Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enhance security by disallowing CSP object-src rule #17818

Merged
merged 1 commit into from
Jun 29, 2021

Conversation

germain-gg
Copy link
Contributor

@germain-gg germain-gg requested a review from a team June 28, 2021 16:11
Copy link
Member

@t3chguy t3chguy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

@germain-gg germain-gg merged commit 4ba0e6b into develop Jun 29, 2021
@germain-gg germain-gg deleted the gsouquet/fix-6162 branch June 29, 2021 14:33
netbsd-srcmastr pushed a commit to NetBSD/pkgsrc that referenced this pull request Aug 3, 2021
Changes in [1.7.34](https://github.com/vector-im/element-desktop/releases/tag/v1.7.34) (2021-07-02)
===================================================================================================

## 🔒 SECURITY FIXES
 * Sanitize untrusted variables from message previews before translation
   Fixes element-hq/element-web#18314

## ✨ Features
 * Fix editing of `<sub>` & `<sup`> & `<u>`
   [\#6469](matrix-org/matrix-react-sdk#6469)
   Fixes #18211
 * Zoom images in lightbox to where the cursor points
   [\#6418](matrix-org/matrix-react-sdk#6418)
   Fixes #17870
 * Avoid hitting the settings store from TextForEvent
   [\#6205](matrix-org/matrix-react-sdk#6205)
   Fixes #17650
 * Initial MSC3083 + MSC3244 support
   [\#6212](matrix-org/matrix-react-sdk#6212)
   Fixes #17686 and #17661
 * Navigate to the first room with notifications when clicked on space notification dot
   [\#5974](matrix-org/matrix-react-sdk#5974)
 * Add matrix: to the list of permitted URL schemes
   [\#6388](matrix-org/matrix-react-sdk#6388)
 * Add "Copy Link" to room context menu
   [\#6374](matrix-org/matrix-react-sdk#6374)
 * 💭 Message bubble layout
   [\#6291](matrix-org/matrix-react-sdk#6291)
   Fixes #4635, #17773 #16220 and #7687
 * Play only one audio file at a time
   [\#6417](matrix-org/matrix-react-sdk#6417)
   Fixes #17439
 * Move download button for media to the action bar
   [\#6386](matrix-org/matrix-react-sdk#6386)
   Fixes #17943
 * Improved display of one-to-one call history with summary boxes for each call
   [\#6121](matrix-org/matrix-react-sdk#6121)
   Fixes #16409
 * Notification settings UI refresh
   [\#6352](matrix-org/matrix-react-sdk#6352)
   Fixes #17782
 * Fix EventIndex double handling events and erroring
   [\#6385](matrix-org/matrix-react-sdk#6385)
   Fixes #18008
 * Improve reply rendering
   [\#3553](matrix-org/matrix-react-sdk#3553)
   Fixes element-hq/element-web#9217, element-hq/element-web#7633, element-hq/element-web#7530, element-hq/element-web#7169, element-hq/element-web#7151, element-hq/element-web#6692 element-hq/element-web#6579 and #17440
 * Improve performance of room name calculation
   [\#1801](matrix-org/matrix-js-sdk#1801)

## 🐛 Bug Fixes
 * Fix browser history getting stuck looping back to the same room
   [\#18053](element-hq/element-web#18053)
 * Fix space shortcuts on layouts with non-English keys in the places of numbers
   [\#17780](element-hq/element-web#17780)
   Fixes #17776
 * Fix CreateRoomDialog exploding when making public room outside of a space
   [\#6493](matrix-org/matrix-react-sdk#6493)
 * Fix regression where registration would soft-crash on captcha
   [\#6505](matrix-org/matrix-react-sdk#6505)
   Fixes #18284
 * only send join rule event if we have a join rule to put in it
   [\#6517](matrix-org/matrix-react-sdk#6517)
 * Improve the new download button's discoverability and interactions.
   [\#6510](matrix-org/matrix-react-sdk#6510)
 * Fix voice recording UI looking broken while microphone permissions are being requested.
   [\#6479](matrix-org/matrix-react-sdk#6479)
   Fixes #18223
 * Match colors of room and user avatars in DMs
   [\#6393](matrix-org/matrix-react-sdk#6393)
   Fixes #2449
 * Fix onPaste handler to work with copying files from Finder
   [\#5389](matrix-org/matrix-react-sdk#5389)
   Fixes #15536 and #16255
 * Fix infinite pagination loop when offline
   [\#6478](matrix-org/matrix-react-sdk#6478)
   Fixes #18242
 * Fix blurhash rounded corners missing regression
   [\#6467](matrix-org/matrix-react-sdk#6467)
   Fixes #18110
 * Fix position of the space hierarchy spinner
   [\#6462](matrix-org/matrix-react-sdk#6462)
   Fixes #18182
 * Fix display of image messages that lack thumbnails
   [\#6456](matrix-org/matrix-react-sdk#6456)
   Fixes #18175
 * Fix crash with large audio files.
   [\#6436](matrix-org/matrix-react-sdk#6436)
   Fixes #18149
 * Make diff colors in codeblocks more pleasant
   [\#6355](matrix-org/matrix-react-sdk#6355)
   Fixes #17939
 * Show the correct audio file duration while loading the file.
   [\#6435](matrix-org/matrix-react-sdk#6435)
   Fixes #18160
 * Fix various timeline settings not applying immediately.
   [\#6261](matrix-org/matrix-react-sdk#6261)
   Fixes #17748
 * Fix issues with room list duplication
   [\#6391](matrix-org/matrix-react-sdk#6391)
   Fixes #14508
 * Fix grecaptcha throwing useless error sometimes
   [\#6401](matrix-org/matrix-react-sdk#6401)
   Fixes #15142
 * Update Emojibase and Twemoji and switch to IamCal (Slack-style) shortcodes
   [\#6347](matrix-org/matrix-react-sdk#6347)
   Fixes #13857 and #13334
 * Respect compound emojis in default avatar initial generation
   [\#6397](matrix-org/matrix-react-sdk#6397)
   Fixes #18040
 * Fix bug where the 'other homeserver' field in the server selection dialog would become briefly focus and then unfocus when clicked.
   [\#6394](matrix-org/matrix-react-sdk#6394)
   Fixes #18031
 * Standardise spelling and casing of homeserver, identity server, and integration manager
   [\#6365](matrix-org/matrix-react-sdk#6365)
 * Fix widgets not receiving decrypted events when they have permission.
   [\#6371](matrix-org/matrix-react-sdk#6371)
   Fixes #17615
 * Prevent client hangs when calculating blurhashes
   [\#6366](matrix-org/matrix-react-sdk#6366)
   Fixes #17945
 * Exclude state events from widgets reading room events
   [\#6378](matrix-org/matrix-react-sdk#6378)
 * Cache feature_spaces\* flags to improve performance
   [\#6381](matrix-org/matrix-react-sdk#6381)

Changes in [1.7.33](https://github.com/vector-im/element-web/releases/tag/v1.7.33) (2021-07-19)
===============================================================================================
[Full Changelog](element-hq/element-web@v1.7.33-rc.1...v1.7.33)

 * No changes from rc.1

Changes in [1.7.33-rc.1](https://github.com/vector-im/element-web/releases/tag/v1.7.33-rc.1) (2021-07-14)
=========================================================================================================
[Full Changelog](element-hq/element-web@v1.7.32...v1.7.33-rc.1)

 * Translations update from Weblate
   [\#17991](element-hq/element-web#17991)
 * Revert "Don't run nginx as root in docker"
   [\#17990](element-hq/element-web#17990)
 * Don't run nginx as root in docker
   [\#17927](element-hq/element-web#17927)
 * Add VS Code to gitignore
   [\#17982](element-hq/element-web#17982)
 * Remove canvas native dependencies from Dockerfile
   [\#17973](element-hq/element-web#17973)
 * Remove node-canvas devDependency
   [\#17967](element-hq/element-web#17967)
 * Add `reskindex` to development steps
   [\#17926](element-hq/element-web#17926)
 * Update Modernizr and stop it from polluting classes on the html tag
   [\#17921](element-hq/element-web#17921)
 * Convert a few files to TS
   [\#17895](element-hq/element-web#17895)
 * Do not generate a lockfile when running in CI
   [\#17902](element-hq/element-web#17902)
 * Fix lockfile to match listed dependencies
   [\#17888](element-hq/element-web#17888)
 * Remove PostCSS calc() processing
   [\#17856](element-hq/element-web#17856)
 * Make issue template styling more consistent and improve PR template
   [\#17691](element-hq/element-web#17691)
 * Update jsrsasign to ^10.2.0 (Includes fix for CVE-2021-30246)
   [\#17170](element-hq/element-web#17170)
 * Migrate to `eslint-plugin-matrix-org`
   [\#17847](element-hq/element-web#17847)
 * Remove spurious overflow: auto on #matrixchat element
   [\#17647](element-hq/element-web#17647)
 * Enhance security by disallowing CSP object-src rule
   [\#17818](element-hq/element-web#17818)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Don't use object tag (for SVGs)
2 participants