From 1942cad1f6296860cfff27415a6f5099cbbc8f43 Mon Sep 17 00:00:00 2001 From: RiotRobot Date: Thu, 4 Jun 2020 15:34:57 +0100 Subject: [PATCH] Prepare changelog for v1.6.3 --- CHANGELOG.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4039829ffa..3e5801e5b4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,16 @@ +Changes in [1.6.3](https://github.com/vector-im/riot-web/releases/tag/v1.6.3) (2020-06-04) +========================================================================================== +[Full Changelog](https://github.com/vector-im/riot-web/compare/v1.6.3-rc.1...v1.6.3) + +## Security notice + +Riot Web 1.6.3 fixes a vulnerability in single sign-on (SSO) deployments where Riot Web could be confused into sending authentication details to an attacker-controlled server. Thanks to Quentin Gliech for responsibly disclosing this via Matrix's Security Disclosure Policy. + +## All changes + + * Fix login loop where the sso flow returns to `#/login` to release + [\#13915](https://github.com/vector-im/riot-web/pull/13915) + Changes in [1.6.3-rc.1](https://github.com/vector-im/riot-web/releases/tag/v1.6.3-rc.1) (2020-06-02) ==================================================================================================== [Full Changelog](https://github.com/vector-im/riot-web/compare/v1.6.2...v1.6.3-rc.1)