summary refs log tree commit diff
path: root/UPGRADE.rst
diff options
context:
space:
mode:
authorKegsay <kegsay@gmail.com>2015-04-22 08:38:26 +0100
committerKegsay <kegsay@gmail.com>2015-04-22 08:38:26 +0100
commit7c50e3b81655b8d4236d0308cd21506ac35b593c (patch)
tree7685f45986d7fda282d70ef865ce5975e5146065 /UPGRADE.rst
parentMuch neater fetching of defined powerlevels from m.room.power_levels state event (diff)
downloadsynapse-7c50e3b81655b8d4236d0308cd21506ac35b593c.tar.xz
Add info on breaking AS API changes
Diffstat (limited to 'UPGRADE.rst')
-rw-r--r--UPGRADE.rst34
1 files changed, 34 insertions, 0 deletions
diff --git a/UPGRADE.rst b/UPGRADE.rst
index 87dd6e04a8..ab327a8136 100644
--- a/UPGRADE.rst
+++ b/UPGRADE.rst
@@ -1,3 +1,37 @@
+Upgrading to v0.x.x
+===================
+
+Application services have had a breaking API change in this version.
+
+They can no longer register themselves with a home server using the AS HTTP API. This
+decision was made because a compromised application service with free reign to register
+any regex in effect grants full read/write access to the home server if a regex of ``.*``
+is used. An attack where a compromised AS re-registers itself with ``.*`` was deemed too
+big of a security risk to ignore, and so the ability to register with the HS remotely has
+been removed.
+
+It has been replaced by specifying a list of application service registrations in
+``homeserver.yaml``::
+
+  app_service_config_files: ["registration-01.yaml", "registration-02.yaml"]
+  
+Where ``registration-01.yaml`` looks like::
+
+  url: <String>  # e.g. "https://my.application.service.com"
+  as_token: <String>
+  hs_token: <String>
+  sender_localpart: <String>  # This is a new field which denotes the user_id localpart when using the AS token
+  namespaces:
+    users:
+      - exclusive: <Boolean>
+        regex: <String>  # e.g. "@prefix_.*"
+    aliases:
+      - exclusive: <Boolean>
+        regex: <String>
+    rooms:
+      - exclusive: <Boolean>
+        regex: <String>
+
 Upgrading to v0.8.0
 ===================