master/synapse
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
6f9fab1089
synapse/changelog.d
History
Eric Eastwood 6f9fab1089
Fix open redirect in legacy SSO flow (idp) (#18909) 
- Validate the `idp` parameter to only accept the ones that are known in
the config file
- URL-encode the `idp` parameter for safety's sake (this is the main
fix)

Fix https://github.com/matrix-org/internal-config/issues/1651 (internal
link)

Regressed in https://github.com/element-hq/synapse/pull/17972
2025-09-17 13:54:47 -05:00
..
.gitignore
18583.removal Remove obsolete and experimental /sync/e2ee endpoint. (#18583) 2025-09-09 09:28:45 +01:00
18641.bugfix Ensure we /send PDUs which pass canonical JSON checks (#18641) 2025-09-12 08:54:20 +00:00
18695.feature Add experimental support for MSC4308: Thread Subscriptions extension to Sliding Sync when MSC4306 and MSC4186 are enabled. (#18695) 2025-09-11 14:45:04 +01:00
18791.misc Re-introduce: Fix LaterGauge metrics to collect from all servers (#18791) 2025-09-02 12:14:27 -05:00
18819.misc Configure Synapse to run MSC4306: Thread Subscriptions Complement tests. (#18819) 2025-09-09 11:40:10 +01:00
18823.bugfix Handle rescinding invites over federation (#18823) 2025-09-08 10:55:48 +01:00
18846.feature Configure Synapse to run MSC4306: Thread Subscriptions Complement tests. (#18819) 2025-09-09 11:40:10 +01:00
18848.feature Add get_media_upload_limits_for_user and on_media_upload_limit_exceeded callbacks to module API (#18848) 2025-09-12 12:26:19 +01:00
18856.doc Clarify Python dependency constraints (#18856) 2025-09-15 09:45:41 -05:00
18870.misc Remove sentinel logcontext where we log in setup, start and exit (#18870) 2025-09-16 17:15:08 -05:00
18874.misc fix: Use the Enum's value for the dictionary key when responding to an admin request for experimental features (#18874) 2025-09-09 09:50:09 +01:00
18875.bugfix Fix prefixed support for MSC4133 (#18875) 2025-09-09 09:53:08 +01:00
18878.docker Suppress "Applying schema" log noise bulk when running Complement tests (#18878) 2025-09-02 13:34:47 -05:00
18886.misc Start background tasks after we fork the process (daemonize) (#18886) 2025-09-09 10:10:34 -05:00
18900.misc Better explain logcontext in run_in_background(...) and run_as_background_process(...) (#18900) 2025-09-10 10:22:53 -05:00
18906.misc Better explain which context the task is run in when using run_in_background(...) or run_as_background_process(...) (#18906) 2025-09-12 09:29:35 -05:00
18909.bugfix Fix open redirect in legacy SSO flow (idp) (#18909) 2025-09-17 13:54:47 -05:00
18910.misc Remove usage of deprecated pkg_resources interface (#18910) 2025-09-12 10:57:04 +01:00