summary refs log tree commit diff
path: root/synapse
diff options
context:
space:
mode:
authorNeil Johnson <neil@matrix.org>2018-06-08 15:46:18 +0100
committerNeil Johnson <neil@matrix.org>2018-06-08 15:46:18 +0100
commit1032393dfb0c865fc540539dfe649e7b1a32037a (patch)
treec80da0170f841f1d05a781d73ada9e16ecbbb1be /synapse
parentMerge tag 'v0.31.0' (diff)
parenttweak changelog (diff)
downloadsynapse-1032393dfb0c865fc540539dfe649e7b1a32037a.tar.xz
Merge tag 'v0.31.1'
Changes in synapse v0.31.1 (2018-06-08)
=======================================

v0.31.1 fixes a security bug in the ``get_missing_events`` federation API
where event visibility rules were not applied correctly.

We are not aware of it being actively exploited but please upgrade asap.

Bug Fixes:

* Fix event filtering in get_missing_events handler (PR #3371)
Diffstat (limited to '')
-rw-r--r--synapse/__init__.py2
-rw-r--r--synapse/handlers/federation.py4
2 files changed, 5 insertions, 1 deletions
diff --git a/synapse/__init__.py b/synapse/__init__.py
index ca113db434..78fc63aa49 100644
--- a/synapse/__init__.py
+++ b/synapse/__init__.py
@@ -16,4 +16,4 @@
 """ This is a reference implementation of a Matrix home server.
 """
 
-__version__ = "0.31.0"
+__version__ = "0.31.1"
diff --git a/synapse/handlers/federation.py b/synapse/handlers/federation.py
index fcf94befb7..495ac4c648 100644
--- a/synapse/handlers/federation.py
+++ b/synapse/handlers/federation.py
@@ -1794,6 +1794,10 @@ class FederationHandler(BaseHandler):
             min_depth=min_depth,
         )
 
+        missing_events = yield self._filter_events_for_server(
+            origin, room_id, missing_events,
+        )
+
         defer.returnValue(missing_events)
 
     @defer.inlineCallbacks