bc426e1bfc
fix: Apply client-requested timeout to federated key queries
...
Also parallelised federation calls in related functions
2026-01-03 16:05:05 +00:00
6c61b3ec5b
fix: Build error two: electric boogaloo
2025-12-31 21:15:28 +00:00
9d9d1170b6
fix: Build error
2025-12-31 21:04:06 +00:00
7be20abcad
style: Fix typo
2025-12-31 20:08:53 +00:00
bf200ad12d
fix: Resolve compile errors
...
me and cargo check are oops now
2025-12-31 20:01:29 +00:00
44851ee6a2
feat: Fall back to remote room summary if local fails
2025-12-31 20:01:29 +00:00
a7e6e6e83f
feat: Allow local server admins to bypass summary visibility checks
...
feat: Allow local server admins to bypass summary visibility checks
Also improve error messages so they aren't so damn long.
2025-12-31 20:01:29 +00:00
8a561fcd3a
chore: Clippy fixes
2025-12-31 19:56:35 +00:00
25c305f473
chore: Fix comment formatting
2025-12-31 19:56:35 +00:00
c565e6ffbc
feat: Restrict where certain admin commands may be used
2025-12-31 19:56:31 +00:00
442f887c98
style: Improve warning regarding admin removal
2025-12-31 19:40:42 +00:00
f8c1e9bcde
feat: Config defined admin list
...
Closes !1246
2025-12-31 19:35:40 +00:00
21324b748f
feat: Enable console feature by default
2025-12-31 19:12:25 +00:00
7c741e62cf
fix: Forbid creators in power levels
2025-12-30 17:34:43 +00:00
12aecf8091
validate membership events returned by remote servers
...
This fixes a vulnerability where an attacker with a malicious remote
server and a user on the local server can trick the local server into
signing arbitrary events. The attacker issue a remote leave as the local
user to a room on the malicious server. Without any validation of the
make_leave response, the local server would sign the attacker-controlled
event and pass it back to the malicious server with send_leave.
The join and knock endpoints are also fixed in this commit, but are less
useful for exploitation because the local server replaces the "content"
field returned by the remote server. Remote invites are unaffected
because we already check that the event returned from /invite has the
same event ID as the event passed to it.
Co-authored-by: timedout <git@nexy7574.co.uk >
Co-authored-by: Jade Ellis <jade@ellis.link >
Co-authored-by: Ginger <ginger@gingershaped.computer >
2025-12-30 15:24:45 +00:00
5e0edd5a1c
feat: Allow configuring the OTLP protocol
2025-12-29 23:33:12 +00:00
d180f5a759
feat: Split otlp exporter into a new, enabled-by-default feature
2025-12-29 23:33:12 +00:00
f163264a82
docs: Update example domains
2025-12-29 23:33:12 +00:00
7350266c80
fix: Don't allow admin room upgrades and fix power levels during upgrade
2025-12-27 04:05:26 +00:00
bf91ce5c7f
feat: Mark v12 as stable
2025-12-21 17:15:16 +00:00
8fd15f26ce
style: Fix clippy
2025-12-21 17:12:36 +00:00
705fa6c5c6
fix: Simplify visibility check code
2025-12-21 17:12:36 +00:00
6f67c27538
fix: Ensure that room ID is present on state events sent to client
...
routes
Mostly fixes !1094
The remaining issue is federation routes
2025-12-21 17:12:35 +00:00
8586d747d1
feat: Run visibility checks on bundled relations
2025-12-21 17:12:35 +00:00
11012a9ce1
fix: Always return the same 404 message in context
2025-12-21 17:12:35 +00:00
07be190507
fix: Return 404 when event is not accessible
2025-12-21 17:12:35 +00:00
ae4acc9568
fix: Don't incorrectly add thread root to relation response
2025-12-21 17:12:35 +00:00
f83ddecd8c
refactor(perf): Push down visibility check after limit
2025-12-21 17:12:34 +00:00
dd87232f1f
refactor: Reduce database lookups in some cases
2025-12-21 17:12:34 +00:00
8e33f9a7d0
refactor: Improve code style for bundled aggregations
2025-12-21 17:12:34 +00:00
8d3e4eba99
fix: Add aggregations to the search endpoint
2025-12-21 17:12:34 +00:00
96bfdb97da
fix: Filter out invalid replacements from bundled aggregations
2025-12-21 17:12:34 +00:00
b61010da47
feat: Add bundled aggregations support
...
Add support for the m.replace and m.reference bundled
aggregations.
This should fix plenty of subtle client issues.
Threads are not included in the new code as they have
historically been written to the database. Replacing the
old system would result in issues when switching away from
continuwuity, so saved for later.
Some TODOs have been left re event visibility and ignored users.
These should be OK for now, though.
2025-12-21 17:12:34 +00:00
987c5eeb03
refactor: Promote handling unsigned data out of timeline
...
Also fixes:
- Transaction IDs leaking in event route
- Age not being set for event relations or threads
- Both of the above for search results
Notes down concern with relations table
2025-12-21 17:12:33 +00:00
7fa4fa9862
fix: Also check sender origin
2025-12-21 10:58:50 +00:00
b2bead67ac
fix: Apply additional validation to invites
2025-12-21 10:10:54 +00:00
48a6a475ce
fix: Omit children with invalid state from space summary
2025-12-18 19:48:58 +00:00
86450da705
style: Run clippy
2025-12-18 19:48:26 +00:00
8538b21860
feat: Check for incoming signatures
2025-12-18 19:03:32 +00:00
63e4aacd2b
style: Reword TODO comment
2025-12-18 18:24:00 +00:00
72f0eb9493
feat: Fetch policy server signatures
2025-12-18 18:23:54 +00:00
867d0ab671
fix(reload): Store paths to config files for admin reload
...
Paths given via --config at startup are now stored inside the config
struct at runtime, to make it possible to reload config without setting
an env var for the config file location.
2025-12-16 14:58:33 +00:00
64e187e5b4
fix: Update comment in src/core/config/mod.rs
2025-12-16 14:19:43 +00:00
cdc53b3421
fix: Allow using LDAP passwords in UIAA
...
Fixes #1131
Co-authored-by: Jade Ellis <jade@ellis.link >
2025-12-16 13:55:32 +00:00
4f198fb4ef
fix: Enforce limits when joining rooms
2025-12-13 22:17:47 +00:00
1631c0afa4
fix: Perform additional validation on events
2025-12-13 21:36:20 +00:00
862684af28
fix: remove trailing whitespace from secrets read from secrets file
2025-12-13 16:07:51 +00:00
7345c241a9
fix: Don't halt and catch fire on deserialization errors in MSC4133 migration
2025-12-12 11:16:52 -05:00
cf8d8e4ea6
chore: Post-rebase cleanup
2025-12-09 03:25:04 +00:00
393d341f07
perf: Throttle frequent device metadata updates & centralise site
2025-12-09 03:25:03 +00:00
timedout