Manuel
|
686a9f282d
|
fix: Server crash when uploading file without extension; fixes security vulnerability [GHSA-792q-q67h-w579](https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579) (#8782)
|
2023-10-21 01:02:14 +02:00 |
|
Manuel
|
6458ab072e
|
fix: Parse Pointer allows to access internal Parse Server classes and circumvent beforeFind query trigger; fixes security vulnerability [GHSA-fcv6-fg5r-jm9q](https://github.com/parse-community/parse-server/security/advisories/GHSA-fcv6-fg5r-jm9q)
|
2023-09-04 14:20:07 +02:00 |
|
Daniel
|
601da1ee3c
|
fix: Server does not start via CLI when auth option is set (#8669)
|
2023-06-29 21:59:08 +02:00 |
|
Manuel
|
5fad2928fb
|
fix: Remote code execution via MongoDB BSON parser through prototype pollution; fixes security vulnerability [GHSA-462x-c3jw-7vr6](https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6) (#8675)
|
2023-06-28 22:59:09 +02:00 |
|
Manuel
|
196e05f047
|
feat: Add new Parse Server option fileUpload.fileExtensions to restrict file upload by file extension; this fixes a security vulnerability in which a phishing attack could be performed using an uploaded HTML file; by default the new option only allows file extensions matching the regex pattern ^[^hH][^tT][^mM][^lL]?$, which excludes HTML files; this fix is released as a patch version given the severity of this vulnerability, however, if your app currently depends on uploading files with HTML file extensions then this may be a breaking change and you could allow HTML file upload by setting the option to ['.*'] (#8537)
|
2023-05-21 01:14:27 +02:00 |
|
yog27ray
|
4f0f0ec4bb
|
fix: Unable to create new role if beforeSave hook exists (#8474)
|
2023-03-22 21:22:32 +01:00 |
|
Daniel
|
2c19c2e4d4
|
fix: Security upgrade jsonwebtoken to 9.0.0 (#8431)
|
2023-02-16 19:52:48 +01:00 |
|
Manuel
|
e016d813e0
|
fix: The client IP address may be determined incorrectly in some cases; it is now required to set the Parse Server option trustProxy accordingly if Parse Server runs behind a proxy server, see the express framework's [trust proxy](https://expressjs.com/en/guide/behind-proxies.html) setting; this fixes a security vulnerability in which the Parse Server option masterKeyIps may be circumvented, see [GHSA-vm5r-c87r-pf6x](https://github.com/parse-community/parse-server/security/advisories/GHSA-vm5r-c87r-pf6x) (#8369)
|
2023-01-05 14:20:40 +01:00 |
|
Manuel
|
735669a86a
|
refactor: Prototype pollution via Cloud Code Webhooks; fixes security vulnerability [GHSA-93vw-8fm5-p2jf](https://github.com/parse-community/parse-server/security/advisories/GHSA-93vw-8fm5-p2jf) (#8307)
|
2022-11-10 00:24:26 +01:00 |
|
Manuel
|
d9c3c02e7d
|
refactor: Parse Server option requestKeywordDenylist can be bypassed via Cloud Code Webhooks or Triggers; fixes security vulnerability [GHSA-xprv-wvh7-qqqx](https://github.com/parse-community/parse-server/security/advisories/GHSA-xprv-wvh7-qqqx) (#8303)
|
2022-11-09 20:01:39 +01:00 |
|
Manuel
|
46dbecdec1
|
refactor: Remote code execution via MongoDB BSON parser through prototype pollution; fixes security vulnerability [GHSA-prm5-8g2m-24gg](https://github.com/parse-community/parse-server/security/advisories/GHSA-prm5-8g2m-24gg) (#8298)
|
2022-11-07 23:49:41 +01:00 |
|
Manuel
|
5e9d494979
|
Merge branch 'beta' into build-beta
|
2022-10-29 21:31:22 +02:00 |
|
dblythy
|
9f111158ed
|
feat: add convenience access to Parse Server configuration in Cloud Code via Parse.Server (#8244)
|
2022-10-29 19:03:31 +02:00 |
|
dblythy
|
28f0d26677
|
fix: relation constraints in compound queries Parse.Query.or, Parse.Query.and not working (#8203)
|
2022-10-24 12:45:17 +02:00 |
|
Manuel
|
aba0081ce1
|
feat: add support for MongoDB 6 (#8242)
|
2022-10-17 19:21:32 +02:00 |
|
dblythy
|
4af13af991
|
ci: reduce timeout after idempotency tests (#8227)
|
2022-10-17 01:53:10 +02:00 |
|
Manuel
|
c03908f74e
|
fix: server crashes when receiving file download request with invalid byte range; this fixes a security vulnerability that allows an attacker to impact the availability of the server instance; the fix improves parsing of the range parameter to properly handle invalid range requests ([GHSA-h423-w6qv-2wj3](https://github.com/parse-community/parse-server/security/advisories/GHSA-h423-w6qv-2wj3)) [skip release] (#8238)
|
2022-10-15 01:06:45 +02:00 |
|
Manuel
|
4c1befabf2
|
fix: server crashes when receiving file download request with invalid byte range; this fixes a security vulnerability that allows an attacker to impact the availability of the server instance; the fix improves parsing of the range parameter to properly handle invalid range requests ([GHSA-h423-w6qv-2wj3](https://github.com/parse-community/parse-server/security/advisories/GHSA-h423-w6qv-2wj3)) [skip release] (#8237)
|
2022-10-15 00:54:08 +02:00 |
|
Diamond Lewis
|
0f763da17d
|
feat: liveQuery support for unsorted distance queries (#8221)
|
2022-10-12 00:27:29 +02:00 |
|
dblythy
|
2a82d19dbd
|
refactor: code style fixes with prettier and lint (#8208)
|
2022-10-03 13:55:05 +02:00 |
|
dblythy
|
eb649f226f
|
test: fix flaky Apple Game Center tests (#8204)
|
2022-10-01 12:14:59 +02:00 |
|
vzukanov
|
0388956808
|
feat: add option to change the default value of the Parse.Query.limit() constraint (#8152)
|
2022-09-30 00:38:57 +02:00 |
|
Manuel
|
8c8ec71573
|
fix: authentication adapter app ID validation may be circumvented; this fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for *Facebook* or *Spotify* and where the server-side authentication adapter configuration appIds is set as a string (e.g. abc) instead of an array of strings (e.g. ["abc"]) ([GHSA-r657-33vp-gp22](https://github.com/parse-community/parse-server/security/advisories/GHSA-r657-33vp-gp22)) [skip release] (#8187)
|
2022-09-20 23:05:44 +02:00 |
|
Manuel
|
1a2b1b9bc1
|
fix: authentication adapter app ID validation may be circumvented; this fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for *Facebook* or *Spotify* and where the server-side authentication adapter configuration appIds is set as a string (e.g. abc) instead of an array of strings (e.g. ["abc"]) ([GHSA-r657-33vp-gp22](https://github.com/parse-community/parse-server/security/advisories/GHSA-r657-33vp-gp22)) [skip release] (#8188)
|
2022-09-20 23:03:21 +02:00 |
|
Manuel
|
83cdc89be9
|
fix: session object properties can be updated by foreign user; this fixes a security vulnerability in which a foreign user can write to the session object of another user if the session object ID is known; the fix prevents writing to foreign session objects ([GHSA-6w4q-23cf-j9jp](https://github.com/parse-community/parse-server/security/advisories/GHSA-6w4q-23cf-j9jp)) [skip release] (#8181)
|
2022-09-20 02:36:54 +02:00 |
|
Manuel
|
37fed3062c
|
fix: session object properties can be updated by foreign user; this fixes a security vulnerability in which a foreign user can write to the session object of another user if the session object ID is known; the fix prevents writing to foreign session objects ([GHSA-6w4q-23cf-j9jp](https://github.com/parse-community/parse-server/security/advisories/GHSA-6w4q-23cf-j9jp)) [skip release] (#8180)
|
2022-09-20 02:23:49 +02:00 |
|
dblythy
|
3b775a1fb8
|
fix: sorting by non-existing value throws INVALID_SERVER_ERROR on Postgres (#8157)
|
2022-09-17 20:41:45 +02:00 |
|
dblythy
|
37af1d78fc
|
fix: updating object includes unchanged keys in client response for certain key types (#8159)
|
2022-09-17 18:20:50 +02:00 |
|
dblythy
|
e424137406
|
fix: query aggregation pipeline cannot handle value of type Date when directAccess: true (#8167)
|
2022-09-17 16:19:28 +02:00 |
|
Stew
|
1d9605bc93
|
fix: liveQuery with containedIn not working when object field is an array (#8128)
|
2022-09-17 13:59:45 +02:00 |
|
dblythy
|
3c75c2ba48
|
fix: push notifications badge doesn't update with Installation beforeSave trigger (#8162)
|
2022-09-16 21:43:03 +02:00 |
|
dblythy
|
c85bc016e2
|
ci: fix flaky Apple Game Center tests (#8163)
|
2022-09-14 16:33:55 +02:00 |
|
Snyk bot
|
149884fe3e
|
refactor: upgrade mongodb from 4.6.0 to 4.7.0 (#8083)
|
2022-09-03 11:22:42 +02:00 |
|
Manuel
|
4c0c7c77b7
|
fix: brute force guessing of user sensitive data via search patterns (GHSA-2m6g-crv8-p3c6) (#8146) [skip release]
|
2022-09-02 21:43:31 +02:00 |
|
Manuel
|
f0db4ca4a4
|
fix: brute force guessing of user sensitive data via search patterns (GHSA-2m6g-crv8-p3c6) (#8145) [skip release]
|
2022-09-02 21:43:09 +02:00 |
|
Antoine Cormouls
|
c16f529f74
|
fix: internal indices for classes _Idempotency and _Role are not protected in defined schema (#8121)
|
2022-08-05 11:25:02 +02:00 |
|
Jong Eun Lee
|
7f5a15d5df
|
fix: graphQL query ignores condition equalTo with value false (#8032)
|
2022-07-03 12:13:10 +02:00 |
|
Manuel
|
9fd4516cde
|
fix: protected fields exposed via LiveQuery (GHSA-crrq-vr9j-fxxh) [skip release] (#8076)
|
2022-06-30 13:01:40 +02:00 |
|
Manuel
|
636d16e0f9
|
fix: protected fields exposed via LiveQuery (GHSA-crrq-vr9j-fxxh) [skip release] (#8075)
|
2022-06-30 12:53:31 +02:00 |
|
Manuel
|
4c9e95674a
|
fix: invalid file request not properly handled [skip release] (#8062)
|
2022-06-18 02:38:04 +02:00 |
|
Manuel
|
1a04a347cf
|
fix: invalid file request not properly handled [skip release] (#8061)
|
2022-06-18 02:15:08 +02:00 |
|
Manuel
|
75af9a26cc
|
fix: certificate in Apple Game Center auth adapter not validated [skip release] (#8058)
|
2022-06-17 20:22:35 +02:00 |
|
Manuel
|
4c2aa63fd2
|
fix: certificate in Apple Game Center auth adapter not validated [skip release] (#8055)
|
2022-06-17 19:32:30 +02:00 |
|
Antoine Cormouls
|
0d818879c2
|
fix: errors in GraphQL do not show the original error but a general Unexpected Error (#8045)
|
2022-06-17 13:40:31 +02:00 |
|
Layne Bernardo
|
03caae1e61
|
fix: websocket connection of LiveQuery interrupts frequently (#8048)
|
2022-06-17 13:20:48 +02:00 |
|
dblythy
|
199dfc1722
|
fix: live query role cache does not clear when a user is added to a role (#8026)
|
2022-06-11 10:21:55 +02:00 |
|
Antoine Cormouls
|
0cd902b8c2
|
refactor: upgrade GraphQL dependencies (#7970)
|
2022-06-10 14:01:45 +02:00 |
|
Javad
|
2d5221e480
|
fix: interrupted WebSocket connection not closed by LiveQuery server (#8012)
|
2022-06-05 16:01:48 +02:00 |
|
dblythy
|
c6dcad8d16
|
feat: align file trigger syntax with class trigger; use the new syntax Parse.Cloud.beforeSave(Parse.File, (request) => {}), the old syntax Parse.Cloud.beforeSaveFile((request) => {}) has been deprecated (#7966)
|
2022-05-29 20:48:55 +02:00 |
|
dblythy
|
c1e808f9e8
|
feat: selectively enable / disable default authentication adapters (#7953)
|
2022-05-29 01:50:43 +02:00 |
|