Manuel 3d7a61ecd5 fix: server crashes when receiving file download request with invalid byte range; this fixes a security vulnerability that allows an attacker to impact the availability of the server instance; the fix improves parsing of the range parameter to properly handle invalid range requests ([GHSA-h423-w6qv-2wj3](https://github.com/parse-community/parse-server/security/advisories/GHSA-h423-w6qv-2wj3)) (#8236)

2022-10-15 02:12:05 +02:00

..

Adapters

fix: server crashes when receiving file download request with invalid byte range; this fixes a security vulnerability that allows an attacker to impact the availability of the server instance; the fix improves parsing of the range parameter to properly handle invalid range requests ([GHSA-h423-w6qv-2wj3](https://github.com/parse-community/parse-server/security/advisories/GHSA-h423-w6qv-2wj3)) (#8236)

2022-10-15 02:12:05 +02:00

cli

Fix Prettier (#7066)

2020-12-13 11:19:04 -06:00

cloud-code

skipWithMasterKey on Built-In Validator (#6972)

2020-10-26 12:49:30 -07:00

Controllers

fix: brute force guessing of user sensitive data via search patterns; this fixes a security vulnerability in which internal and protected fields may be used as query constraints to guess the value of these fields and obtain sensitive data (GHSA-2m6g-crv8-p3c6) (#8143)

2022-09-02 21:15:09 +02:00

GraphQL

Fix Prettier (#7066)

2020-12-13 11:19:04 -06:00

LiveQuery

fix: protected fields exposed via LiveQuery; this removes protected fields from the client response; this may be a breaking change if your app is currently expecting to receive these protected fields ([GHSA-crrq-vr9j-fxxh](https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh)) (#8074)

2022-06-30 12:24:34 +02:00

Options

fix: security vulnerability that allows remote code execution (ghsa p6h4 93qp jhcm) (#7841)

2022-03-12 00:19:31 +01:00

Push

fix(prettier): Properly handle lint-stage files (#6970)

2020-10-25 15:06:58 -05:00

Routers

fix: server crashes when receiving file download request with invalid byte range; this fixes a security vulnerability that allows an attacker to impact the availability of the server instance; the fix improves parsing of the range parameter to properly handle invalid range requests ([GHSA-h423-w6qv-2wj3](https://github.com/parse-community/parse-server/security/advisories/GHSA-h423-w6qv-2wj3)) (#8236)

2022-10-15 02:12:05 +02:00

vendor

fix(prettier): Properly handle lint-stage files (#6970)

2020-10-25 15:06:58 -05:00

AccountLockout.js

fix(prettier): Properly handle lint-stage files (#6970)

2020-10-25 15:06:58 -05:00

Auth.js

fix(prettier): Properly handle lint-stage files (#6970)

2020-10-25 15:06:58 -05:00

batch.js

Properly handle serverURL and publicServerUrl in Batch requests #6980 (#7049)

2020-12-09 14:16:24 -06:00

cache.js

Use Prettier JS (#5017)

2018-09-01 13:58:06 -04:00

ClientSDK.js

fix(prettier): Properly handle lint-stage files (#6970)

2020-10-25 15:06:58 -05:00

Config.js

fix: security vulnerability that allows remote code execution (ghsa p6h4 93qp jhcm) (#7841)

2022-03-12 00:19:31 +01:00

cryptoUtils.js

fix(prettier): Properly handle lint-stage files (#6970)

2020-10-25 15:06:58 -05:00

defaults.js

fix(prettier): Properly handle lint-stage files (#6970)

2020-10-25 15:06:58 -05:00

deprecated.js

fix(prettier): Properly handle lint-stage files (#6970)

2020-10-25 15:06:58 -05:00

index.js

fix(prettier): Properly handle lint-stage files (#6970)

2020-10-25 15:06:58 -05:00

logger.js

Fix #6179 Initializing default logger (#6186)

2019-11-07 17:41:34 -06:00

middlewares.js

fix(prettier): Properly handle lint-stage files (#6970)

2020-10-25 15:06:58 -05:00

ParseMessageQueue.js

fix(prettier): Properly handle lint-stage files (#6970)

2020-10-25 15:06:58 -05:00

ParseServer.js

fix(prettier): Properly handle lint-stage files (#6970)

2020-10-25 15:06:58 -05:00

ParseServerRESTController.js

fix(prettier): Properly handle lint-stage files (#6970)

2020-10-25 15:06:58 -05:00

password.js

chore: replace bcrypt with @node-rs/bcrypt (#6794)

2020-07-13 10:08:01 -05:00

PromiseRouter.js

fix(prettier): Properly handle lint-stage files (#6970)

2020-10-25 15:06:58 -05:00

request.js

remove runtime dependency on request (#5076)

2018-09-23 12:31:08 -04:00

requiredParameter.js

Use Prettier JS (#5017)

2018-09-01 13:58:06 -04:00

rest.js

fix(prettier): Properly handle lint-stage files (#6970)

2020-10-25 15:06:58 -05:00

RestQuery.js

fix: brute force guessing of user sensitive data via search patterns; this fixes a security vulnerability in which internal and protected fields may be used as query constraints to guess the value of these fields and obtain sensitive data (GHSA-2m6g-crv8-p3c6) (#8143)

2022-09-02 21:15:09 +02:00

RestWrite.js

fix: session object properties can be updated by foreign user; this fixes a security vulnerability in which a foreign user can write to the session object of another user if the session object ID is known; the fix prevents writing to foreign session objects ([GHSA-6w4q-23cf-j9jp](https://github.com/parse-community/parse-server/security/advisories/GHSA-6w4q-23cf-j9jp)) (#8183)

2022-09-20 02:19:43 +02:00

StatusHandler.js

fix(prettier): Properly handle lint-stage files (#6970)

2020-10-25 15:06:58 -05:00

TestUtils.js

Use Prettier JS (#5017)

2018-09-01 13:58:06 -04:00

triggers.js

feat: include sessionToken in onLiveQueryEvent (#7043)

2020-12-03 18:36:41 -06:00

Utils.js

fix: sensitive keyword detection may produce false positives (#7883)

2022-03-24 02:49:39 +01:00