Anders Kaseorg 751b2a03e5 CVE-2022-31168: Fix authorization check for changing bot roles. ... Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. Signed-off-by: Anders Kaseorg <anders@zulip.com>		2022-07-21 17:59:09 -07:00
..
actions	confirmation: Rename STATUS_ACTIVE to STATUS_USED.	2022-07-21 15:17:37 -07:00
data_import	user_profile: Fallback to "" for timezone upon creation.	2022-06-28 16:05:24 -07:00
integration_fixtures/nagios	tests: Add a test for fixtures for non-webhook integrations.	2021-04-28 08:16:51 -07:00
lib	cache: Use getattr to access _cache.	2022-07-20 22:00:05 -07:00
management	typing: Add assertions before accessing settings.	2022-07-15 14:00:56 -07:00
migrations	migrations: Adjust stats size for tsvector to 10k, from 100.	2022-07-19 09:24:06 -07:00
openapi	api-docs: Add warning formatting to important description notes.	2022-07-20 14:36:15 -07:00
tests	CVE-2022-31168: Fix authorization check for changing bot roles.	2022-07-21 17:59:09 -07:00
tornado	decorator: Move tornado notify `data` parameter to `REQ` framework.	2022-07-20 14:23:05 -07:00
views	CVE-2022-31168: Fix authorization check for changing bot roles.	2022-07-21 17:59:09 -07:00
webhooks	integrations: Add RhodeCode webhook integration.	2022-07-13 14:10:00 -07:00
worker	queue_processor: Remove unreachable code.	2022-07-19 17:30:15 -07:00
__init__.py	django: Upgrade Zulip to Django 3.2 LTS.	2021-05-03 08:36:22 -07:00
apps.py	caching: Make sender type optional for flush_cache.	2021-07-26 14:48:07 -07:00
context_processors.py	middleware: Reorder middleware to avoid hasattr checks.	2022-07-14 17:24:24 -07:00
decorator.py	response: Replace json_unauthorized with UnauthorizedError.	2022-07-18 18:01:42 -07:00
filters.py	typing: Fix function signatures.	2021-08-20 05:54:19 -07:00
forms.py	integrations: Fix wrong type annotation.	2022-07-15 14:00:56 -07:00
logging_handlers.py	python: Use Python 3.8 typing.{Protocol,TypedDict}.	2022-04-27 12:57:49 -07:00
middleware.py	middleware: Add isinstance check before retrieving content.	2022-07-15 14:00:56 -07:00
models.py	confirmation: Rename STATUS_ACTIVE to STATUS_USED.	2022-07-21 15:17:37 -07:00
signals.py	requirements: Upgrade to Django 4.0.	2022-07-13 16:07:17 -07:00