Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
zulip/zerver/views
History
Mateusz Mandera a014ef75a3 CVE-2021-43791: Validate confirmation keys in /accounts/register/ codepath. 
A confirmation link takes a user to the check_prereg_key_and_redirect
endpoint, before getting redirected to POST to /accounts/register/. The
problem was that validation was happening in the check_prereg_key_and_redirect
part and not in /accounts/register/ - meaning that one could submit an
expired confirmation key and be able to register.

We fix this by moving validation into /accouts/register/.
 		2021-12-01 23:14:04 +00:00
..
development auth: Add login buttons for web public access. 2021-10-05 16:30:40 -07:00
__init__.py
…
alert_words.py request: Rename validator parameter of REQ to json_validator. 2021-04-07 14:13:06 -07:00
attachments.py python: Reformat with Black, except quotes. 2021-02-12 13:11:19 -08:00
auth.py auth: Include user_id in the params returned at the end of mobile flow. 2021-11-16 12:12:59 -08:00
compatibility.py python: Migrate most json_error => JsonableError. 2021-06-30 16:22:38 -07:00
custom_profile_fields.py types: Fix declared type of custom profile field values. 2021-09-22 16:22:46 -07:00
digest.py mypy: Fix most AnonymousUser type errors. 2021-07-24 14:55:46 -07:00
documentation.py request: Refactor ZulipRequestNotes to RequestNotes. 2021-09-03 08:48:45 -07:00
drafts.py drafts: Extract all of the real work to lib functions. 2021-07-28 16:33:01 -07:00
email_mirror.py python: Migrate most json_error => JsonableError. 2021-06-30 16:22:38 -07:00
events_register.py request: Refactor ZulipRequestNotes to RequestNotes. 2021-09-03 08:48:45 -07:00
home.py realm: Add option to enable/disable spectator login. 2021-11-18 12:55:12 -08:00
hotspots.py python: Migrate most json_error => JsonableError. 2021-06-30 16:22:38 -07:00
invite.py do_invite_users: Turn some args into kwargs-only. 2021-09-10 16:53:03 -07:00
message_edit.py settings: Add moderators and members option in delete_own_message_policy. 2021-09-30 14:59:31 -07:00
message_fetch.py realm: Add option to enable/disable spectator login. 2021-11-18 12:55:12 -08:00
message_flags.py request: Refactor ZulipRequestNotes to RequestNotes. 2021-09-03 08:48:45 -07:00
message_send.py request: Refactor ZulipRequestNotes to RequestNotes. 2021-09-03 08:48:45 -07:00
muting.py muting: Add support for muting deactivated users. 2021-07-07 10:44:18 -07:00
portico.py realm: Rename plan type constants to be more descriptive. 2021-10-19 12:20:39 -07:00
presence.py request: Refactor ZulipRequestNotes to RequestNotes. 2021-09-03 08:48:45 -07:00
push_notifications.py python: Fix mypy no_implicit_reexport errors. 2021-07-16 14:02:31 -07:00
reactions.py python: Fix mypy no_implicit_reexport errors. 2021-07-16 14:02:31 -07:00
realm.py realm: Add option to enable/disable spectator login. 2021-11-18 12:55:12 -08:00
realm_domains.py python: Migrate most json_error => JsonableError. 2021-06-30 16:22:38 -07:00
realm_emoji.py realm: Extend add_custom_emoji_policy to use COMMON_POLICY_TYPES. 2021-07-27 16:41:23 -07:00
realm_export.py typing: Use assertions for function arguments. 2021-07-26 14:48:45 -07:00
realm_icon.py url_encoding: Use proper parsing for query string appending. 2021-10-14 12:47:43 -07:00
realm_linkifiers.py exceptions: Add ValidationFailureError. 2021-07-06 09:44:45 -07:00
realm_logo.py url_encoding: Use proper parsing for query string appending. 2021-10-14 12:47:43 -07:00
realm_playgrounds.py python: Fix mypy no_implicit_reexport errors. 2021-07-16 14:02:31 -07:00
registration.py CVE-2021-43791: Validate confirmation keys in /accounts/register/ codepath. 2021-12-01 23:14:04 +00:00
report.py request: Refactor ZulipRequestNotes to RequestNotes. 2021-09-03 08:48:45 -07:00
storage.py python: Fix mypy no_implicit_reexport errors. 2021-07-16 14:02:31 -07:00
streams.py api: Migrate `/update-subscription-settings` response value. 2021-11-26 22:25:53 -08:00
submessage.py python: Fix mypy no_implicit_reexport errors. 2021-07-16 14:02:31 -07:00
thumbnail.py requirements: Remove Thumbor. 2021-05-06 20:07:32 -07:00
tutorial.py api: Fix encoding of strings in tutorial endpoint. 2021-05-07 14:06:54 -07:00
typing.py typing_notifications: Make privacy settings functional. 2021-10-07 17:39:22 -07:00
unsubscribe.py settings: Remove do_change_notification_settings function. 2021-09-08 11:04:44 -07:00
upload.py python: Migrate most json_error => JsonableError. 2021-06-30 16:22:38 -07:00
user_groups.py user_groups: Rename get_memberships_of_users. 2021-10-12 13:57:47 -07:00
user_settings.py email_change: Show deactivated page if realm is now deactivated. 2021-11-14 18:55:40 -08:00
users.py realm: Add option to enable/disable spectator login. 2021-11-18 12:55:12 -08:00
video_calls.py integrations: Switch BigBlueButton over to SHA256. 2021-11-25 07:58:27 -08:00
zephyr.py python: Remove default "utf8" argument for encode(), decode(). 2021-08-02 15:53:52 -07:00