From ae40d8223a37368bbf5b28d9fbbe2162ca729d55 Mon Sep 17 00:00:00 2001 From: Andrew Morgan Date: Fri, 20 Sep 2019 13:11:16 +0100 Subject: [PATCH 1/2] Remove trailing slash ability from password_reset/submit_token --- synapse/rest/client/v2_alpha/account.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/synapse/rest/client/v2_alpha/account.py b/synapse/rest/client/v2_alpha/account.py index 1791f4d79bcd..3c5b23dc8067 100644 --- a/synapse/rest/client/v2_alpha/account.py +++ b/synapse/rest/client/v2_alpha/account.py @@ -200,7 +200,7 @@ class PasswordResetSubmitTokenServlet(RestServlet): """Handles 3PID validation token submission""" PATTERNS = client_patterns( - "/password_reset/(?P[^/]*)/submit_token/*$", releases=(), unstable=True + "/password_reset/(?P[^/]*)/submit_token$", releases=(), unstable=True ) def __init__(self, hs): From bb0da4fcc7edd5a0db8ed13eb165b1a9f83a27ad Mon Sep 17 00:00:00 2001 From: Andrew Morgan Date: Fri, 20 Sep 2019 13:14:11 +0100 Subject: [PATCH 2/2] Add changelog --- changelog.d/6074.feature | 1 + 1 file changed, 1 insertion(+) create mode 100644 changelog.d/6074.feature diff --git a/changelog.d/6074.feature b/changelog.d/6074.feature new file mode 100644 index 000000000000..b7aa9c99d89a --- /dev/null +++ b/changelog.d/6074.feature @@ -0,0 +1 @@ +Prevent password reset's submit_token endpoint from accepting trailing slashes. \ No newline at end of file