Skip to content
Snippets Groups Projects
This project is mirrored from https://github.com/Nheko-Reborn/nheko.git. Pull mirroring updated .
  1. Nov 04, 2022
  2. Oct 27, 2022
  3. Oct 25, 2022
  4. Oct 22, 2022
  5. Oct 19, 2022
  6. Oct 14, 2022
    • Rohit Sutradhar's avatar
      VoIP v1 implementation (#1161) · ac48c332
      Rohit Sutradhar authored
      * Initial commit for VoIP v1 implementation
      
      * Added draft of event handlers for voip methods
      
      * Added event handlers for VoIP events, added rejectCall, added version tracking for call version for V0 and V1 compatibility
      
      * Added call events to the general message pipeline. Modified Call Reject mechanism
      
      * Added message delegates for new events. Modified hidden events. Updated handle events.
      
      * Updated implementation to keep track of calls on other devices
      
      * Fixed linting
      
      * Fixed code warnings
      
      * Fixed minor bugs
      
      * fixed ci
      
      * Added acceptNegotiation method definition when missing gstreamer
      
      * Fixed warnings
      
      * Fixed linting
      Unverified
      ac48c332
  7. Oct 13, 2022
  8. Oct 10, 2022
  9. Oct 09, 2022
    • Nicolas Werner's avatar
      Properly propagate pack usage to UI · 4002b1ec
      Nicolas Werner authored
      We can't have a pack that is neither sticker nor emoji. Which is why
      none defaults to both on. That wasn't propagated to the UI, which made
      the interaction very confusing. It also made some states unsettable,
      since you can't turn anything off from the none state.
      
      fixes #1152
      Verified
      4002b1ec
  10. Oct 08, 2022
  11. Oct 07, 2022
  12. Oct 06, 2022
  13. Oct 05, 2022
  14. Oct 03, 2022
  15. Oct 02, 2022
  16. Oct 01, 2022
  17. Sep 30, 2022
  18. Sep 28, 2022
    • Nicolas Werner's avatar
      Make clazy happy · bffa0115
      Nicolas Werner authored
      Verified
      bffa0115
    • Nicolas Werner's avatar
      Prevent the homeserver from inserting malicious secrets · 67bee15a
      Nicolas Werner authored
      Correctly verify that the reply to a secrets request is actually coming
      from a verified device. While we did verify that it was us who replied,
      we didn't properly cancel storing the secret if the sending device was
      one of ours but was maliciously inserted by the homeserver and
      unverified. We only send secret requests to verified devices in the
      first place, so only the homeserver could abuse this issue.
      
      Additionally we protected against malicious secret poisoning by
      verifying that the secret is actually the reply to a request. This means
      the server only has 2 places where it can poison the secrets:
      
      - After a verification when we automatically request the secrets
      - When the user manually hits the request button
      
      It also needs to prevent other secret answers to reach the client first
      since we ignore all replies after that one.
      
      The impact of this might be quite severe. It could allow the server to
      replace the cross-signing keys silently and while we might not trust
      that key, we possibly could trust it in the future if we rely on the
      stored secret. Similarly this could potentially be abused to make the
      client trust a malicious online key backup.
      
      If your deployment is not patched yet and you don't control your
      homeserver, you can protect against this by simply not doing any
      verifications of your own devices and not pressing the request button in
      the settings menu.
      Verified
      67bee15a
Loading