From d3441ebb563439bac0837d70591f92e2c6080303 Mon Sep 17 00:00:00 2001 From: Martin Holst Swende Date: Tue, 25 Sep 2018 15:54:58 +0200 Subject: cmd/clef, signer: security fixes (#17554) * signer: remove local path disclosure from extapi * signer: show more data in cli ui * rpc: make http server forward UA and Origin via Context * signer, clef/core: ui changes + display UA and Origin * signer: cliui - indicate less trust in remote headers, see https://github.com/ethereum/go-ethereum/issues/17637 * signer: prevent possibility swap KV-entries in aes_gcm storage, fixes #17635 * signer: remove ecrecover from external API * signer,clef: default reject instead of warn + valideate new passwords. fixes #17632 and #17631 * signer: check calldata length even if no ABI signature is present * signer: fix failing testcase * clef: remove account import from external api * signer: allow space in passwords, improve error messsage * signer/storage: fix typos --- cmd/clef/extapi_changelog.md | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'cmd/clef/extapi_changelog.md') diff --git a/cmd/clef/extapi_changelog.md b/cmd/clef/extapi_changelog.md index 2014e90ae..6c2c3e819 100644 --- a/cmd/clef/extapi_changelog.md +++ b/cmd/clef/extapi_changelog.md @@ -1,6 +1,13 @@ ### Changelog for external API +#### 4.0.0 +* The external `account_Ecrecover`-method was removed. +* The external `account_Import`-method was removed. + +#### 3.0.0 + +* The external `account_List`-method was changed to not expose `url`, which contained info about the local filesystem. It now returns only a list of addresses. #### 2.0.0 -- cgit v1.2.3