Merge branch 'master' into ens/sdk-1163-cycles-transfer-top-up

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 # UNRELEASED
 
+### feat: change `list_permitted` and `list_authorized` to an update call.
+
+This requires the `list_authorized` and `list_permitted` methods to be called as an update and disables the ability to
+call it as a query call. This resolves a potential security risk.
+
 ### fix: `dfx ledger transfer` now logs to stderr messages about duplicates rather than printing them to stdout
 
 The message "transaction is a duplicate of another transaction in block ...", previously printed to stdout, is now logged to stderr. This means that the output of `dfx ledger transfer` to stdout will contain only "Transfer sent at block height <block height>".
@@ -21,6 +26,11 @@ Added the following subcommands:
 
 Updated Motoko to [0.10.1](https://github.com/dfinity/motoko/releases/tag/0.10.1)
 
+### Frontend canister
+
+- Module hash: 517d5117bb43236e1673627aacec3955a68072dcd95f0b0218e6155f75a4bb54
+- https://github.com/dfinity/sdk/pull/3421
+
 # 0.15.1
 
 ### feat: Added support for reserved_cycles and reserved_cycles_limit

src/canisters/frontend/ic-certified-assets/assets.did

@@ -220,10 +220,10 @@ service: {
 
   authorize: (principal) -> ();
   deauthorize: (principal) -> ();
-  list_authorized: () -> (vec principal) query;
+  list_authorized: () -> (vec principal);
   grant_permission: (GrantPermission) -> ();
   revoke_permission: (RevokePermission) -> ();
-  list_permitted: (ListPermitted) -> (vec principal) query;
+  list_permitted: (ListPermitted) -> (vec principal);
   take_ownership: () -> ();
 
   get_asset_properties : (key: Key) -> (record {

src/canisters/frontend/ic-certified-assets/src/lib.rs

@@ -104,14 +104,14 @@ async fn validate_revoke_permission(arg: RevokePermissionArguments) -> Result<St
     ))
 }
 
-#[query(manual_reply = true)]
-#[candid_method(query)]
+#[update(manual_reply = true)]
+#[candid_method(update)]
 fn list_authorized() -> ManualReply<Vec<Principal>> {
     STATE.with(|s| ManualReply::one(s.borrow().list_permitted(&Permission::Commit)))
 }
 
-#[query(manual_reply = true)]
-#[candid_method(query)]
+#[update(manual_reply = true)]
+#[candid_method(update)]
 fn list_permitted(arg: ListPermittedArguments) -> ManualReply<Vec<Principal>> {
     STATE.with(|s| ManualReply::one(s.borrow().list_permitted(&arg.permission)))
 }

src/distributed/assetstorage.did

@@ -220,10 +220,10 @@ service: {
 
   authorize: (principal) -> ();
   deauthorize: (principal) -> ();
-  list_authorized: () -> (vec principal) query;
+  list_authorized: () -> (vec principal);
   grant_permission: (GrantPermission) -> ();
   revoke_permission: (RevokePermission) -> ();
-  list_permitted: (ListPermitted) -> (vec principal) query;
+  list_permitted: (ListPermitted) -> (vec principal);
   take_ownership: () -> ();
 
   get_asset_properties : (key: Key) -> (record {