Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
zulip/zerver
History
Alex Vandiver bedb68b2fe registration: Prevent injecting arbitrary strings via query param. 
While the query parameter is properly excaped when inlined into the
template (and thus is not an XSS), it can still produce content which
misleads the user via carefully-crafted query parameter.

Validate that the parameter looks like an email address.

Thanks to jinjo2 for reporting this, via HackerOne.
 		2023-12-14 12:00:16 -08:00
..
actions models: Make ScheduledMessage.read_by_sender non-nullable. 2023-12-14 08:16:31 -08:00
data_import python: Consistently use from…import for datetime. 2023-12-05 12:01:18 -08:00
integration_fixtures/nagios
…
lib message_send: Add read_by_sender API parameter. 2023-12-14 08:16:31 -08:00
management send_custom_email: Support JSON extra context with remote servers. 2023-12-13 22:28:20 -08:00
migrations models: Make ScheduledMessage.read_by_sender non-nullable. 2023-12-14 08:16:31 -08:00
openapi message_send: Add read_by_sender API parameter. 2023-12-14 08:16:31 -08:00
tests registration: Prevent injecting arbitrary strings via query param. 2023-12-14 12:00:16 -08:00
tornado tornado: Handle the handler having been cleared by connection close. 2023-12-12 10:29:37 -08:00
transaction_tests mypy: Enable new error explicit-override. 2023-10-12 12:28:41 -07:00
views registration: Prevent injecting arbitrary strings via query param. 2023-12-14 12:00:16 -08:00
webhooks python: Use urlsplit instead of urlparse. 2023-12-05 13:03:07 -08:00
worker remote_server: Rename to 'send_server_data_to_push_bouncer'. 2023-12-11 14:07:39 -08:00
__init__.py
…
apps.py mypy: Enable new error explicit-override. 2023-10-12 12:28:41 -07:00
context_processors.py context_processors: Add common context to be used in corporate pages. 2023-12-08 12:26:12 -08:00
decorator.py python: Use urlsplit instead of urlparse. 2023-12-05 13:03:07 -08:00
filters.py mypy: Enable new error explicit-override. 2023-10-12 12:28:41 -07:00
forms.py registration: Set the organization language at creation time. 2023-10-26 16:27:35 -07:00
logging_handlers.py
…
middleware.py requests: Add SELF_HOSTING_MANAGEMENT_SUBDOMAIN. 2023-11-22 14:22:26 -08:00
models.py models: Make ScheduledMessage.read_by_sender non-nullable. 2023-12-14 08:16:31 -08:00
signals.py email: Add a space after the time and AM/PM in the login email. 2023-11-27 09:47:30 -08:00