Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix/vuln grape strip #853

Closed
wants to merge 759 commits into from
Closed

Fix/vuln grape strip #853

wants to merge 759 commits into from

Conversation

mod
Copy link

@mod mod commented Mar 8, 2019

Important security fix, a vulnerability has been introduced in patch upgrade 1.0.1 after our code review

Maksim Litvinov and others added 30 commits June 5, 2018 14:09
Add readiness & liveness probes (#1197)
fb06503 
* Add readiness_probe

* Add HelthChecker service

* Review fixes

* Use connection from associated model
@kite-bot
[ci skip] Bump 1.8.28.
9f6a856
@yivo
Add missing index for authentication which is important for API v2 pe…
b826253 
…rformance (closes #1237) (#1244)
@ysv
Fully support field Market#enabled (related to #817) (#1229)
33792f1 
* Fully support field Market#enabled (related to #817)

* Fix
@kite-bot
[ci skip] Bump 1.8.29.
94bc001
@ysv
Check if both currencies are enabled on market enabling (closes #1242) (
6a5b042 
#1243)

* Check if both currencies are enabled on market enabling (closes #1242)
@k1T4eR
Use create,migrate,seed instead of setup. (#1259)
f5b9bfb
@yivo
Don't accept deposits in case if deposit_confirmations set to zero (f…
d46c664 
…ixes #1248) (#1257)
@kite-bot
[ci skip] Bump 1.8.30.
2bebcc3
@yivo
Cache JWT key (don't initialize it at every request) (#1269)
595f128
@k1T4eR
Hide request.authorization by 'SECRET'. (#1263)
125d811
@kite-bot
[ci skip] Bump 1.8.31.
9c3beb8
@mitjok
Add support for Barong 1.8 dynamic levels (closes #1134) (#1222)
b47159a 
* #1134: integer member levels, trading ability fetched from env var
@kite-bot
[ci skip] Bump 1.8.32.
ad022b3
@shal
Add documentation for Websocket API (#1256)
a31ae3e 
* Add documentation for websocket api

* Update documentation, add missing details

* Finish API documentation
@kite-bot
[ci skip] Bump 1.8.33.
1035e15
@yivo
Ensure orders are put back to matching daemon order book (fixes disap…
1c814ed 
…pearing orders, fixes order cancelation problem, optimizes number of queries to markets) (#1245)
@kite-bot
[ci skip] Bump 1.8.34.
bd36a43
@yivo
Add missing input for ERC20 contract address (#1286)
1921436
@yivo
Remove deprecated POST /api/v2/withdraws (closes #1178) (#1284)
edb6900
@kite-bot
[ci skip] Bump 1.8.35.
66e92b2
@dinesh-skyach
Fix Bunny errors which make WS API broken (closes #1279) (#1283)
471bb08 
* WS protocol API Broken v1.8
@kite-bot
[ci skip] Bump 1.8.36.
abb51ea
@yivo
Handle missing Redis values in GET /api/v2/k (fixes #1281) (#1295)
cc6aa74
@yivo
Fix Figaro warnings (#1300)
3808edd
@yivo
Fix Google auth error (Error: invalid_request) which breaks local sig…
6c9297f 
…n in for development (#1301)
@yivo
Prevent race conditions in withdraw worker + add rich logging. (#1306)
eeb038b
@yivo
Handle race conditions when registering member + add useful logging f…
a9b1859 
…or OmniAuth sequence. (#1310)
@yivo
Handle missing member & currency as validation errors preventing NoMe…
a9aac13 
…thodError (closes #1272) (#1299)
@kite-bot
[ci skip] Bump 1.8.37.
40af459
kite-bot and others added 25 commits December 20, 2018 07:54
@kite-bot
[ci skip] Bump 1.9.9.
d2342bd
Don't trigger pusher events on market order update
318330e
@kite-bot
[ci skip] Bump 1.9.10.
d18c1c4
Load balance from hot wallet before make quick withdraw (#1934)
608918a
@kite-bot
[ci skip] Bump 1.9.11.
872114a
@ritesh-skyach
Add Currency Name (#1944)
6ec0c08
@kite-bot
[ci skip] Bump 1.9.12.
5b29c25
@ysv
Freeze bundler version in 1.17.1
a51e742
@kite-bot
[ci skip] Bump 1.9.13.
005b3fe
Add min withdraw amount for currencies
7577d6a
Add manualy loading withdrawal from admin panel and validations for e…
692e40c 
…vents
@kite-bot
[ci skip] Bump 1.9.14.
b1110fe
@rxx
Event API serializers imporvements (closes #1376, #1396) (#1442)
ac2a928 
* #1376: Add account model event
* #1396: Add id to order and trade events
@kite-bot
[ci skip] Bump 1.9.15.
f5ea6ea
@ysv
Expose Trade market maker and don't expose null side
6180e8f
@kite-bot
[ci skip] Bump 1.9.16.
b7b3fe0
@ysv
Publish WS event on k-line updates. Improve k-daemon performance
62cdcac 
* Publish MQ event on  #update_point or #append_point
* Update WS API doc
* Skip unnecessary k point updates
* Use lset instead of pop & push
* Add TODO to k.rb
* Add k-line comments
* KLineService #humanize_period(period)

closes #1995
@kite-bot
[ci skip] Bump 1.9.17.
ecc4ef2
Add close, avg_price & price_change_percent to WS & REST API
f03180b 
* Add close, avg_price & price_change_percent
* Update WS API doc
* Move & refactor Market #change_ratio to Global
* Add ticker specs

closes #1991
@kite-bot
[ci skip] Bump 1.9.18.
4dfc132
Updating api docs
5975f0a
@kite-bot
[ci skip] Bump 1.9.19.
1ffe6c5
@sd189
Update setup-ubuntu.md (#2043)
dbbef13
@kite-bot
[ci skip] Bump 1.9.20.
c3ae0ec
Revert "Add grape_strip to resolve whitespace in input params"
8765de3 
This reverts commit 44a653a.
@mod mod closed this Mar 8, 2019
@mod mod deleted the fix/vuln-grape-strip branch March 8, 2019 12:08
@mod mod restored the fix/vuln-grape-strip branch March 8, 2019 12:08
@mod mod deleted the fix/vuln-grape-strip branch March 8, 2019 12:44
@dagnyc dagnyc mentioned this pull request Mar 17, 2019
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone