diff options
| -rw-r--r-- | changelog.d/4555.bugfix | 1 | ||||
| -rw-r--r-- | changelog.d/4987.misc | 1 | ||||
| -rw-r--r-- | changelog.d/4999.bugfix | 1 | ||||
| -rw-r--r-- | changelog.d/5003.bugfix | 1 | ||||
| -rw-r--r-- | docker/README.md | 5 | ||||
| -rwxr-xr-x | scripts/synapse_port_db | 2 | ||||
| -rw-r--r-- | synapse/handlers/room_member.py | 9 | ||||
| -rw-r--r-- | synapse/static/client/login/js/login.js | 2 |
8 files changed, 18 insertions, 4 deletions
diff --git a/changelog.d/4555.bugfix b/changelog.d/4555.bugfix new file mode 100644 index 0000000000..d596022c3f --- /dev/null +++ b/changelog.d/4555.bugfix @@ -0,0 +1 @@ +Avoid redundant URL encoding of redirect URL for SSO login in the fallback login page. Fixes a regression introduced in [#4220](https://github.com/matrix-org/synapse/pull/4220). Contributed by Marcel Fabian Krüger ("[zaugin](https://github.com/zauguin)"). diff --git a/changelog.d/4987.misc b/changelog.d/4987.misc new file mode 100644 index 0000000000..33490e146f --- /dev/null +++ b/changelog.d/4987.misc @@ -0,0 +1 @@ +README updates: Corrected the default POSTGRES_USER. Added port forwarding hint in TLS section. diff --git a/changelog.d/4999.bugfix b/changelog.d/4999.bugfix new file mode 100644 index 0000000000..acbc191960 --- /dev/null +++ b/changelog.d/4999.bugfix @@ -0,0 +1 @@ +Prevent the ability to kick users from a room they aren't in. diff --git a/changelog.d/5003.bugfix b/changelog.d/5003.bugfix new file mode 100644 index 0000000000..9955dc871f --- /dev/null +++ b/changelog.d/5003.bugfix @@ -0,0 +1 @@ +Fix issue #4596 so synapse_port_db script works with --curses option on Python 3. Contributed by Anders Jensen-Waud <anders@jensenwaud.com>. diff --git a/docker/README.md b/docker/README.md index 44ade63f27..b48d74e09c 100644 --- a/docker/README.md +++ b/docker/README.md @@ -60,7 +60,8 @@ Synapse requires a valid TLS certificate. You can do one of the following: * Provide your own certificate and key (as `${DATA_PATH}/${SYNAPSE_SERVER_NAME}.tls.crt` and `${DATA_PATH}/${SYNAPSE_SERVER_NAME}.tls.key`, or elsewhere by providing an - entire config as `${SYNAPSE_CONFIG_PATH}`). + entire config as `${SYNAPSE_CONFIG_PATH}`). In this case, you should forward + traffic to port 8448 in the container, for example with `-p 443:8448`. * Use a reverse proxy to terminate incoming TLS, and forward the plain http traffic to port 8008 in the container. In this case you should set `-e @@ -138,7 +139,7 @@ Database specific values (will use SQLite if not set): **NOTE**: You are highly encouraged to use postgresql! Please use the compose file to make it easier to deploy. * `POSTGRES_USER` - The user for the synapse postgres database. [default: - `matrix`] + `synapse`] Mail server specific values (will not send emails if not set): diff --git a/scripts/synapse_port_db b/scripts/synapse_port_db index 2fa01d1a18..3de394b035 100755 --- a/scripts/synapse_port_db +++ b/scripts/synapse_port_db @@ -811,7 +811,7 @@ class CursesProgress(Progress): middle_space = 1 items = self.tables.items() - items.sort(key=lambda i: (i[1]["perc"], i[0])) + items = sorted(items, key=lambda i: (i[1]["perc"], i[0])) for i, (table, data) in enumerate(items): if i + 2 >= rows: diff --git a/synapse/handlers/room_member.py b/synapse/handlers/room_member.py index 71ce5b54e5..e432740832 100644 --- a/synapse/handlers/room_member.py +++ b/synapse/handlers/room_member.py @@ -421,6 +421,9 @@ class RoomMemberHandler(object): room_id, latest_event_ids=latest_event_ids, ) + # TODO: Refactor into dictionary of explicitly allowed transitions + # between old and new state, with specific error messages for some + # transitions and generic otherwise old_state_id = current_state_ids.get((EventTypes.Member, target.to_string())) if old_state_id: old_state = yield self.store.get_event(old_state_id, allow_none=True) @@ -446,6 +449,9 @@ class RoomMemberHandler(object): if same_sender and same_membership and same_content: defer.returnValue(old_state) + if old_membership in ["ban", "leave"] and action == "kick": + raise AuthError(403, "The target user is not in the room") + # we don't allow people to reject invites to the server notice # room, but they can leave it once they are joined. if ( @@ -459,6 +465,9 @@ class RoomMemberHandler(object): "You cannot reject this invite", errcode=Codes.CANNOT_LEAVE_SERVER_NOTICE_ROOM, ) + else: + if action == "kick": + raise AuthError(403, "The target user is not in the room") is_host_in_room = yield self._is_host_in_room(current_state_ids) diff --git a/synapse/static/client/login/js/login.js b/synapse/static/client/login/js/login.js index 3a958749a1..e02663f50e 100644 --- a/synapse/static/client/login/js/login.js +++ b/synapse/static/client/login/js/login.js @@ -49,7 +49,7 @@ var show_login = function() { $("#loading").hide(); var this_page = window.location.origin + window.location.pathname; - $("#sso_redirect_url").val(encodeURIComponent(this_page)); + $("#sso_redirect_url").val(this_page); if (matrixLogin.serverAcceptsPassword) { $("#password_flow").show(); |