Enhance security by disallowing CSP object-src rule #17818
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
netbsd-srcmastr
pushed a commit
to NetBSD/pkgsrc
that referenced
this pull request
Aug 3, 2021
Changes in [1.7.34](https://github.com/vector-im/element-desktop/releases/tag/v1.7.34) (2021-07-02) =================================================================================================== ## 🔒 SECURITY FIXES * Sanitize untrusted variables from message previews before translation Fixes element-hq/element-web#18314 ## ✨ Features * Fix editing of `<sub>` & `<sup`> & `<u>` [\#6469](matrix-org/matrix-react-sdk#6469) Fixes #18211 * Zoom images in lightbox to where the cursor points [\#6418](matrix-org/matrix-react-sdk#6418) Fixes #17870 * Avoid hitting the settings store from TextForEvent [\#6205](matrix-org/matrix-react-sdk#6205) Fixes #17650 * Initial MSC3083 + MSC3244 support [\#6212](matrix-org/matrix-react-sdk#6212) Fixes #17686 and #17661 * Navigate to the first room with notifications when clicked on space notification dot [\#5974](matrix-org/matrix-react-sdk#5974) * Add matrix: to the list of permitted URL schemes [\#6388](matrix-org/matrix-react-sdk#6388) * Add "Copy Link" to room context menu [\#6374](matrix-org/matrix-react-sdk#6374) * 💭 Message bubble layout [\#6291](matrix-org/matrix-react-sdk#6291) Fixes #4635, #17773 #16220 and #7687 * Play only one audio file at a time [\#6417](matrix-org/matrix-react-sdk#6417) Fixes #17439 * Move download button for media to the action bar [\#6386](matrix-org/matrix-react-sdk#6386) Fixes #17943 * Improved display of one-to-one call history with summary boxes for each call [\#6121](matrix-org/matrix-react-sdk#6121) Fixes #16409 * Notification settings UI refresh [\#6352](matrix-org/matrix-react-sdk#6352) Fixes #17782 * Fix EventIndex double handling events and erroring [\#6385](matrix-org/matrix-react-sdk#6385) Fixes #18008 * Improve reply rendering [\#3553](matrix-org/matrix-react-sdk#3553) Fixes element-hq/element-web#9217, element-hq/element-web#7633, element-hq/element-web#7530, element-hq/element-web#7169, element-hq/element-web#7151, element-hq/element-web#6692 element-hq/element-web#6579 and #17440 * Improve performance of room name calculation [\#1801](matrix-org/matrix-js-sdk#1801) ## 🐛 Bug Fixes * Fix browser history getting stuck looping back to the same room [\#18053](element-hq/element-web#18053) * Fix space shortcuts on layouts with non-English keys in the places of numbers [\#17780](element-hq/element-web#17780) Fixes #17776 * Fix CreateRoomDialog exploding when making public room outside of a space [\#6493](matrix-org/matrix-react-sdk#6493) * Fix regression where registration would soft-crash on captcha [\#6505](matrix-org/matrix-react-sdk#6505) Fixes #18284 * only send join rule event if we have a join rule to put in it [\#6517](matrix-org/matrix-react-sdk#6517) * Improve the new download button's discoverability and interactions. [\#6510](matrix-org/matrix-react-sdk#6510) * Fix voice recording UI looking broken while microphone permissions are being requested. [\#6479](matrix-org/matrix-react-sdk#6479) Fixes #18223 * Match colors of room and user avatars in DMs [\#6393](matrix-org/matrix-react-sdk#6393) Fixes #2449 * Fix onPaste handler to work with copying files from Finder [\#5389](matrix-org/matrix-react-sdk#5389) Fixes #15536 and #16255 * Fix infinite pagination loop when offline [\#6478](matrix-org/matrix-react-sdk#6478) Fixes #18242 * Fix blurhash rounded corners missing regression [\#6467](matrix-org/matrix-react-sdk#6467) Fixes #18110 * Fix position of the space hierarchy spinner [\#6462](matrix-org/matrix-react-sdk#6462) Fixes #18182 * Fix display of image messages that lack thumbnails [\#6456](matrix-org/matrix-react-sdk#6456) Fixes #18175 * Fix crash with large audio files. [\#6436](matrix-org/matrix-react-sdk#6436) Fixes #18149 * Make diff colors in codeblocks more pleasant [\#6355](matrix-org/matrix-react-sdk#6355) Fixes #17939 * Show the correct audio file duration while loading the file. [\#6435](matrix-org/matrix-react-sdk#6435) Fixes #18160 * Fix various timeline settings not applying immediately. [\#6261](matrix-org/matrix-react-sdk#6261) Fixes #17748 * Fix issues with room list duplication [\#6391](matrix-org/matrix-react-sdk#6391) Fixes #14508 * Fix grecaptcha throwing useless error sometimes [\#6401](matrix-org/matrix-react-sdk#6401) Fixes #15142 * Update Emojibase and Twemoji and switch to IamCal (Slack-style) shortcodes [\#6347](matrix-org/matrix-react-sdk#6347) Fixes #13857 and #13334 * Respect compound emojis in default avatar initial generation [\#6397](matrix-org/matrix-react-sdk#6397) Fixes #18040 * Fix bug where the 'other homeserver' field in the server selection dialog would become briefly focus and then unfocus when clicked. [\#6394](matrix-org/matrix-react-sdk#6394) Fixes #18031 * Standardise spelling and casing of homeserver, identity server, and integration manager [\#6365](matrix-org/matrix-react-sdk#6365) * Fix widgets not receiving decrypted events when they have permission. [\#6371](matrix-org/matrix-react-sdk#6371) Fixes #17615 * Prevent client hangs when calculating blurhashes [\#6366](matrix-org/matrix-react-sdk#6366) Fixes #17945 * Exclude state events from widgets reading room events [\#6378](matrix-org/matrix-react-sdk#6378) * Cache feature_spaces\* flags to improve performance [\#6381](matrix-org/matrix-react-sdk#6381) Changes in [1.7.33](https://github.com/vector-im/element-web/releases/tag/v1.7.33) (2021-07-19) =============================================================================================== [Full Changelog](element-hq/element-web@v1.7.33-rc.1...v1.7.33) * No changes from rc.1 Changes in [1.7.33-rc.1](https://github.com/vector-im/element-web/releases/tag/v1.7.33-rc.1) (2021-07-14) ========================================================================================================= [Full Changelog](element-hq/element-web@v1.7.32...v1.7.33-rc.1) * Translations update from Weblate [\#17991](element-hq/element-web#17991) * Revert "Don't run nginx as root in docker" [\#17990](element-hq/element-web#17990) * Don't run nginx as root in docker [\#17927](element-hq/element-web#17927) * Add VS Code to gitignore [\#17982](element-hq/element-web#17982) * Remove canvas native dependencies from Dockerfile [\#17973](element-hq/element-web#17973) * Remove node-canvas devDependency [\#17967](element-hq/element-web#17967) * Add `reskindex` to development steps [\#17926](element-hq/element-web#17926) * Update Modernizr and stop it from polluting classes on the html tag [\#17921](element-hq/element-web#17921) * Convert a few files to TS [\#17895](element-hq/element-web#17895) * Do not generate a lockfile when running in CI [\#17902](element-hq/element-web#17902) * Fix lockfile to match listed dependencies [\#17888](element-hq/element-web#17888) * Remove PostCSS calc() processing [\#17856](element-hq/element-web#17856) * Make issue template styling more consistent and improve PR template [\#17691](element-hq/element-web#17691) * Update jsrsasign to ^10.2.0 (Includes fix for CVE-2021-30246) [\#17170](element-hq/element-web#17170) * Migrate to `eslint-plugin-matrix-org` [\#17847](element-hq/element-web#17847) * Remove spurious overflow: auto on #matrixchat element [\#17647](element-hq/element-web#17647) * Enhance security by disallowing CSP object-src rule [\#17818](element-hq/element-web#17818)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #6162
Requires matrix-org/matrix-react-sdk#6279