kami-parse-server

fix: Security upgrade jsonwebtoken to 9.0.0 (#8431 )

2023-02-16 19:52:48 +01:00

2021-03-30 22:42:34 +02:00

feat: align file trigger syntax with class trigger; use the new syntax Parse.Cloud.beforeSave(Parse.File, (request) => {}), the old syntax Parse.Cloud.beforeSaveFile((request) => {}) has been deprecated (#7966 )

2022-05-29 20:48:55 +02:00

Controllers

fix: Remote code execution via MongoDB BSON parser through prototype pollution; fixes security vulnerability [GHSA-462x-c3jw-7vr6](https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6 ) (#8675 )

2023-06-28 22:59:09 +02:00

Deprecator

fix: depreciate allowClientClassCreation defaulting to true (#7925 )

2022-05-07 21:08:59 +02:00

GraphQL

feat: add option to change the default value of the Parse.Query.limit() constraint (#8152 )

2022-09-30 00:38:57 +02:00

LiveQuery

feat: liveQuery support for unsorted distance queries (#8221 )

2022-10-12 00:27:29 +02:00

Options

fix: Server does not start via CLI when auth option is set (#8669 )

2023-06-29 21:59:08 +02:00

Push

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

Routers

fix: Remote code execution via MongoDB BSON parser through prototype pollution; fixes security vulnerability [GHSA-462x-c3jw-7vr6](https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6 ) (#8675 )

2023-06-28 22:59:09 +02:00

SchemaMigrations

fix: internal indices for classes _Idempotency and _Role are not protected in defined schema (#8121 )

2022-08-05 11:25:02 +02:00

Security

fix: improve security by deprecating creating users with public access by default (#7319 )

2021-10-08 05:24:20 +02:00

vendor

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

AccountLockout.js

refactor: replace hardcoded error codes with references (#7546 )

2021-10-18 20:19:47 +02:00

Auth.js

fix: live query role cache does not clear when a user is added to a role (#8026 )

2022-06-11 10:21:55 +02:00

batch.js

build: release

2022-03-18 15:17:12 +01:00

cache.js

Use Prettier JS (#5017 )

2018-09-01 13:58:06 -04:00

ClientSDK.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

Config.js

feat: Add new Parse Server option fileUpload.fileExtensions to restrict file upload by file extension; this fixes a security vulnerability in which a phishing attack could be performed using an uploaded HTML file; by default the new option only allows file extensions matching the regex pattern ^[^hH][^tT][^mM][^lL]?$, which excludes HTML files; this fix is released as a patch version given the severity of this vulnerability, however, if your app currently depends on uploading files with HTML file extensions then this may be a breaking change and you could allow HTML file upload by setting the option to ['.*'] (#8537 )

2023-05-21 01:14:27 +02:00

cryptoUtils.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

defaults.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

deprecated.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

index.js

feat: add user-defined schema and migrations (#7418 )

2021-11-01 14:28:49 +01:00

KeyPromiseQueue.js

Add KeyPromiseQueue to Push and Job StatusHandlers (#7267 )

2021-03-15 18:51:46 -05:00

logger.js

Fix #6179 Initializing default logger (#6186 )

2019-11-07 17:41:34 -06:00

middlewares.js

fix: The client IP address may be determined incorrectly in some cases; it is now required to set the Parse Server option trustProxy accordingly if Parse Server runs behind a proxy server, see the express framework's [trust proxy](https://expressjs.com/en/guide/behind-proxies.html ) setting; this fixes a security vulnerability in which the Parse Server option masterKeyIps may be circumvented, see [GHSA-vm5r-c87r-pf6x](https://github.com/parse-community/parse-server/security/advisories/GHSA-vm5r-c87r-pf6x ) (#8369 )

2023-01-05 14:20:40 +01:00

Page.js

Add page localization (#7128 )

2021-02-09 14:03:57 +01:00

ParseMessageQueue.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

ParseServer.js

fix: The client IP address may be determined incorrectly in some cases; it is now required to set the Parse Server option trustProxy accordingly if Parse Server runs behind a proxy server, see the express framework's [trust proxy](https://expressjs.com/en/guide/behind-proxies.html ) setting; this fixes a security vulnerability in which the Parse Server option masterKeyIps may be circumvented, see [GHSA-vm5r-c87r-pf6x](https://github.com/parse-community/parse-server/security/advisories/GHSA-vm5r-c87r-pf6x ) (#8369 )

2023-01-05 14:20:40 +01:00

ParseServerRESTController.js

refactor: remove deprecated url.parse() method (#7751 )

2022-01-06 15:26:00 +01:00

password.js

chore: replace bcrypt with @node-rs/bcrypt (#6794 )

2020-07-13 10:08:01 -05:00

PromiseRouter.js

Improve single schema cache (#7214 )

2021-03-16 16:05:36 -05:00

request.js

remove runtime dependency on request (#5076 )

2018-09-23 12:31:08 -04:00

requiredParameter.js

Use Prettier JS (#5017 )

2018-09-01 13:58:06 -04:00

rest.js

Fix: context for afterFind (#7078 )

2020-12-18 14:54:48 +01:00

RestQuery.js

fix: brute force guessing of user sensitive data via search patterns (GHSA-2m6g-crv8-p3c6) (#8146 ) [skip release]

2022-09-02 21:43:31 +02:00

RestWrite.js

fix: Remote code execution via MongoDB BSON parser through prototype pollution; fixes security vulnerability [GHSA-462x-c3jw-7vr6](https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6 ) (#8675 )

2023-06-28 22:59:09 +02:00

StatusHandler.js

Add KeyPromiseQueue to Push and Job StatusHandlers (#7267 )

2021-03-15 18:51:46 -05:00

TestUtils.js

Use Prettier JS (#5017 )

2018-09-01 13:58:06 -04:00

triggers.js

feat: align file trigger syntax with class trigger; use the new syntax Parse.Cloud.beforeSave(Parse.File, (request) => {}), the old syntax Parse.Cloud.beforeSaveFile((request) => {}) has been deprecated (#7966 )

2022-05-29 20:48:55 +02:00

Utils.js

fix: Remote code execution via MongoDB BSON parser through prototype pollution; fixes security vulnerability [GHSA-462x-c3jw-7vr6](https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6 ) (#8675 )

2023-06-28 22:59:09 +02:00