Commit Graph
4865 Commits
Author SHA1 Message Date
timedout 23a3ada393 fix: SEC36
Reviewed-By: Jacob Taylor <jacob@explodie.org>
Reviewed-By: Jade Ellis <jade@ellis.link>
Reviewed-By: Ginger <ginger@gingershaped.computer>
2026-11-10 20:39:13 +00:00
Jade Ellis 88441a409a refactor(rooms/timeline): Simplify deduplication of read receipts 2026-11-10 20:02:21 +00:00
Jade Ellis f42955602e test: Add unit test for merging threaded and private receipts 2026-11-10 20:02:21 +00:00
Jade Ellis c7aebd2b52 fix: Deduplicate read receipts and preserve per-thread state 2026-11-10 20:02:20 +00:00
Jade Ellis 61a50a627b fix(client): Add membership checks to read markers 2026-11-10 20:02:20 +00:00
Jade Ellis 76ace2bc09 fix(client): Allow setting read receipts on backfilled events 2026-11-10 20:02:20 +00:00
Jade Ellis e0d3d12654 fix(sync/v3): Pack room receipts into single m.receipt event 2026-11-10 20:02:20 +00:00
Jade Ellis be2f540a9d fix(client): Accurately include receipt senders in lazy loading 2026-11-10 20:02:19 +00:00
Jade Ellis 0368097791 fix(service/sending): Prevent panics and fix receipt limit in federation sender 2026-11-10 20:02:18 +00:00
Ginger 4d7a7d6cdc chore(deps): Clean up features and remove unused dependencies 2026-11-10 13:24:05 -05:00
Jade Ellis 779374bb54 fix(deps): Properly use intended crypto backends 2026-11-08 20:34:05 +00:00
theS1LV3R a9bb74df6d chore: Disable hickory-dns feature from reqwest
As we now pass in our own resolver (and hickory instance) for every client,
having the hickory-dns feature enabled isn't necessary.
2026-11-08 19:40:49 +00:00
theS1LV3R 144777dab0 fix: Add DNS resolver to oidc crate as well
Because openidconnect vendors reqwest (??), we have to re-implement
the entire Resolve trait.

No I don't like it, but I can't think of a better solution.
2026-11-08 19:40:49 +00:00
theS1LV3R a484c28f99 fix: Don't try to use system resolv.conf when other servers are configured
Previously, only HTTP clients targeting matrix servers (and using the
resolution spec) would use the DNS servers configured in the c10y config.
This happened because reqwest requires any DNS resolvers passed in to
implement reqwest::dns::Resolve, which only the matrix resolver did,
and no other HTTP client had a proper DNS resolver (which used the
configured DNS servers) passed into it.

To fix this we make a custom resolution struct based on reqwest's
reqwest::dns::HickoryDnsResolver, which implements Request with no
other modifications to the DNS response. HickoryDnsResolver itself isn't
exported, which is why we re-created it instead of using it directly.

no im not an LLM i just wrote this to remember my own changes later on

Fixes: continuwuation/continuwuity#2441
2026-11-08 19:40:49 +00:00
Henry-Hiles be5ff91eb3 chore: break out of loop when level is empty 2026-11-08 19:34:25 +00:00
Henry-Hiles 5ff6d71e7c chore: Make walk use counts only 2026-11-08 19:34:25 +00:00
Henry-Hiles 2e43797d95 chore: Make Clippy happy 2026-11-08 19:34:25 +00:00
Henry-Hiles 15b4e8e2f9 fix: Correct relations pagination and recursion
Ended up rewriting a fair bit, but should work better.
2026-11-08 19:34:25 +00:00
Jade Ellis 6075e6e3ad chore: Upgrade other dependencies 2026-11-08 17:41:23 +00:00
Ginger 4a3b0366ac feat: Ratelimit CSAPI endpoints 2026-11-05 16:49:48 +00:00
Erwan Leboucher 8c720e5427 fix: Store to-device messages before syncs can read their count 2026-11-05 15:17:36 +00:00
Erwan Leboucher fb389cb6f9 fix: Record device list changes before syncs can read their count
Signed-off-by: Erwan Leboucher <erwanleboucher@gmail.com>
2026-11-05 15:17:23 +00:00
Bardi Harborow db86d42801 fix: Compare push user_is_target against the notified user
`user_is_target` was set by comparing a member event's `state_key` to its
sender, rather than to the user receiving the notification.
2026-11-05 15:27:50 +11:00
Bardi Harborow 223e889459 fix: Return 405 when setting m.fully_read via account data
The spec requires servers to reject client writes to server-managed
account data types with 405 M_BAD_JSON. We returned 400.
2026-11-04 19:32:17 +00:00
Bardi Harborow 219e8d2e1e fix: Return M_UNKNOWN_DEVICE for unknown masqueraded appservice devices
When an appservice masqueraded as a device_id that does not exist for
the user, we returned 403 M_FORBIDDEN. The spec requires 400
M_UNKNOWN_DEVICE.
2026-11-04 19:32:17 +00:00
Bardi Harborow 4d0ccd998f fix: Return M_PROFILE_TOO_LARGE for oversize profiles
Profile updates that would push the profile over 64 KiB were rejected
with an untyped error, producing a 500. The spec requires 400
M_PROFILE_TOO_LARGE, which ruma now provides.
2026-11-04 19:32:17 +00:00
Bardi Harborow 42609eab02 fix: Return M_KEY_TOO_LARGE for oversize profile keys
Profile keys longer than 255 bytes were rejected with 413 M_TOO_LARGE.
The spec requires 400 M_KEY_TOO_LARGE, which ruma now provides.
2026-11-04 19:32:17 +00:00
Bardi Harborow dad9e1426c fix: Advertise m.forget_forced_upon_leave capability according to config 2026-11-04 18:48:40 +00:00
Ginger 34c5787af0 fix: Fix join rule evaluation for servers again
Reviewed-by: timedout <git@nexy7574.co.uk>
Reviewed-by: Jade Ellis <jade@ellis.link>
2026-11-04 12:24:51 -05:00
Ginger c77bbf6d18 fix: Fix busted url_preview feature gate 2026-11-03 20:41:11 -05:00
Erwan Leboucher 0727d564a2 fix: Avoid v12 room ID collisions when creating rooms concurrently
Fixes #2424. v12 rooms created by the same user in the same millisecond got the same room ID, so they ended up as one room.

Reviewed-on: https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2433
Reviewed-by: nex <me@nexy7574.co.uk>
Reviewed-by: Jade Ellis <jade@ellis.link>
2026-11-03 09:52:43 +00:00
timedout f3d8e8d688 chore: Reformat 2026-11-02 00:50:41 +00:00
Ginger dc03f2136a fix: Validate OAuth HTTPS redirect URIs are subdomains of the client domain 2026-11-02 00:44:02 +00:00
Erwan Leboucher abf8f878bc fix: gap fill outliers that are missing prev events
Signed-off-by: Erwan Leboucher <erwanleboucher@gmail.com>
2026-10-31 09:02:27 +01:00
timedout 068ba88378 style: Fix formatting 2026-10-30 00:54:52 +00:00
timedout 60de549cf9 perf: Write empty rows when replacing extremities 2026-10-30 00:51:52 +00:00
timedout 363097b31b fix: Centralise extremity progression 2026-10-30 00:51:52 +00:00
timedout d128207d71 fix: Make the extremity check consistency migration faster 2026-10-30 00:51:51 +00:00
timedout c6832372c2 feat: Add command to enumerate extremities 2026-10-30 00:51:51 +00:00
timedout 14f5f62182 fix: Only consider accepted PDUs in extremity consistency check 2026-10-30 00:51:51 +00:00
timedout 5208efcb5e fix: Make migration handle excessive extremities too 2026-10-30 00:51:51 +00:00
timedout 224cf04936 fix: Never allow unknown/backfilled PDUs to become extremities 2026-10-30 00:51:51 +00:00
timedout ae26d5c239 fix: Add startup migration to re-process existing extremities on-disk 2026-10-30 00:51:51 +00:00
timedout 30f62eef25 style: reformat 2026-10-30 00:51:51 +00:00
timedout b04ffd7e6a fix: Correctly remove extremities after creating a new event 2026-10-30 00:51:51 +00:00
timedout bc15b7b668 fix: Remove dead references to mark_event_referenced 2026-10-30 00:51:50 +00:00
timedout 3eb2788eb9 feat: Only track appended extremities 2026-10-30 00:51:47 +00:00
timedout b580379a2d fix: Only check that room_id is not present on create events in PDU check 1 2026-10-30 00:43:55 +00:00
timedout 3c19206534 fix: Perform PDU checks 1, 2, and 3 before yielding a gapfilled PDU
Fixes #2386
2026-10-30 00:43:55 +00:00
Renovate Bot 7358712fb9 chore(deps): update rust crate tower-sec-fetch to 0.2.0 2026-10-29 13:40:37 +00:00