From aec1377d0ba09628ffc399eb977ef507fecd1d28 Mon Sep 17 00:00:00 2001
From: Andrew Morgan <andrew@amorgan.xyz>
Date: Wed, 2 Oct 2019 13:55:00 +0100
Subject: 1.4.0rc2

---
 synapse/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'synapse')

diff --git a/synapse/__init__.py b/synapse/__init__.py
index ddfe9ec542..5197eea22e 100644
--- a/synapse/__init__.py
+++ b/synapse/__init__.py
@@ -35,4 +35,4 @@ try:
 except ImportError:
     pass
 
-__version__ = "1.4.0rc1"
+__version__ = "1.4.0rc2"
-- 
cgit 1.5.1


From 0f46bf5737012bb09b40f8e71c5f6db84125df8f Mon Sep 17 00:00:00 2001
From: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>
Date: Thu, 3 Oct 2019 12:57:26 +0100
Subject: Replace client_secret with <redacted> in server logs (#6158)

Replace `client_secret` query parameter values with `<redacted>` in the logs. Prevents a scenario where a MITM of server traffic can horde 3pids on their account.
---
 changelog.d/6158.bugfix  | 1 +
 synapse/http/__init__.py | 6 ++++--
 2 files changed, 5 insertions(+), 2 deletions(-)
 create mode 100644 changelog.d/6158.bugfix

(limited to 'synapse')

diff --git a/changelog.d/6158.bugfix b/changelog.d/6158.bugfix
new file mode 100644
index 0000000000..6b48fce05e
--- /dev/null
+++ b/changelog.d/6158.bugfix
@@ -0,0 +1 @@
+Redact `client_secret` in server logs.
diff --git a/synapse/http/__init__.py b/synapse/http/__init__.py
index 3acf772cd1..3880ce0d94 100644
--- a/synapse/http/__init__.py
+++ b/synapse/http/__init__.py
@@ -42,11 +42,13 @@ def cancelled_to_request_timed_out_error(value, timeout):
 
 
 ACCESS_TOKEN_RE = re.compile(r"(\?.*access(_|%5[Ff])token=)[^&]*(.*)$")
+CLIENT_SECRET_RE = re.compile(r"(\?.*client(_|%5[Ff])secret=)[^&]*(.*)$")
 
 
 def redact_uri(uri):
-    """Strips access tokens from the uri replaces with <redacted>"""
-    return ACCESS_TOKEN_RE.sub(r"\1<redacted>\3", uri)
+    """Strips sensitive information from the uri replaces with <redacted>"""
+    uri = ACCESS_TOKEN_RE.sub(r"\1<redacted>\3", uri)
+    return CLIENT_SECRET_RE.sub(r"\1<redacted>\3", uri)
 
 
 class QuieterFileBodyProducer(FileBodyProducer):
-- 
cgit 1.5.1


From ecb69d824a39d420a20a1c0b24a7174cea392560 Mon Sep 17 00:00:00 2001
From: Andrew Morgan <andrew@amorgan.xyz>
Date: Thu, 3 Oct 2019 13:22:44 +0100
Subject: 1.4.0

---
 CHANGES.md              | 9 +++++++++
 changelog.d/6158.bugfix | 1 -
 debian/changelog        | 6 ++++++
 synapse/__init__.py     | 2 +-
 4 files changed, 16 insertions(+), 2 deletions(-)
 delete mode 100644 changelog.d/6158.bugfix

(limited to 'synapse')

diff --git a/CHANGES.md b/CHANGES.md
index 78322a08c1..165e1d4db4 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,3 +1,12 @@
+Synapse 1.4.0 (2019-10-03)
+==========================
+
+Bugfixes
+--------
+
+- Redact `client_secret` in server logs. ([\#6158](https://github.com/matrix-org/synapse/issues/6158))
+
+
 Synapse 1.4.0rc2 (2019-10-02)
 =============================
 
diff --git a/changelog.d/6158.bugfix b/changelog.d/6158.bugfix
deleted file mode 100644
index 6b48fce05e..0000000000
--- a/changelog.d/6158.bugfix
+++ /dev/null
@@ -1 +0,0 @@
-Redact `client_secret` in server logs.
diff --git a/debian/changelog b/debian/changelog
index 76efc442d7..60c682cc57 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+matrix-synapse-py3 (1.4.0) stable; urgency=medium
+
+  * New synapse release 1.4.0.
+
+ -- Synapse Packaging team <packages@matrix.org>  Thu, 03 Oct 2019 13:22:25 +0100
+
 matrix-synapse-py3 (1.3.1) stable; urgency=medium
 
   * New synapse release 1.3.1.
diff --git a/synapse/__init__.py b/synapse/__init__.py
index 5197eea22e..2d52d26af5 100644
--- a/synapse/__init__.py
+++ b/synapse/__init__.py
@@ -35,4 +35,4 @@ try:
 except ImportError:
     pass
 
-__version__ = "1.4.0rc2"
+__version__ = "1.4.0"
-- 
cgit 1.5.1