Skip to content
This repository was archived by the owner on Apr 26, 2024. It is now read-only.

Commit faee1e9

Browse files
hawkowlhawkowl
committed
Merge remote-tracking branch 'origin/develop' into shhs
2 parents 12875f9 + d216a36 commit faee1e9

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

68 files changed

+1158
-283
lines changed

‎CHANGES.md

+20
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,23 @@
1+
Synapse 0.99.3.2 (2019-05-03)
2+
=============================
3+
4+
Internal Changes
5+
----------------
6+
7+
- Ensure that we have `urllib3` <1.25, to resolve incompatibility with `requests`. ([\#5135](https://github.com/matrix-org/synapse/issues/5135))
8+
9+
10+
Synapse 0.99.3.1 (2019-05-03)
11+
=============================
12+
13+
Security update
14+
---------------
15+
16+
This release includes two security fixes:
17+
18+
- Switch to using a cryptographically-secure random number generator for token strings, ensuring they cannot be predicted by an attacker. Thanks to @opnsec for identifying and responsibly disclosing this issue! ([\#5133](https://github.com/matrix-org/synapse/issues/5133))
19+
- Blacklist 0.0.0.0 and :: by default for URL previews. Thanks to @opnsec for identifying and responsibly disclosing this issue too! ([\#5134](https://github.com/matrix-org/synapse/issues/5134))
20+
121
Synapse 0.99.3 (2019-04-01)
222
===========================
323

‎changelog.d/5037.bugfix

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Workaround bug in twisted where attempting too many concurrent DNS requests could cause it to hang due to running out of file descriptors.

‎changelog.d/5083.feature

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Add an configuration option to require authentication on /publicRooms and /profile endpoints.

‎changelog.d/5104.bugfix

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Fix the ratelimting on third party invites.

‎changelog.d/5119.feature

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Move admin APIs to `/_synapse/admin/v1`. (The old paths are retained for backwards-compatibility, for now).

‎changelog.d/5120.misc

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Factor out an "assert_requester_is_admin" function.

‎changelog.d/5121.feature

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Implement an admin API for sending server notices. Many thanks to @krombel who provided a foundation for this work.

‎changelog.d/5122.misc

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Remove the requirement to authenticate for /admin/server_version.

‎changelog.d/5124.bugfix

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Add some missing limitations to room alias creation.

‎changelog.d/5128.bugfix

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Add some missing limitations to room alias creation.

‎changelog.d/5142.feature

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Implement an admin API for sending server notices. Many thanks to @krombel who provided a foundation for this work.

‎changelog.d/5154.bugfix

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Fix bogus imports in unit tests.

‎debian/changelog

+12
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,15 @@
1+
matrix-synapse-py3 (0.99.3.2) stable; urgency=medium
2+
3+
* New synapse release 0.99.3.2.
4+
5+
-- Synapse Packaging team <packages@matrix.org> Fri, 03 May 2019 18:56:20 +0100
6+
7+
matrix-synapse-py3 (0.99.3.1) stable; urgency=medium
8+
9+
* New synapse release 0.99.3.1.
10+
11+
-- Synapse Packaging team <packages@matrix.org> Fri, 03 May 2019 16:02:43 +0100
12+
113
matrix-synapse-py3 (0.99.3) stable; urgency=medium
214

315
[ Richard van der Hoff ]

‎docker/Dockerfile-dhvirtualenv

+2-1
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,8 @@ RUN apt-get update -qq -o Acquire::Languages=none \
5757
python3-pip \
5858
python3-setuptools \
5959
python3-venv \
60-
sqlite3
60+
sqlite3 \
61+
libpq-dev
6162

6263
COPY --from=builder /dh-virtualenv_1.1-1_all.deb /
6364

‎docs/admin_api/account_validity.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ This API extends the validity of an account by as much time as configured in the
1313

1414
The API is::
1515

16-
POST /_matrix/client/unstable/admin/account_validity/validity
16+
POST /_synapse/admin/v1/account_validity/validity
1717

1818
with the following body:
1919

‎docs/admin_api/delete_group.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ being deleted.
88
The API is:
99

1010
```
11-
POST /_matrix/client/r0/admin/delete_group/<group_id>
11+
POST /_synapse/admin/v1/delete_group/<group_id>
1212
```
1313

1414
including an `access_token` of a server admin.

‎docs/admin_api/media_admin_api.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ This API gets a list of known media in a room.
44

55
The API is:
66
```
7-
GET /_matrix/client/r0/admin/room/<room_id>/media
7+
GET /_synapse/admin/v1/room/<room_id>/media
88
```
99
including an `access_token` of a server admin.
1010

‎docs/admin_api/purge_history_api.rst

+2-2
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ paginate further back in the room from the point being purged from.
1010

1111
The API is:
1212

13-
``POST /_matrix/client/r0/admin/purge_history/<room_id>[/<event_id>]``
13+
``POST /_synapse/admin/v1/purge_history/<room_id>[/<event_id>]``
1414

1515
including an ``access_token`` of a server admin.
1616

@@ -49,7 +49,7 @@ Purge status query
4949

5050
It is possible to poll for updates on recent purges with a second API;
5151

52-
``GET /_matrix/client/r0/admin/purge_history_status/<purge_id>``
52+
``GET /_synapse/admin/v1/purge_history_status/<purge_id>``
5353

5454
(again, with a suitable ``access_token``). This API returns a JSON body like
5555
the following:

‎docs/admin_api/purge_remote_media.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ media.
66

77
The API is::
88

9-
POST /_matrix/client/r0/admin/purge_media_cache?before_ts=<unix_timestamp_in_ms>&access_token=<access_token>
9+
POST /_synapse/admin/v1/purge_media_cache?before_ts=<unix_timestamp_in_ms>&access_token=<access_token>
1010

1111
{}
1212

‎docs/admin_api/register_api.rst

+2-2
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ is not enabled.
1212

1313
To fetch the nonce, you need to request one from the API::
1414

15-
> GET /_matrix/client/r0/admin/register
15+
> GET /_synapse/admin/v1/register
1616

1717
< {"nonce": "thisisanonce"}
1818

@@ -22,7 +22,7 @@ body containing the nonce, username, password, whether they are an admin
2222

2323
As an example::
2424

25-
> POST /_matrix/client/r0/admin/register
25+
> POST /_synapse/admin/v1/register
2626
> {
2727
"nonce": "thisisanonce",
2828
"username": "pepper_roni",

‎docs/admin_api/server_notices.md

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# Server Notices
2+
3+
The API to send notices is as follows:
4+
5+
```
6+
POST /_synapse/admin/v1/send_server_notice
7+
```
8+
9+
or:
10+
11+
```
12+
PUT /_synapse/admin/v1/send_server_notice/{txnId}
13+
```
14+
15+
You will need to authenticate with an access token for an admin user.
16+
17+
When using the `PUT` form, retransmissions with the same transaction ID will be
18+
ignored in the same way as with `PUT
19+
/_matrix/client/r0/rooms/{roomId}/send/{eventType}/{txnId}`.
20+
21+
The request body should look something like the following:
22+
23+
```json
24+
{
25+
"user_id": "@target_user:server_name",
26+
"content": {
27+
"msgtype": "m.text",
28+
"body": "This is my message"
29+
}
30+
}
31+
```
32+
33+
You can optionally include the following additional parameters:
34+
35+
* `type`: the type of event. Defaults to `m.room.message`.
36+
* `state_key`: Setting this will result in a state event being sent.
37+
38+
39+
Once the notice has been sent, the API will return the following response:
40+
41+
```json
42+
{
43+
"event_id": "<event_id>"
44+
}
45+
```
46+
47+
Note that server notices must be enabled in `homeserver.yaml` before this API
48+
can be used. See [server_notices.md](../server_notices.md) for more information.

‎docs/admin_api/user_admin_api.rst

+3-3
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ This API returns information about a specific user account.
55

66
The api is::
77

8-
GET /_matrix/client/r0/admin/whois/<user_id>
8+
GET /_synapse/admin/v1/whois/<user_id>
99

1010
including an ``access_token`` of a server admin.
1111

@@ -50,7 +50,7 @@ references to it).
5050

5151
The api is::
5252

53-
POST /_matrix/client/r0/admin/deactivate/<user_id>
53+
POST /_synapse/admin/v1/deactivate/<user_id>
5454

5555
with a body of:
5656

@@ -73,7 +73,7 @@ Changes the password of another user.
7373

7474
The api is::
7575

76-
POST /_matrix/client/r0/admin/reset_password/<user_id>
76+
POST /_synapse/admin/v1/reset_password/<user_id>
7777

7878
with a body of:
7979

‎docs/admin_api/version_api.rst

+1-3
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,7 @@ contains Synapse version information).
88

99
The api is::
1010

11-
GET /_matrix/client/r0/admin/server_version
12-
13-
including an ``access_token`` of a server admin.
11+
GET /_synapse/admin/v1/server_version
1412

1513
It returns a JSON body like the following:
1614

‎docs/sample_config.yaml

+33-7
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,20 @@ pid_file: DATADIR/homeserver.pid
6969
#
7070
#use_presence: false
7171

72+
# Whether to require authentication to retrieve profile data (avatars,
73+
# display names) of other users through the client API. Defaults to
74+
# 'false'. Note that profile data is also available via the federation
75+
# API, so this setting is of limited value if federation is enabled on
76+
# the server.
77+
#
78+
#require_auth_for_profile_requests: true
79+
80+
# If set to 'true', requires authentication to access the server's
81+
# public rooms directory through the client API, and forbids any other
82+
# homeserver to fetch it via federation. Defaults to 'false'.
83+
#
84+
#restrict_public_rooms_to_local_users: true
85+
7286
# The GC threshold parameters to pass to `gc.set_threshold`, if defined
7387
#
7488
#gc_thresholds: [700, 10, 10]
@@ -136,8 +150,8 @@ pid_file: DATADIR/homeserver.pid
136150
#
137151
# Valid resource names are:
138152
#
139-
# client: the client-server API (/_matrix/client). Also implies 'media' and
140-
# 'static'.
153+
# client: the client-server API (/_matrix/client), and the synapse admin
154+
# API (/_synapse/admin). Also implies 'media' and 'static'.
141155
#
142156
# consent: user consent forms (/_matrix/consent). See
143157
# docs/consent_tracking.md.
@@ -239,6 +253,11 @@ listeners:
239253
# Used by phonehome stats to group together related servers.
240254
#server_context: context
241255

256+
# Whether to require a user to be in the room to add an alias to it.
257+
# Defaults to 'true'.
258+
#
259+
#require_membership_for_aliases: false
260+
242261

243262
## TLS ##
244263

@@ -543,11 +562,12 @@ uploads_path: "DATADIR/uploads"
543562
# height: 600
544563
# method: scale
545564

546-
# Is the preview URL API enabled? If enabled, you *must* specify
547-
# an explicit url_preview_ip_range_blacklist of IPs that the spider is
548-
# denied from accessing.
565+
# Is the preview URL API enabled?
549566
#
550-
#url_preview_enabled: false
567+
# 'false' by default: uncomment the following to enable it (and specify a
568+
# url_preview_ip_range_blacklist blacklist).
569+
#
570+
#url_preview_enabled: true
551571

552572
# List of IP address CIDR ranges that the URL preview spider is denied
553573
# from accessing. There are no defaults: you must explicitly
@@ -557,6 +577,12 @@ uploads_path: "DATADIR/uploads"
557577
# synapse to issue arbitrary GET requests to your internal services,
558578
# causing serious security issues.
559579
#
580+
# (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly
581+
# listed here, since they correspond to unroutable addresses.)
582+
#
583+
# This must be specified if url_preview_enabled is set. It is recommended that
584+
# you uncomment the following list as a starting point.
585+
#
560586
#url_preview_ip_range_blacklist:
561587
# - '127.0.0.0/8'
562588
# - '10.0.0.0/8'
@@ -567,7 +593,7 @@ uploads_path: "DATADIR/uploads"
567593
# - '::1/128'
568594
# - 'fe80::/64'
569595
# - 'fc00::/7'
570-
#
596+
571597
# List of IP address CIDR ranges that the URL preview spider is allowed
572598
# to access even if they are specified in url_preview_ip_range_blacklist.
573599
# This is useful for specifying exceptions to wide-ranging blacklisted

‎docs/server_notices.md

+6-19
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
1-
Server Notices
2-
==============
1+
# Server Notices
32

43
'Server Notices' are a new feature introduced in Synapse 0.30. They provide a
54
channel whereby server administrators can send messages to users on the server.
@@ -11,8 +10,7 @@ they may also find a use for features such as "Message of the day".
1110
This is a feature specific to Synapse, but it uses standard Matrix
1211
communication mechanisms, so should work with any Matrix client.
1312

14-
User experience
15-
---------------
13+
## User experience
1614

1715
When the user is first sent a server notice, they will get an invitation to a
1816
room (typically called 'Server Notices', though this is configurable in
@@ -29,8 +27,7 @@ levels.
2927
Having joined the room, the user can leave the room if they want. Subsequent
3028
server notices will then cause a new room to be created.
3129

32-
Synapse configuration
33-
---------------------
30+
## Synapse configuration
3431

3532
Server notices come from a specific user id on the server. Server
3633
administrators are free to choose the user id - something like `server` is
@@ -58,17 +55,7 @@ room which will be created.
5855
`system_mxid_display_name` and `system_mxid_avatar_url` can be used to set the
5956
displayname and avatar of the Server Notices user.
6057

61-
Sending notices
62-
---------------
58+
## Sending notices
6359

64-
As of the current version of synapse, there is no convenient interface for
65-
sending notices (other than the automated ones sent as part of consent
66-
tracking).
67-
68-
In the meantime, it is possible to test this feature using the manhole. Having
69-
gone into the manhole as described in [manhole.md](manhole.md), a notice can be
70-
sent with something like:
71-
72-
```
73-
>>> hs.get_server_notices_manager().send_notice('@user:server.com', {'msgtype':'m.text', 'body':'foo'})
74-
```
60+
To send server notices to users you can use the
61+
[admin_api](admin_api/server_notices.md).

‎scripts-dev/build_debian_packages

+1
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ DISTS = (
2424
"ubuntu:xenial",
2525
"ubuntu:bionic",
2626
"ubuntu:cosmic",
27+
"ubuntu:disco",
2728
)
2829

2930
DESC = '''\

‎synapse/__init__.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -27,4 +27,4 @@
2727
except ImportError:
2828
pass
2929

30-
__version__ = "0.99.3"
30+
__version__ = "0.99.3.2"

‎synapse/api/auth.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -556,7 +556,7 @@ def is_server_admin(self, user):
556556
""" Check if the given user is a local server admin.
557557
558558
Args:
559-
user (str): mxid of user to check
559+
user (UserID): user to check
560560
561561
Returns:
562562
bool: True if the user is an admin

‎synapse/api/constants.py

+3
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@
2020
# the "depth" field on events is limited to 2**63 - 1
2121
MAX_DEPTH = 2**63 - 1
2222

23+
# the maximum length for a room alias is 255 characters
24+
MAX_ALIAS_LENGTH = 255
25+
2326

2427
class Membership(object):
2528

0 commit comments

Comments
 (0)