From c6b1441c52e06b6b8c8715dd3e4d4340aac3a216 Mon Sep 17 00:00:00 2001
From: Richard van der Hoff <richard@matrix.org>
Date: Fri, 8 Jun 2018 11:34:46 +0100
Subject: Fix event filtering in get_missing_events handler

---
 synapse/handlers/federation.py | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'synapse')

diff --git a/synapse/handlers/federation.py b/synapse/handlers/federation.py
index fcf94befb7..495ac4c648 100644
--- a/synapse/handlers/federation.py
+++ b/synapse/handlers/federation.py
@@ -1794,6 +1794,10 @@ class FederationHandler(BaseHandler):
             min_depth=min_depth,
         )
 
+        missing_events = yield self._filter_events_for_server(
+            origin, room_id, missing_events,
+        )
+
         defer.returnValue(missing_events)
 
     @defer.inlineCallbacks
-- 
cgit 1.5.1


From 0eb4722932b4d2d92cd8cca97e1b36bd3b20d38d Mon Sep 17 00:00:00 2001
From: Neil Johnson <neil@matrix.org>
Date: Fri, 8 Jun 2018 15:21:46 +0100
Subject: changelog a bump version

---
 CHANGES.rst         | 10 ++++++++++
 synapse/__init__.py |  2 +-
 2 files changed, 11 insertions(+), 1 deletion(-)

(limited to 'synapse')

diff --git a/CHANGES.rst b/CHANGES.rst
index 3a2a30873f..ff137f481a 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -1,3 +1,13 @@
+Changes in synapse v0.31.1 (2018-06-08)
+=======================================
+
+This release fixes a security bug where event visibility rules were not
+applied correctly to ``get_missing_events``.
+
+Bug Fixes:
+
+ * Fix event filtering in get_missing_events handler (PR #3371)
+
 Changes in synapse v0.31.0 (2018-06-06)
 =======================================
 
diff --git a/synapse/__init__.py b/synapse/__init__.py
index ca113db434..78fc63aa49 100644
--- a/synapse/__init__.py
+++ b/synapse/__init__.py
@@ -16,4 +16,4 @@
 """ This is a reference implementation of a Matrix home server.
 """
 
-__version__ = "0.31.0"
+__version__ = "0.31.1"
-- 
cgit 1.5.1