6e11754642
A bug in the implementation of the can_forge_sender permission (previously is_api_super_user) resulted in users with this permission being able to send messages appearing as if sent by a system bots, including to other organizations hosted by the same Zulip installation. - The send message API had a bug allowing an api super user to use forging to send messages to other realms' streams, as a cross-realm bot. We fix this most directly by eliminating the realm_str parameter - it is not necessary for any valid current use case. The email gateway doesn't use this API despite the comment in that block suggesting otherwise. - The conditionals inside access_stream_for_send_message are changed up to improve security. They were generally not ordered very well, allowing the function to successfully return due to very weak acceptance conditions - skipping the higher importance checks that should lead to raising an error. - The query count in test_subs is decreased because access_stream_for_send_message returns earlier when doing its check for a cross-realm bot sender - some subscription checking queries are skipped. - A linkifier test in test_message_dict needs to be changed. It didn't make much sense in the first place, because it was creating a message by a normal user, to a stream outside of the user's realm. That shouldn't even be allowed. |
||
|---|---|---|
| .github | ||
| .tx | ||
| analytics | ||
| confirmation | ||
| corporate | ||
| docs | ||
| frontend_tests | ||
| locale | ||
| pgroonga | ||
| puppet | ||
| requirements | ||
| scripts | ||
| static | ||
| stubs | ||
| templates | ||
| tools | ||
| var/puppeteer | ||
| zerver | ||
| zilencer | ||
| zproject | ||
| zthumbor | ||
| .browserslistrc | ||
| .codecov.yml | ||
| .editorconfig | ||
| .eslintignore | ||
| .eslintrc.json | ||
| .gitattributes | ||
| .gitignore | ||
| .gitlint | ||
| .mailmap | ||
| .npmignore | ||
| .prettierignore | ||
| .pyre_configuration | ||
| .sonarcloud.properties | ||
| .yarnrc | ||
| CODE_OF_CONDUCT.md | ||
| CONTRIBUTING.md | ||
| Dockerfile-postgresql | ||
| LICENSE | ||
| NOTICE | ||
| README.md | ||
| SECURITY.md | ||
| Vagrantfile | ||
| babel.config.js | ||
| manage.py | ||
| mypy.ini | ||
| package.json | ||
| postcss.config.js | ||
| prettier.config.js | ||
| pyproject.toml | ||
| setup.cfg | ||
| stylelint.config.js | ||
| tsconfig.json | ||
| version.py | ||
| webpack.config.ts | ||
| yarn.lock | ||
README.md
Zulip overview
Zulip is a powerful, open source group chat application that combines the immediacy of real-time chat with the productivity benefits of threaded conversations. Zulip is used by open source projects, Fortune 500 companies, large standards bodies, and others who need a real-time chat system that allows users to easily process hundreds or thousands of messages a day. With over 700 contributors merging over 500 commits a month, Zulip is also the largest and fastest growing open source group chat project.
Getting started
Click on the appropriate link below. If nothing seems to apply, join us on the Zulip community server and tell us what's up!
You might be interested in:
-
Contributing code. Check out our guide for new contributors to get started. Zulip prides itself on maintaining a clean and well-tested codebase, and a stock of hundreds of beginner-friendly issues.
-
Contributing non-code. Report an issue, translate Zulip into your language, write for the Zulip blog, or give us feedback. We would love to hear from you, even if you're just trying the product out.
-
Supporting Zulip. Advocate for your organization to use Zulip, become a sponsor, write a review in the mobile app stores, or upvote Zulip on product comparison sites.
-
Checking Zulip out. The best way to see Zulip in action is to drop by the Zulip community server. We also recommend reading Zulip for open source, Zulip for companies, or Zulip for working groups and part time communities.
-
Running a Zulip server. Use a preconfigured DigitalOcean droplet, install Zulip directly, or use Zulip's experimental Docker image. Commercial support is available; see https://zulip.com/plans for details.
-
Using Zulip without setting up a server. https://zulip.com offers free and commercial hosting, including providing our paid plan for free to fellow open source projects.
-
Participating in outreach programs like Google Summer of Code.
You may also be interested in reading our blog or following us on Twitter. Zulip is distributed under the Apache 2.0 license.