zulip/zerver/lib
Mateusz Mandera 8d2d64c100 CVE-2020-14215: Fix validation in PreregistrationUser queries.
The most import change here is the one in maybe_send_to_registration
codepath, as the insufficient validation there could lead to fetching
an expired PreregistrationUser that was invited as an administrator
admin even years ago, leading to this registration ending up in the
new user being a realm administrator.

Combined with the buggy migration in
0198_preregistrationuser_invited_as.py, this led to users incorrectly
joining as organizations administrators by accident.  But even without
that bug, this issue could have allowed a user who was invited as an
administrator but then had that invitation expire and then joined via
social authentication incorrectly join as an organization administrator.

The second change is in ConfirmationEmailWorker, where this wasn't a
security problem, but if the server was stopped for long enough, with
some invites to send out email for in the queue, then after starting it
up again, the queue worker would send out emails for invites that
had already expired.
2020-06-16 23:35:39 -07:00
..
bugdown realm: Remove Google Hangouts integration. 2020-06-16 17:02:27 -07:00
url_preview python: Fix misuse of Optional types for optional parameters. 2020-06-13 15:31:27 -07:00
webhooks python: Fix misuse of Optional types for optional parameters. 2020-06-13 15:31:27 -07:00
__init__.py [manual] Rename Django app from zephyr to zerver. 2013-08-06 07:39:36 -04:00
actions.py CVE-2020-14215: Fix validation in PreregistrationUser queries. 2020-06-16 23:35:39 -07:00
addressee.py python: Convert percent formatting to .format for translated strings. 2020-06-15 16:24:46 -07:00
alert_words.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
attachments.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
avatar_hash.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
avatar.py python: Convert more percent formatting to Python 3.6 f-strings. 2020-06-14 23:27:22 -07:00
bot_config.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
bot_lib.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
bot_storage.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
bulk_create.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
cache_helpers.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
cache.py python: Convert more percent formatting to Python 3.6 f-strings. 2020-06-14 23:27:22 -07:00
camo.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
ccache.py python: Fix misuse of Optional types for optional parameters. 2020-06-13 15:31:27 -07:00
context_managers.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
create_user.py python: Fix misuse of Optional types for optional parameters. 2020-06-13 15:31:27 -07:00
db.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
debug.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
dev_ldap_directory.py python: Convert more percent formatting to Python 3.6 f-strings. 2020-06-14 23:27:22 -07:00
digest.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
display_recipient.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
domains.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
email_mirror_helpers.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
email_mirror.py logging: Use logging.exception and exc_info for unexpected exceptions. 2020-06-14 23:27:22 -07:00
email_notifications.py python: Manually convert more percent-formatting to f-strings. 2020-06-14 23:27:22 -07:00
email_validation.py python: Convert percent formatting to .format for translated strings. 2020-06-15 16:24:46 -07:00
emoji.py python: Convert percent formatting to .format for translated strings. 2020-06-15 16:24:46 -07:00
error_notify.py python: Manually convert more percent-formatting to f-strings. 2020-06-14 23:27:22 -07:00
events.py events: Remove incorrect line from new-stream handler. 2020-06-16 10:41:50 -07:00
exceptions.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
export.py python: Convert more percent formatting to Python 3.6 f-strings. 2020-06-14 23:27:22 -07:00
external_accounts.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
fix_unreads.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
generate_test_data.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
hotspots.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
html_diff.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
html_to_text.py python: Replace None defaults with empty collections where appropriate. 2020-06-13 15:31:27 -07:00
i18n.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
import_realm.py python: Convert more percent formatting to Python 3.6 f-strings. 2020-06-14 23:27:22 -07:00
initial_password.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
integrations.py realm: Remove Google Hangouts integration. 2020-06-16 17:02:27 -07:00
logging_util.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
management.py python: Manually convert more percent-formatting to f-strings. 2020-06-14 23:27:22 -07:00
mdiff.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
mention.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
message.py do_render_markdown: Remove unused message_user_ids parameter. 2020-06-13 15:31:27 -07:00
migrate.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
mobile_auth_otp.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
name_restrictions.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
narrow.py python: Convert percent formatting to .format for translated strings. 2020-06-15 16:24:46 -07:00
onboarding.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
outgoing_webhook.py python: Manually convert more percent-formatting to f-strings. 2020-06-14 23:27:22 -07:00
parallel.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
presence.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
profile.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
push_notifications.py push_notifications: Add support for setting counts in iOS. 2020-06-16 11:26:36 -07:00
pysa.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
queue.py logging: Use logging.exception and exc_info for unexpected exceptions. 2020-06-14 23:27:22 -07:00
rate_limiter.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
realm_description.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
realm_icon.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
realm_logo.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
redis_utils.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
remote_server.py python: Convert percent formatting to .format for translated strings. 2020-06-15 16:24:46 -07:00
request.py python: Convert percent formatting to .format for translated strings. 2020-06-15 16:24:46 -07:00
response.py python: Replace None defaults with empty collections where appropriate. 2020-06-13 15:31:27 -07:00
rest.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
retention.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
send_email.py python: Manually convert more percent-formatting to f-strings. 2020-06-14 23:27:22 -07:00
server_initialization.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
sessions.py logging: Use logging.exception and exc_info for unexpected exceptions. 2020-06-14 23:27:22 -07:00
soft_deactivation.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
sqlalchemy_utils.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
statistics.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
storage.py docs: Merge front-end-build-process with html-css. 2019-10-23 13:08:36 -07:00
stream_recipient.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
stream_subscription.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
stream_topic.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
streams.py python: Convert percent formatting to .format for translated strings. 2020-06-15 16:24:46 -07:00
subdomains.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
test_classes.py email: Migrate to new Python ≥ 3.3 email API. 2020-06-14 20:24:06 -07:00
test_data.source.txt test_data.source.txt: Replace postmodernism generator text with a play. 2017-08-23 13:00:39 -07:00
test_fixtures.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
test_helpers.py python: Fix misuse of Optional types for optional parameters. 2020-06-13 15:31:27 -07:00
test_runner.py python: Fix misuse of Optional types for optional parameters. 2020-06-13 15:31:27 -07:00
tex.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
thumbnail.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
timeout.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
timestamp.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
timezone.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
topic_mutes.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
topic.py message_edit: Do case-insensitive exact match when editing topics. 2020-06-13 16:36:29 -07:00
transfer.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
type_debug.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
types.py types: Convert ProfileDataElement to Python 3.6 style and total. 2020-06-13 15:37:25 -07:00
unminify.py python: Manually convert more percent-formatting to f-strings. 2020-06-14 23:27:22 -07:00
upload.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
url_encoding.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
user_agent.py user_agent: Compile the regular expression. 2020-02-14 10:26:37 -08:00
user_groups.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
user_status.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
users.py python: Convert percent formatting to .format for translated strings. 2020-06-15 16:24:46 -07:00
utils.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
validator.py python: Convert percent formatting to .format for translated strings. 2020-06-15 16:24:46 -07:00
widget.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00
zcommand.py python: Convert percent formatting to .format for translated strings. 2020-06-15 16:24:46 -07:00
zephyr.py python: Sort imports with isort. 2020-06-11 16:45:32 -07:00