diff --git a/Changelog.md b/Changelog.md index 82789bab0..64cb1f2ce 100644 --- a/Changelog.md +++ b/Changelog.md @@ -11,6 +11,12 @@ ## Features * Added the footer to conversation pages [#6710](https://github.com/diaspora/diaspora/pull/6710) +# 0.5.7.1 + +This security release disables post fetching for relayables. Due to an insecure implementation, fetching of root posts for relayables could allow an attacker to distribute malicious/spoofed/modified posts for any person. + +Disabling the fetching will make the current federation a bit less reliable, but for a hotfix, this is the best solution. We will re-enable the fetching in 0.6.0.0 when we moved out the federation into its own library and are able to implement further validation during fetches. + # 0.5.7.0 ## Refactor diff --git a/lib/federated/relayable.rb b/lib/federated/relayable.rb index 7a1b13d6c..cd5ec3b74 100644 --- a/lib/federated/relayable.rb +++ b/lib/federated/relayable.rb @@ -40,7 +40,7 @@ module Federated end def fetch_parent guid - Diaspora::Fetcher::Single.find_or_fetch_from_remote guid, diaspora_handle + raise Diaspora::PostNotFetchable end end end