@@ -88,5 +88,14 @@
 			"KevLehman",
 			"renatobecker"
 		]
+	}],
+	"3.14.2": [{
+		"title": "[FIX] Security Hotfix (https://docs.rocket.chat/guides/security/security-updates)",
+		"userLogin": "sampaiodiego",
+		"contributors": [
+			"sampaiodiego",
+			"KevLehman",
+			"g-thome"
+		]
 	}]
 }
@@ -59612,6 +59612,26 @@
           ]
         }
       ]
+    },
+    "3.14.2": {
+      "node_version": "12.22.1",
+      "npm_version": "6.14.1",
+      "apps_engine_version": "1.25.0",
+      "mongo_versions": [
+        "3.4",
+        "3.6",
+        "4.0"
+      ],
+      "pull_requests": [
+        {
+          "pr": "48",
+          "title": "Update README.md",
+          "userLogin": "hehsiao",
+          "contributors": [
+            "hehsiao"
+          ]
+        }
+      ]
     }
   }
-}
+}
@@ -1,4 +1,36 @@
 
+# 3.14.2
+`2021-05-25  ·  1 🐛  ·  1 🔍  ·  4 👩‍💻👨‍💻`
+
+### Engine versions
+- Node: `12.22.1`
+- NPM: `6.14.1`
+- MongoDB: `3.4, 3.6, 4.0`
+- Apps-Engine: `1.25.0`
+
+### 🐛 Bug fixes
+
+
+- Security Hotfix (https://docs.rocket.chat/guides/security/security-updates)
+
+<details>
+<summary>🔍 Minor changes</summary>
+
+
+- Update README.md ([#48](https://github.com/RocketChat/Rocket.Chat/pull/48) by [@hehsiao](https://github.com/hehsiao))
+
+</details>
+
+### 👩‍💻👨‍💻 Contributors 😍
+
+- [@hehsiao](https://github.com/hehsiao)
+
+### 👩‍💻👨‍💻 Core Team 🤓
+
+- [@KevLehman](https://github.com/KevLehman)
+- [@g-thome](https://github.com/g-thome)
+- [@sampaiodiego](https://github.com/sampaiodiego)
+
 # 3.14.1
 `2021-05-19  ·  1 🎉  ·  2 🚀  ·  4 🐛  ·  3 🔍  ·  7 👩‍💻👨‍💻`
 
 
@@ -18,7 +18,7 @@ export function clean(v: Query, allowList: string[] = []): Query {
 	if (v instanceof Object) {
 		/* eslint-disable guard-for-in */
 		for (const key in typedParam) {
-			if (/^$/.test(key) && !allowList.includes(key)) {
+			if (key.startsWith('$') && !allowList.includes(key)) {
 				delete typedParam[key];
 			} else {
 				clean(typedParam[key], allowList);
 
@@ -51,6 +51,7 @@ export const createRoom = function(type, name, owner, members = [], readOnly, {
 	}
 
 	let room = {
+		...extraData,
 		name: getValidRoomName(name, null, validRoomNameOptions),
 		fname: name,
 		t: type,
@@ -60,7 +61,6 @@ export const createRoom = function(type, name, owner, members = [], readOnly, {
 			_id: owner._id,
 			username: owner.username,
 		},
-		...extraData,
 		ts: now,
 		ro: readOnly === true,
 	};
 
@@ -7,6 +7,7 @@ import { TAPi18n } from 'meteor/rocketchat:tap-i18n';
 import { SyncedCron } from 'meteor/littledata:synced-cron';
 import archiver from 'archiver';
 import moment from 'moment';
+import { v4 as uuidv4 } from 'uuid';
 
 import { settings } from '../../settings/server';
 import { Subscriptions, Rooms, Users, Uploads, Messages, UserDataFiles, ExportOperations, Avatars } from '../../models/server';
@@ -504,12 +505,14 @@ const continueExportOperation = async function(exportOperation) {
 			}
 		}
 
+		const generatedFileName = uuidv4();
+
 		if (exportOperation.status === 'downloading') {
 			exportOperation.fileList.forEach((attachmentData) => {
 				copyFile(attachmentData, exportOperation.assetsPath);
 			});
 
-			const targetFile = joinPath(zipFolder, `${ exportOperation.userId }.zip`);
+			const targetFile = joinPath(zipFolder, `${ generatedFileName }.zip`);
 			if (await fsExists(targetFile)) {
 				await fsUnlink(targetFile);
 			}
@@ -520,7 +523,7 @@ const continueExportOperation = async function(exportOperation) {
 		if (exportOperation.status === 'compressing') {
 			createDir(zipFolder);
 
-			exportOperation.generatedFile = joinPath(zipFolder, `${ exportOperation.userId }.zip`);
+			exportOperation.generatedFile = joinPath(zipFolder, `${ generatedFileName }.zip`);
 			if (!await fsExists(exportOperation.generatedFile)) {
 				await makeZipFile(exportOperation.exportPath, exportOperation.generatedFile);
 			}
 
@@ -1,5 +1,6 @@
 import { Meteor } from 'meteor/meteor';
 import limax from 'limax';
+import { escapeHTML } from '@rocket.chat/string-helpers';
 
 import { settings } from '../../settings';
 import { Rooms } from '../../models';
@@ -9,17 +10,18 @@ export const getValidRoomName = (displayName, rid = '', options = {}) => {
 	let slugifiedName = displayName;
 
 	if (settings.get('UI_Allow_room_names_with_special_chars')) {
+		const cleanName = limax(displayName);
 		if (options.allowDuplicates !== true) {
 			const room = Rooms.findOneByDisplayName(displayName);
 			if (room && room._id !== rid) {
 				if (room.archived) {
-					throw new Meteor.Error('error-archived-duplicate-name', `There's an archived channel with name ${ displayName }`, { function: 'RocketChat.getValidRoomName', channel_name: displayName });
+					throw new Meteor.Error('error-archived-duplicate-name', `There's an archived channel with name ${ cleanName }`, { function: 'RocketChat.getValidRoomName', channel_name: cleanName });
 				} else {
-					throw new Meteor.Error('error-duplicate-channel-name', `A channel with name '${ displayName }' exists`, { function: 'RocketChat.getValidRoomName', channel_name: displayName });
+					throw new Meteor.Error('error-duplicate-channel-name', `A channel with name '${ cleanName }' exists`, { function: 'RocketChat.getValidRoomName', channel_name: cleanName });
 				}
 			}
 		}
-		slugifiedName = limax(displayName);
+		slugifiedName = cleanName;
 	}
 
 	let nameValidation;
@@ -35,9 +37,9 @@ export const getValidRoomName = (displayName, rid = '', options = {}) => {
 	}
 
 	if (!nameValidation.test(slugifiedName) || !validateName(slugifiedName)) {
-		throw new Meteor.Error('error-invalid-room-name', `${ slugifiedName } is not a valid room name.`, {
+		throw new Meteor.Error('error-invalid-room-name', `${ escapeHTML(slugifiedName) } is not a valid room name.`, {
 			function: 'RocketChat.getValidRoomName',
-			channel_name: slugifiedName,
+			channel_name: escapeHTML(slugifiedName),
 		});
 	}
 
@@ -52,9 +54,9 @@ export const getValidRoomName = (displayName, rid = '', options = {}) => {
 				}
 				slugifiedName = tmpName;
 			} else if (room.archived) {
-				throw new Meteor.Error('error-archived-duplicate-name', `There's an archived channel with name ${ slugifiedName }`, { function: 'RocketChat.getValidRoomName', channel_name: slugifiedName });
+				throw new Meteor.Error('error-archived-duplicate-name', `There's an archived channel with name ${ escapeHTML(slugifiedName) }`, { function: 'RocketChat.getValidRoomName', channel_name: escapeHTML(slugifiedName) });
 			} else {
-				throw new Meteor.Error('error-duplicate-channel-name', `A channel with name '${ slugifiedName }' exists`, { function: 'RocketChat.getValidRoomName', channel_name: slugifiedName });
+				throw new Meteor.Error('error-duplicate-channel-name', `A channel with name '${ escapeHTML(slugifiedName) }' exists`, { function: 'RocketChat.getValidRoomName', channel_name: escapeHTML(slugifiedName) });
 			}
 		}
 	}
 
@@ -221,6 +221,17 @@ if (Meteor.isServer) {
 				throw new Meteor.Error('invalid-store', 'The store does not exist');
 			}
 
+			let parsedUrl;
+			try {
+				parsedUrl = new URL(url);
+			} catch (e) {
+				throw new Meteor.Error('invalid-url', 'The url is not valid');
+			}
+
+			if (['localhost', '127.0.0.1', '0.0.0.0'].includes(parsedUrl.hostname)) {
+				throw new Meteor.Error('invalid-url', 'URL cannot reference localhost');
+			}
+
 			// Extract file info
 			if (!file.name) {
 				file.name = url.replace(/\?.*$/, '').split('/').pop();
Original file line number	Diff line number	Diff line change
`@@ -59612,6 +59612,26 @@`
`59612`	`59612`	`]`
`59613`	`59613`	`}`
`59614`	`59614`	`]`
	`59615`	`+ },`
	`59616`	`+ "3.14.2": {`
	`59617`	`+ "node_version": "12.22.1",`
	`59618`	`+ "npm_version": "6.14.1",`
	`59619`	`+ "apps_engine_version": "1.25.0",`
	`59620`	`+ "mongo_versions": [`
	`59621`	`+ "3.4",`
	`59622`	`+ "3.6",`
	`59623`	`+ "4.0"`
	`59624`	`+ ],`
	`59625`	`+ "pull_requests": [`
	`59626`	`+ {`
	`59627`	`+ "pr": "48",`
	`59628`	`+ "title": "Update README.md",`
	`59629`	`+ "userLogin": "hehsiao",`
	`59630`	`+ "contributors": [`
	`59631`	`+ "hehsiao"`
	`59632`	`+ ]`
	`59633`	`+ }`
	`59634`	`+ ]`
`59615`	`59635`	`}`
`59616`	`59636`	`}`
`59617`		`-}`
	`59637`	`+}`
Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,6 @@`
`1`	`1`	`import { Meteor } from 'meteor/meteor';`
`2`	`2`	`import limax from 'limax';`
	`3`	`+import { escapeHTML } from '@rocket.chat/string-helpers';`
`3`	`4`
`4`	`5`	`import { settings } from '../../settings';`
`5`	`6`	`import { Rooms } from '../../models';`
`@@ -9,17 +10,18 @@ export const getValidRoomName = (displayName, rid = '', options = {}) => {`
`9`	`10`	`let slugifiedName = displayName;`
`10`	`11`
`11`	`12`	`if (settings.get('UI_Allow_room_names_with_special_chars')) {`
	`13`	`+ const cleanName = limax(displayName);`
`12`	`14`	`if (options.allowDuplicates !== true) {`
`13`	`15`	`const room = Rooms.findOneByDisplayName(displayName);`
`14`	`16`	`if (room && room._id !== rid) {`
`15`	`17`	`if (room.archived) {`
`16`		- throw new Meteor.Error('error-archived-duplicate-name', `There's an archived channel with name ${ displayName }`, { function: 'RocketChat.getValidRoomName', channel_name: displayName });
	`18`	+ throw new Meteor.Error('error-archived-duplicate-name', `There's an archived channel with name ${ cleanName }`, { function: 'RocketChat.getValidRoomName', channel_name: cleanName });
`17`	`19`	`} else {`
`18`		- throw new Meteor.Error('error-duplicate-channel-name', `A channel with name '${ displayName }' exists`, { function: 'RocketChat.getValidRoomName', channel_name: displayName });
	`20`	+ throw new Meteor.Error('error-duplicate-channel-name', `A channel with name '${ cleanName }' exists`, { function: 'RocketChat.getValidRoomName', channel_name: cleanName });
`19`	`21`	`}`
`20`	`22`	`}`
`21`	`23`	`}`
`22`		`- slugifiedName = limax(displayName);`
	`24`	`+ slugifiedName = cleanName;`
`23`	`25`	`}`
`24`	`26`
`25`	`27`	`let nameValidation;`
`@@ -35,9 +37,9 @@ export const getValidRoomName = (displayName, rid = '', options = {}) => {`
`35`	`37`	`}`
`36`	`38`
`37`	`39`	`if (!nameValidation.test(slugifiedName) \|\| !validateName(slugifiedName)) {`
`38`		- throw new Meteor.Error('error-invalid-room-name', `${ slugifiedName } is not a valid room name.`, {
	`40`	+ throw new Meteor.Error('error-invalid-room-name', `${ escapeHTML(slugifiedName) } is not a valid room name.`, {
`39`	`41`	`function: 'RocketChat.getValidRoomName',`
`40`		`- channel_name: slugifiedName,`
	`42`	`+ channel_name: escapeHTML(slugifiedName),`
`41`	`43`	`});`
`42`	`44`	`}`
`43`	`45`
`@@ -52,9 +54,9 @@ export const getValidRoomName = (displayName, rid = '', options = {}) => {`
`52`	`54`	`}`
`53`	`55`	`slugifiedName = tmpName;`
`54`	`56`	`} else if (room.archived) {`
`55`		- throw new Meteor.Error('error-archived-duplicate-name', `There's an archived channel with name ${ slugifiedName }`, { function: 'RocketChat.getValidRoomName', channel_name: slugifiedName });
	`57`	+ throw new Meteor.Error('error-archived-duplicate-name', `There's an archived channel with name ${ escapeHTML(slugifiedName) }`, { function: 'RocketChat.getValidRoomName', channel_name: escapeHTML(slugifiedName) });
`56`	`58`	`} else {`
`57`		- throw new Meteor.Error('error-duplicate-channel-name', `A channel with name '${ slugifiedName }' exists`, { function: 'RocketChat.getValidRoomName', channel_name: slugifiedName });
	`59`	+ throw new Meteor.Error('error-duplicate-channel-name', `A channel with name '${ escapeHTML(slugifiedName) }' exists`, { function: 'RocketChat.getValidRoomName', channel_name: escapeHTML(slugifiedName) });
`58`	`60`	`}`
`59`	`61`	`}`
`60`	`62`	`}`