Ginger
d7a51c7107
refactor: Allow for client identities with no user ID
2026-05-27 12:15:16 -04:00
Ginger
74841b6711
refactor: Represent route auth information in the type system
2026-05-26 18:26:02 +00:00
Ginger
185f8c42dc
fix: Properly check forbidden_remote_server_names for incoming requests
2026-05-21 12:11:03 +00:00
Ginger
ba2c123e82
feat: Remove support for server-side blurhashing
2026-05-14 13:22:17 +00:00
Ginger
0d2eeed567
refactor: Move room joining logic into a new service
2026-05-06 14:01:50 -04:00
Ginger
8c2cf67783
refactor: Remove support for guest user registration
2026-05-05 09:09:48 -04:00
Ginger
88b59eb053
fix: Include target user's membership when building stripped state
2026-05-01 13:15:55 -04:00
Ginger
e6cae5b8ed
fix: Fix membership check in kick handler
2026-04-29 12:45:15 -04:00
Ginger
e34fd76dc0
fix: Re-add support for MSC4293
2026-04-28 09:16:57 -04:00
Ginger
5578144da9
refactor: Clean up api/client/membership/kick.rs
2026-04-28 09:16:57 -04:00
Ginger
5309a064e8
refactor: Remove old project name in api/client/membership/
2026-04-28 09:16:57 -04:00
Ginger
56d35b4e39
refactor: Clean up api/client/membership.ban.rs
2026-04-28 09:16:57 -04:00
Ginger
a8a8e1ea51
chore: Clippy fixes
2026-04-28 09:16:57 -04:00
Ginger
e70004c98f
chore: Clippy fixes
2026-04-28 09:16:56 -04:00
Ginger
0c7abd792d
refactor: Fix errors in api/router/
2026-04-28 09:16:56 -04:00
Ginger
eba38c2fa0
refactor: Fix errors in api/server/send_knock.rs
2026-04-28 09:16:52 -04:00
Ginger
a2f6141f4b
refactor: Fix errors in api/client/room/
2026-04-28 09:16:51 -04:00
Ginger
97a01a1500
refactor: Rename PduBuilder to PartialPdu
2026-04-28 09:16:51 -04:00
Ginger
755006c66d
refactor: Fix errors in api/client/membership/
2026-04-28 09:16:51 -04:00
Jade Ellis
a4e64383b7
refactor: Ruma upstraming, bake a little more
2026-04-28 09:16:51 -04:00
Ginger and Jade Ellis
204bc1367e
refactor: Ruma upstreaming, half-baked edition
...
Co-authored-by: Jade Ellis <jade@ellis.link >
2026-04-28 09:16:51 -04:00
Jade Ellis
0134f69bf9
chore: Update incompatible dependenceis
2026-04-23 20:02:48 +01:00
éźera
2ca7149a7f
feat: allow deprioritizing servers for join requests
...
Implements #1549 .
2026-04-15 13:24:42 +00:00
éźera
67d8d72506
fix: return 404 when joining non-existent room
...
Fixes #1443 .
2026-04-05 11:40:53 -05:00
timedout
31e2195e56
fix: Remove non-compliant and non-functional non-authoritative directory queries
...
chore: Add news frag
2026-02-19 01:37:42 +00:00
nexy7574
aa5400bcef
style: Fix IncompatibleRoomVersion log line
2026-02-15 16:11:18 +00:00
nexy7574
ff4dddd673
fix: Refactor local join process
2026-02-15 16:11:18 +00:00
timedout
3da7fa24db
fix: Produce more useful errors in make_join_request
2026-02-15 16:11:18 +00:00
timedout
f243b383cb
style: Fix typo in validate_remote_member_event_stub
2026-02-08 15:37:40 +00:00
timedout
e0b7d03018
fix: Perform additional membership validation on remote knocks too
2026-02-08 15:34:07 +00:00
timedout
184ae2ebb9
fix: Apply validation to make_join process
2026-02-06 18:15:39 +00:00
timedout
99a10998b4
style: Remove unused import
2026-01-11 15:42:06 +00:00
nex
05c6b5df75
fix: M_BAD_JSON in c2s invite
2026-01-11 15:37:59 +00:00
Jade Ellis
9552dd7485
style: Log error
2026-01-06 01:55:52 +00:00
Ginger
88c84f221f
chore: Add comment and warning to unhappy path
2026-01-06 00:59:32 +00:00
Laurențiu Nicola
a10bd71945
fix(admin): fix force-leaving rooms with no left_state PDU
2026-01-06 00:59:31 +00:00
timedout
279f7cbfe4
style: Fix failing lints
2026-01-05 20:10:29 +00:00
timedout
4b873a1b95
fix: Apply spam checker to local restricted joins
2026-01-05 20:10:29 +00:00
timedout
99f16c2dfc
fix: Call user_may_join_room later in the join process
2026-01-05 20:10:28 +00:00
timedout
5ac82f36f3
feat: Consolidate antispam checks into a service
...
Also adds support for the spam checker join rule, and Draupnir callbacks
2026-01-05 20:10:28 +00:00
timedout
c249dd992e
feat: Add support for automatically rejecting pending invites
2026-01-05 20:10:28 +00:00
timedout and Jade Ellis
0956779802
feat: Add Meowlnir invite interception support
...
Co-authored-by: Jade Ellis <jade@ellis.link >
2026-01-05 20:10:27 +00:00
Jade Ellis
aed15f246a
refactor: Clean up logging issues
...
Primary issues: Double escapes (debug fmt), spans without levels
2026-01-05 18:28:57 +00:00
12aecf8091
validate membership events returned by remote servers
...
This fixes a vulnerability where an attacker with a malicious remote
server and a user on the local server can trick the local server into
signing arbitrary events. The attacker issue a remote leave as the local
user to a room on the malicious server. Without any validation of the
make_leave response, the local server would sign the attacker-controlled
event and pass it back to the malicious server with send_leave.
The join and knock endpoints are also fixed in this commit, but are less
useful for exploitation because the local server replaces the "content"
field returned by the remote server. Remote invites are unaffected
because we already check that the event returned from /invite has the
same event ID as the event passed to it.
Co-authored-by: timedout <git@nexy7574.co.uk >
Co-authored-by: Jade Ellis <jade@ellis.link >
Co-authored-by: Ginger <ginger@gingershaped.computer >
2025-12-30 15:24:45 +00:00
timedout
4f198fb4ef
fix: Enforce limits when joining rooms
2025-12-13 22:17:47 +00:00
Ginger
07dfc5528d
refactor(sync/v3): Split load_joined_room into smaller functions
2025-12-07 19:58:24 +00:00
ginger
3f4749a796
fix: Correct error message
2025-12-07 19:58:24 +00:00
Ginger
0008709481
fix(sync/v3): Stop ignoring leave cache deserialization failures
2025-12-07 19:58:24 +00:00
Ginger
1c21e4af6e
fix: Properly sync left rooms
...
- Remove most usages of `update_membership` in favor
of directly calling the `mark_as_*` functions
- Store the leave membership event as the value in the
`userroomid_leftstate` table
- Use the `userroomid_leftstate` table to synchronize the
timeline and state for left rooms if possible
2025-12-07 19:58:24 +00:00
timedout
bc8d304dbf
style: Fix unnecessary qualification
...
Sounds like my university experience
2025-11-23 16:33:32 +00:00
Ginger
Jade Ellis
éźera
timedout
Laurențiu Nicola
