realm_logo_url function. 2019-08-20 12:07:20 -07:00
redis_utils.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
remote_server.py push_notifs: Handle more requests Exceptions in send_to_push_bouncer. 2019-12-04 09:58:22 -08:00
request.py request: Tighten type checking on REQ. 2019-11-13 12:35:55 -08:00
response.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
rest.py upload: Fix browser caching of uploads with local uploads backend. 2019-10-01 15:15:17 -07:00
retention.py streams: Remove get_stream_recipients function and its uses. 2019-12-12 12:05:42 -08:00
send_email.py email: Convert send_email to use formataddr. 2019-07-22 18:15:58 -07:00
server_initialization.py install: Don't create internal realm in the installation process. 2020-02-19 17:05:28 +01:00
sessions.py logging: Switch various logging code paths to use user IDs. 2019-11-15 17:24:01 -08:00
soft_deactivation.py soft_deactivation: Fix incorrect logging function. 2020-02-19 12:08:55 -08:00
sqlalchemy_utils.py mypy: Set local_partial_types = True. 2018-05-21 22:41:00 -07:00
statistics.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
storage.py docs: Merge front-end-build-process with html-css. 2019-10-23 13:08:36 -07:00
stream_recipient.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
stream_subscription.py mypy: Migrate from mypy_extensions to typing_extensions. 2019-08-05 17:24:09 -07:00
stream_topic.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
streams.py recipients: Remove bulk_get_recipients function and its uses. 2019-12-12 12:00:13 -08:00
subdomains.py get_realm: raise DoesNotExist instead of returning None. 2019-05-06 21:58:16 -07:00
test_classes.py test_classes: Fix bug where UserProfile could be passed to client_post. 2020-02-19 16:59:14 +01:00
test_data.source.txt test_data.source.txt: Replace postmodernism generator text with a play. 2017-08-23 13:00:39 -07:00
test_fixtures.py test_fixtures: Fix buggy reuse of status_dir between databases. 2020-02-19 12:28:26 -08:00
test_helpers.py test_helpers: Set Recipient class attrs in use_db_models. 2020-01-13 17:34:40 -08:00
test_runner.py test_runner: Clean up type ignores. 2019-08-09 16:39:16 -07:00
tex.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
thumbnail.py thumbnail: Tighten fix for CVE-2019-19775 open redirect. 2020-01-16 11:41:12 -08:00
timeout.py mypy: Add assertion in timeout.py. 2018-04-25 08:58:55 -07:00
timestamp.py zerver/lib: Use python 3 syntax for typing. 2017-11-18 16:09:04 -08:00
timezone.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
topic_mutes.py Extract topic_match_sa() helper. 2018-11-07 10:03:53 -08:00
topic.py bugdown: Correctly set has_link attribute on messages. 2019-12-11 17:01:41 +05:30
transfer.py logging: Switch various logging code paths to use user IDs. 2019-11-15 17:24:01 -08:00
type_debug.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
types.py types: Consistently use DisplayRecipientT for display_recipient objects. 2019-08-20 12:15:30 -07:00
unminify.py unminify: Update for webpack chunk splitting. 2019-11-01 18:25:30 -07:00
upload.py bugdown: Fix logic for extracting attachment path_id. 2019-12-12 20:30:26 -08:00
url_encoding.py topic -> subject: Extract get_topic_from_message_info(). 2018-11-14 23:24:06 -08:00
user_agent.py user_agent: Use re.X to make the regex a little more readable. 2018-12-05 14:58:13 -08:00
user_groups.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
user_status.py user status: Add "status_text" support in the backend. 2019-01-24 09:46:35 -08:00
users.py decorator: Extract OrganizationAdministratorRequired common exception. 2019-11-18 15:10:56 -08:00
utils.py utils: Add a function to check if string can be an API key. 2020-01-13 17:33:48 -08:00
validator.py validators: Add check_int_in validator. 2019-11-18 15:14:56 -08:00
video_calls.py zoom: Fix handling of 201 status codes from zoom API. 2019-01-16 15:37:06 -08:00
widget.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
zcommand.py zcommand: Fix broken switch mode message. 2018-08-08 11:29:49 -07:00
zephyr.py python: Remove now-unnecessary str_utils library. 2018-11-27 11:57:54 -08:00