Ginger
8cf2d175d6
fix: Update package and crate metadata
2026-01-08 19:28:27 +00:00
Jade Ellis
d353446488
fix: Incomplete rename
2026-01-07 23:48:04 +00:00
timedout
77e8fd1744
style: Use contains to check for row presence
2026-01-07 17:31:54 +00:00
timedout
7fa7b129c0
perf: Store empty value (row only needs to exist)
2026-01-07 17:31:54 +00:00
timedout
247bc15659
fix: Await future
2026-01-07 17:31:53 +00:00
timedout
88a35e139d
fix: Correctly return M_USER_LOCKED during login
2026-01-07 17:31:53 +00:00
timedout
1c816850ed
feat: Allow admins to disable the login capability of an account
...
# Conflicts:
# src/admin/user/commands.rs
2026-01-07 17:31:51 +00:00
timedout
3483059e1c
fix: Unawaited future causing build error
2026-01-07 14:33:37 +00:00
Ginger
d865dd4454
feat( !783 ): Add --once shortcut flag to issue command
2026-01-07 14:22:37 +00:00
Ginger
adc7c5ac49
fix( !783 ): Don't allow registrations by default with no token configured
2026-01-07 14:22:37 +00:00
Ginger
112403e470
chore( !783 ): Remove config file check for no static token or captcha
2026-01-07 14:22:37 +00:00
Ginger
ea0a124981
chore( !783 ): Update config file documentation, depluralize token subcommand
2026-01-07 14:22:37 +00:00
Ginger
ca77970ff3
feat( !783 ): Add admin commands for managing tokens
2026-01-07 14:22:37 +00:00
Ginger
42f4ec34cd
feat( !783 ): Initial implementation
...
Adds support for extra limited-use registration tokens
stored in the database, and a new service to manage them.
2026-01-07 14:22:37 +00:00
timedout
a8209d1dd9
feat: Add command to forcefully log out all of a user's devices
2026-01-06 20:28:23 +00:00
Jade Ellis
9552dd7485
style: Log error
2026-01-06 01:55:52 +00:00
Ginger
88c84f221f
chore: Add comment and warning to unhappy path
2026-01-06 00:59:32 +00:00
Laurențiu Nicola
a10bd71945
fix(admin): fix force-leaving rooms with no left_state PDU
2026-01-06 00:59:31 +00:00
timedout
279f7cbfe4
style: Fix failing lints
2026-01-05 20:10:29 +00:00
timedout
006c57face
perf: Don't check accept_make_join twice for restricted make_join
2026-01-05 20:10:29 +00:00
timedout
d52e0dc014
fix: Apply check_all_joins to make_join
2026-01-05 20:10:29 +00:00
timedout
4b873a1b95
fix: Apply spam checker to local restricted joins
2026-01-05 20:10:29 +00:00
timedout
76865e6f91
fix: Accept_may_join callback works again
2026-01-05 20:10:29 +00:00
timedout
99f16c2dfc
fix: Call user_may_join_room later in the join process
2026-01-05 20:10:28 +00:00
timedout
5ac82f36f3
feat: Consolidate antispam checks into a service
...
Also adds support for the spam checker join rule, and Draupnir callbacks
2026-01-05 20:10:28 +00:00
timedout
c249dd992e
feat: Add support for automatically rejecting pending invites
2026-01-05 20:10:28 +00:00
timedout
0956779802
feat: Add Meowlnir invite interception support
...
Co-authored-by: Jade Ellis <jade@ellis.link>
2026-01-05 20:10:27 +00:00
timedout
a83c1f1513
fix: Restrict suspend+lock commands to admin room
...
Also prevent locking the service user or admin users
2026-01-05 19:49:12 +00:00
timedout
7502a944d7
feat: Add user locking and unlocking commands and functionality
...
Also corrects the response code returned by UserSuspended
2026-01-05 19:30:16 +00:00
Jade Ellis
aed15f246a
refactor: Clean up logging issues
...
Primary issues: Double escapes (debug fmt), spans without levels
2026-01-05 18:28:57 +00:00
timedout
27d6604d14
fix: Use a timeout instead of deadline
2026-01-03 17:08:47 +00:00
timedout
1c7bd2f6fa
style: Remove unnecessary then() calls in chain
2026-01-03 16:22:49 +00:00
timedout
56d7099011
style: Include errors in key claim response too
2026-01-03 16:10:06 +00:00
timedout
bc426e1bfc
fix: Apply client-requested timeout to federated key queries
...
Also parallelised federation calls in related functions
2026-01-03 16:05:05 +00:00
timedout
6c61b3ec5b
fix: Build error two: electric boogaloo
2025-12-31 21:15:28 +00:00
timedout
9d9d1170b6
fix: Build error
2025-12-31 21:04:06 +00:00
Jade Ellis
7be20abcad
style: Fix typo
2025-12-31 20:08:53 +00:00
timedout
bf200ad12d
fix: Resolve compile errors
...
me and cargo check are oops now
2025-12-31 20:01:29 +00:00
timedout
44851ee6a2
feat: Fall back to remote room summary if local fails
2025-12-31 20:01:29 +00:00
timedout
a7e6e6e83f
feat: Allow local server admins to bypass summary visibility checks
...
feat: Allow local server admins to bypass summary visibility checks
Also improve error messages so they aren't so damn long.
2025-12-31 20:01:29 +00:00
Ginger
8a561fcd3a
chore: Clippy fixes
2025-12-31 19:56:35 +00:00
Ginger
25c305f473
chore: Fix comment formatting
2025-12-31 19:56:35 +00:00
Ginger
c565e6ffbc
feat: Restrict where certain admin commands may be used
2025-12-31 19:56:31 +00:00
Jade Ellis
442f887c98
style: Improve warning regarding admin removal
2025-12-31 19:40:42 +00:00
Terry
f8c1e9bcde
feat: Config defined admin list
...
Closes !1246
2025-12-31 19:35:40 +00:00
Ginger
21324b748f
feat: Enable console feature by default
2025-12-31 19:12:25 +00:00
timedout
7c741e62cf
fix: Forbid creators in power levels
2025-12-30 17:34:43 +00:00
Olivia Lee
12aecf8091
validate membership events returned by remote servers
...
This fixes a vulnerability where an attacker with a malicious remote
server and a user on the local server can trick the local server into
signing arbitrary events. The attacker issue a remote leave as the local
user to a room on the malicious server. Without any validation of the
make_leave response, the local server would sign the attacker-controlled
event and pass it back to the malicious server with send_leave.
The join and knock endpoints are also fixed in this commit, but are less
useful for exploitation because the local server replaces the "content"
field returned by the remote server. Remote invites are unaffected
because we already check that the event returned from /invite has the
same event ID as the event passed to it.
Co-authored-by: timedout <git@nexy7574.co.uk>
Co-authored-by: Jade Ellis <jade@ellis.link>
Co-authored-by: Ginger <ginger@gingershaped.computer>
2025-12-30 15:24:45 +00:00
Jade Ellis
5e0edd5a1c
feat: Allow configuring the OTLP protocol
2025-12-29 23:33:12 +00:00
Jade Ellis
d180f5a759
feat: Split otlp exporter into a new, enabled-by-default feature
2025-12-29 23:33:12 +00:00
