joe/kami-parse-server
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3,418 Commits 2 Branches 18 Tags
0a2d412e265992d53a670011afd9d2578562adc3
Commit Graph

3418 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Manuel
0a2d412e26 fix: Parse Server option requestKeywordDenylist can be bypassed via Cloud Code Webhooks or Triggers; fixes security vulnerability [GHSA-xprv-wvh7-qqqx](https://github.com/parse-community/parse-server/security/advisories/GHSA-xprv-wvh7-qqqx) (#8301) 2022-11-09 20:00:05 +01:00
semantic-release-bot
35346525e8 chore(release): 4.10.18 [skip ci] 
## [4.10.18](https://github.com/parse-community/parse-server/compare/4.10.17...4.10.18) (2022-11-07)

### Bug Fixes

* Remote code execution via MongoDB BSON parser through prototype pollution; fixes security vulnerability [GHSA-prm5-8g2m-24gg](https://github.com/parse-community/parse-server/security/advisories/GHSA-prm5-8g2m-24gg) ([#8296](https://github.com/parse-community/parse-server/issues/8296)) ([47cfeee](47cfeee0ce))
 2022-11-07 22:24:24 +00:00
Manuel
47cfeee0ce fix: Remote code execution via MongoDB BSON parser through prototype pollution; fixes security vulnerability [GHSA-prm5-8g2m-24gg](https://github.com/parse-community/parse-server/security/advisories/GHSA-prm5-8g2m-24gg) (#8296) 2022-11-07 23:05:29 +01:00
semantic-release-bot
041e60487c chore(release): 4.10.17 [skip ci] 
## [4.10.17](https://github.com/parse-community/parse-server/compare/4.10.16...4.10.17) (2022-10-15)

### Bug Fixes

* server crashes when receiving file download request with invalid byte range; this fixes a security vulnerability that allows an attacker to impact the availability of the server instance; the fix improves parsing of the range parameter to properly handle invalid range requests ([GHSA-h423-w6qv-2wj3](https://github.com/parse-community/parse-server/security/advisories/GHSA-h423-w6qv-2wj3)) ([#8236](https://github.com/parse-community/parse-server/issues/8236)) ([3d7a61e](3d7a61ecd5))
 2022-10-15 00:25:57 +00:00
Manuel
3d7a61ecd5 fix: server crashes when receiving file download request with invalid byte range; this fixes a security vulnerability that allows an attacker to impact the availability of the server instance; the fix improves parsing of the range parameter to properly handle invalid range requests ([GHSA-h423-w6qv-2wj3](https://github.com/parse-community/parse-server/security/advisories/GHSA-h423-w6qv-2wj3)) (#8236) 2022-10-15 02:12:05 +02:00
semantic-release-bot
f03bf00e5f chore(release): 4.10.16 [skip ci] 
## [4.10.16](https://github.com/parse-community/parse-server/compare/4.10.15...4.10.16) (2022-09-20)

### Bug Fixes

* authentication adapter app ID validation may be circumvented; this fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for *Facebook* or *Spotify* and where the server-side authentication adapter configuration `appIds` is set as a string (e.g. `abc`) instead of an array of strings (e.g. `["abc"]`) ([GHSA-r657-33vp-gp22](https://github.com/parse-community/parse-server/security/advisories/GHSA-r657-33vp-gp22)) ([#8186](https://github.com/parse-community/parse-server/issues/8186)) ([b3e7939](b3e7939f6b))
 2022-09-20 20:56:54 +00:00
Manuel
b3e7939f6b fix: authentication adapter app ID validation may be circumvented; this fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for *Facebook* or *Spotify* and where the server-side authentication adapter configuration appIds is set as a string (e.g. abc) instead of an array of strings (e.g. ["abc"]) ([GHSA-r657-33vp-gp22](https://github.com/parse-community/parse-server/security/advisories/GHSA-r657-33vp-gp22)) (#8186) 2022-09-20 22:32:19 +02:00
semantic-release-bot
9d502269c5 chore(release): 4.10.15 [skip ci] 
## [4.10.15](https://github.com/parse-community/parse-server/compare/4.10.14...4.10.15) (2022-09-20)

### Bug Fixes

* session object properties can be updated by foreign user; this fixes a security vulnerability in which a foreign user can write to the session object of another user if the session object ID is known; the fix prevents writing to foreign session objects ([GHSA-6w4q-23cf-j9jp](https://github.com/parse-community/parse-server/security/advisories/GHSA-6w4q-23cf-j9jp)) ([#8183](https://github.com/parse-community/parse-server/issues/8183)) ([7ca9ed0](7ca9ed0142))
 2022-09-20 00:33:55 +00:00
Manuel
7ca9ed0142 fix: session object properties can be updated by foreign user; this fixes a security vulnerability in which a foreign user can write to the session object of another user if the session object ID is known; the fix prevents writing to foreign session objects ([GHSA-6w4q-23cf-j9jp](https://github.com/parse-community/parse-server/security/advisories/GHSA-6w4q-23cf-j9jp)) (#8183) 2022-09-20 02:19:43 +02:00
semantic-release-bot
e29f7c0431 chore(release): 4.10.14 [skip ci] 
## [4.10.14](https://github.com/parse-community/parse-server/compare/4.10.13...4.10.14) (2022-09-02)

### Bug Fixes

* brute force guessing of user sensitive data via search patterns; this fixes a security vulnerability in which internal and protected fields may be used as query constraints to guess the value of these fields and obtain sensitive data (GHSA-2m6g-crv8-p3c6) ([#8143](https://github.com/parse-community/parse-server/issues/8143)) ([634c44a](634c44acd1))
 2022-09-02 19:28:55 +00:00
Manuel
634c44acd1 fix: brute force guessing of user sensitive data via search patterns; this fixes a security vulnerability in which internal and protected fields may be used as query constraints to guess the value of these fields and obtain sensitive data (GHSA-2m6g-crv8-p3c6) (#8143) 2022-09-02 21:15:09 +02:00
semantic-release-bot
4748e9bbd3 chore(release): 4.10.13 [skip ci] 
## [4.10.13](https://github.com/parse-community/parse-server/compare/4.10.12...4.10.13) (2022-06-30)

### Bug Fixes

* protected fields exposed via LiveQuery; this removes protected fields from the client response; this may be a breaking change if your app is currently expecting to receive these protected fields ([GHSA-crrq-vr9j-fxxh](https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh)) ([#8074](https://github.com/parse-community/parse-server/issues/8074)) ([054f3e6](054f3e6ab0))
 2022-06-30 10:38:27 +00:00
Manuel
054f3e6ab0 fix: protected fields exposed via LiveQuery; this removes protected fields from the client response; this may be a breaking change if your app is currently expecting to receive these protected fields ([GHSA-crrq-vr9j-fxxh](https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh)) (#8074) 2022-06-30 12:24:34 +02:00
semantic-release-bot
6286d2e34f chore(release): 4.10.12 [skip ci] 
## [4.10.12](https://github.com/parse-community/parse-server/compare/4.10.11...4.10.12) (2022-06-17)

### Bug Fixes

* invalid file request not properly handled; this fixes a security vulnerability in which an invalid file request can crash the server ([GHSA-xw6g-jjvf-wwf9](https://github.com/parse-community/parse-server/security/advisories/GHSA-xw6g-jjvf-wwf9)) ([#8059](https://github.com/parse-community/parse-server/issues/8059)) ([5f42322](5f423224bd))
 2022-06-17 23:43:36 +00:00
Manuel
5f423224bd fix: invalid file request not properly handled; this fixes a security vulnerability in which an invalid file request can crash the server ([GHSA-xw6g-jjvf-wwf9](https://github.com/parse-community/parse-server/security/advisories/GHSA-xw6g-jjvf-wwf9)) (#8059) 2022-06-18 01:29:49 +02:00
semantic-release-bot
ad680bd312 chore(release): 4.10.11 [skip ci] 
## [4.10.11](https://github.com/parse-community/parse-server/compare/4.10.10...4.10.11) (2022-06-17)

### Bug Fixes

* certificate in Apple Game Center auth adapter not validated; this fixes a security vulnerability in which authentication could be bypassed using a fake certificate; if you are using the Apple Gamer Center auth adapter it is your responsibility to keep its root certificate up-to-date and we advice you read the security advisory ([GHSA-rh9j-f5f8-rvgc](https://github.com/parse-community/parse-server/security/advisories/GHSA-rh9j-f5f8-rvgc)) ([145838d](145838d2d9))
 2022-06-17 16:38:16 +00:00
Manuel
145838d2d9 fix: certificate in Apple Game Center auth adapter not validated; this fixes a security vulnerability in which authentication could be bypassed using a fake certificate; if you are using the Apple Gamer Center auth adapter it is your responsibility to keep its root certificate up-to-date and we advice you read the security advisory ([GHSA-rh9j-f5f8-rvgc](https://github.com/parse-community/parse-server/security/advisories/GHSA-rh9j-f5f8-rvgc)) 2022-06-17 18:24:13 +02:00
Manuel Trezza
8580a524eb fix CI timeout 2022-06-17 17:57:22 +02:00
Manuel Trezza
53afafa13f Update gcenter.js 2022-06-17 17:30:54 +02:00
Manuel Trezza
c411c48d49 Create game_center.pem 2022-06-17 16:19:25 +02:00
Manuel Trezza
07786c1666 fix adapter 2022-06-17 16:19:25 +02:00
semantic-release-bot
b00b0410e6 chore(release): 4.10.10 [skip ci] 
## [4.10.10](https://github.com/parse-community/parse-server/compare/4.10.9...4.10.10) (2022-05-01)

### Bug Fixes

* authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter (GHSA-qf8x-vqjv-92gr) ([#7963](https://github.com/parse-community/parse-server/issues/7963)) ([1930a64](1930a64e9c))
 2022-05-01 00:48:05 +00:00
Manuel
1930a64e9c fix: authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter (GHSA-qf8x-vqjv-92gr) (#7963) 2022-05-01 02:46:57 +02:00
semantic-release-bot
cd354b77a6 chore(release): 4.10.9 [skip ci] 
## [4.10.9](https://github.com/parse-community/parse-server/compare/4.10.8...4.10.9) (2022-03-28)

### Bug Fixes

* security upgrade @parse/push-adapter from 3.4.1 to 4.1.2 ([#7897](https://github.com/parse-community/parse-server/issues/7897)) ([3d80ee5](3d80ee5ec3))
 2022-03-28 02:57:17 +00:00
Snyk bot
3d80ee5ec3 fix: security upgrade @parse/push-adapter from 3.4.1 to 4.1.2 (#7897) 2022-03-28 04:56:02 +02:00
semantic-release-bot
bf88869578 chore(release): 4.10.8 [skip ci] 
## [4.10.8](https://github.com/parse-community/parse-server/compare/4.10.7...4.10.8) (2022-03-24)

### Bug Fixes

* sensitive keyword detection may produce false positives ([#7883](https://github.com/parse-community/parse-server/issues/7883)) ([d347613](d34761369e))
 2022-03-24 01:50:33 +00:00
Manuel
d34761369e fix: sensitive keyword detection may produce false positives (#7883) 2022-03-24 02:49:39 +01:00
Manuel
02f88f433e docs: add details to changelog (#7842) 2022-03-12 00:39:01 +01:00
semantic-release-bot
7c844772ea chore(release): 4.10.7 [skip ci] 
## [4.10.7](https://github.com/parse-community/parse-server/compare/4.10.6...4.10.7) (2022-03-11)

### Bug Fixes

* security vulnerability that allows remote code execution (ghsa p6h4 93qp jhcm) ([#7841](https://github.com/parse-community/parse-server/issues/7841)) ([886bfd7](886bfd7cac))
 2022-03-11 23:20:36 +00:00
Manuel
886bfd7cac fix: security vulnerability that allows remote code execution (ghsa p6h4 93qp jhcm) (#7841) 2022-03-12 00:19:31 +01:00
Manuel
318c20319a ci: fix changelog file path (#7835) 2022-03-08 02:49:18 +01:00
Manuel
6f25ea93fb ci: add manual docker release workflow (#7809) 2022-02-13 00:16:02 +01:00
semantic-release-bot
cd41626625 chore(release): 4.10.6 [skip ci] 
## [4.10.6](https://github.com/parse-community/parse-server/compare/4.10.5...4.10.6) (2022-02-12)

### Bug Fixes

* update graphql dependencies to work with Parse Dashboard ([#7658](https://github.com/parse-community/parse-server/issues/7658)) ([350ecde](350ecdee59))
 2022-02-12 16:08:06 +00:00
Frans Bouwmeester
350ecdee59 fix: update graphql dependencies to work with Parse Dashboard (#7658) 2022-02-12 17:07:04 +01:00
semantic-release-bot
b465f7bade chore(release): 4.10.5 [skip ci] 
## [4.10.5](https://github.com/parse-community/parse-server/compare/4.10.4...4.10.5) (2022-02-12)

### Bug Fixes

* security upgrade follow-redirects from 1.13.0 to 1.14.8 ([#7803](https://github.com/parse-community/parse-server/issues/7803)) ([611332e](611332ea33))
 2022-02-12 15:42:56 +00:00
Manuel
d7f2bb49d4 ci: disable auto-release dry-run 2022-02-12 16:41:32 +01:00
Manuel
4bd13088e1 docs: fix changelog typo 2022-02-12 16:37:58 +01:00
Snyk bot
611332ea33 fix: security upgrade follow-redirects from 1.13.0 to 1.14.8 (#7803) 2022-02-12 16:31:29 +01:00
Manuel
65c13febf5 ci: fix release automation workflow typo 2022-02-12 16:16:20 +01:00
Manuel
adf7d928de ci: add release automation (#7807) 2022-02-12 16:14:28 +01:00
Frans Bouwmeester
065facdc53 test: fix failing tests on 4.x LTS branch (#7661) 2021-10-30 19:19:54 +02:00
dblythy
4ac4b7f710 Merge pull request from GHSA-7pr3-p5fm-8r9x
Some checks failed
docker / build (push) Has been cancelled
Details 
* fix: LQ deletes session token

* add 4.10.4

* add changes
 2021-09-30 04:52:12 +02:00
Manuel
6683cd96b6 fix docker run (#7557) 2021-09-07 18:18:30 +02:00
Manuel
ef2ec21355 ci: update docker image building (#7553) 
* docker

* Update docker-publish.yml

* Update docker-publish.yml
 2021-09-07 16:44:48 +02:00
Manuel
c71ae7d478 chore(release): 4.10.3 (#7538) 2021-09-02 13:01:27 +02:00
Kartal Kaan Bozdoğan
6ae5835b19 Merge pull request from GHSA-xqp8-w826-hh6x 
* Backport the advisory fix

* Added a 4.10.3 section to CHANGELOG
 2021-09-02 12:46:48 +02:00
Manuel
0bfa6b7cc1 Release 4.10.2 (#7513) 
* move graphql-tag from devDependencies to dependencies (#7183)

* bump version

* Update CHANGELOG.md
 2021-08-24 00:46:39 +02:00
Manuel
0be0b87b2d bump version 2021-08-23 13:57:55 +02:00
Manuel
f3133acf21 Release 4.10.1 (#7508) 
* bump parse 3.3.0

* Update CHANGELOG.md

* update user test (PR #7464)

* fix Twitter API oauth Error (PR #7370)

* bumped dependencies

* Revert "bumped dependencies"

This reverts commit 97ad83dd15eee379d9b258f02ac14e4950415835.

* bump @parse/push-adapter 3.4.1

* bump jwks-rsa@1.12.3

* bump mongodb@3.6.11

* bump ws@7.5.3

* changed logging for circular obj (PR #7457)

* Update CHANGELOG.md
 2021-08-23 13:53:33 +02:00
Manuel
7e1da90bb2 added changelog 2021-08-20 19:56:37 +02:00