Anon/pleroma
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
15,257 Commits 1 Branch 0 Tags 222 MiB
2112e8b5e4
Commit Graph

104 Commits

Author SHA1 Message Date
Mark Felder
e23672d82f Ensure benchee doesn't run unless we are executing benchmarks 2023-11-08 12:44:57 -05:00
Haelwenn (lanodan) Monnier
76c070fe86 ObjectValidators.BareUriTest: Replace calls of SafeText to BareUri 2023-11-08 02:17:50 +01:00
Mark Felder
bf426c53b4 Fix digest email processing, consolidate Oban queues 
The email related jobs can all share a single Oban queue
 2023-11-07 15:14:36 -05:00
tusooa
aaf53d9d77
Bump package version for mergeback 2023-10-31 20:49:31 -04:00
tusooa
ad45b06b3f Merge branch 'stable' into 'release/2.6.0' 
# Conflicts:
#   .gitlab-ci.yml
#   lib/pleroma/web/common_api/utils.ex
#   lib/pleroma/web/xml.ex
#   mix.exs
#   test/pleroma/web/activity_pub/transmogrifier/emoji_react_handling_test.exs
#   test/pleroma/web/common_api/utils_test.exs
#   test/pleroma/web/mastodon_api/update_credentials_test.exs
#   test/pleroma/web/xml_test.exs
 2023-10-31 01:07:43 +00:00
tusooa
a2a69709b5
Bump version to 2.6.0 2023-10-24 19:57:31 -04:00
tusooa
b748efe66a
Fix mentioning punycode domains when using Markdown 2023-10-16 21:35:25 -04:00
tusooa
3e7d2e29b3
Add changelog 2023-10-15 17:20:26 -04:00
tusooa
d244c9d298
Add changelog 2023-09-13 19:19:05 -04:00
Mint
535a5ecad0 CommonAPI: Prevent users from accessing media of other users 
commit 1afde067b1 upstream.
 2023-09-03 11:19:13 +02:00
Mint
1afde067b1 CommonAPI: Prevent users from accessing media of other users 2023-09-03 10:41:37 +02:00
tusooa
3c5ecca377
Skip changelog 2023-08-30 20:37:45 -04:00
Haelwenn
1e685c8302 Merge branch 'csp-flash' into 'develop' 
allow https: so that flash works across instances without need for media proxy

See merge request pleroma/pleroma!3879
 2023-08-16 13:37:49 +00:00
tusooa
b729a8b140 Merge branch 'fix-dockerfile-perms' into 'develop' 
Fix config ownership in dockerfile to pass restriction test

See merge request pleroma/pleroma!3931
 2023-08-10 00:42:29 +00:00
Cat pony Black
c298e0165c Fix config ownership in dockerfile to pass restriction test 2023-08-08 19:07:48 +02:00
mae
48b1e9bdc7 Completely disable xml entity resolution 2023-08-05 14:17:04 +02:00
Haelwenn
17c336de66 Merge branch 'docs/gentoo-otp-intro' into 'develop' 
gentoo_otp_en.md: Indicate which install method it covers

See merge request pleroma/pleroma!3928
 2023-08-05 11:04:32 +00:00
Haelwenn (lanodan) Monnier
4099ddb3dc Mergeback release 2.5.4 2023-08-05 08:58:05 +02:00
Haelwenn (lanodan) Monnier
b631180b38 Release 2.5.4 2023-08-05 08:27:42 +02:00
Mark Felder
cc848b78dc Document and test that XXE processing is disabled 
https://vuln.be/post/xxe-in-erlang-and-elixir/
 2023-08-05 08:23:04 +02:00
Mark Felder
6d48b0f1a9 Document and test that XXE processing is disabled 
https://vuln.be/post/xxe-in-erlang-and-elixir/
 2023-08-05 08:14:27 +02:00
Haelwenn (lanodan) Monnier
0e321698d2 gentoo_otp_en.md: Indicate which install method it covers 2023-08-04 17:11:20 +02:00
Haelwenn (lanodan) Monnier
9f0ad901ed changelog: Entry for config permissions restrictions 
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3135
 2023-08-04 09:50:28 +02:00
Haelwenn (lanodan) Monnier
22df32b3f5 changelog: Entry for config permissions restrictions 
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3135
 2023-08-04 09:49:53 +02:00
Mark Felder
2c79509453 Resolve information disclosure vulnerability through emoji pack archive download endpoint 
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.

The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.

Reported by: graf@poast.org
 2023-08-04 08:40:27 +02:00
Mark Felder
18a0c923d0 Resolve information disclosure vulnerability through emoji pack archive download endpoint 
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.

The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.

Reported by: graf@poast.org
 2023-08-04 08:39:55 +02:00
Haelwenn
819fccb7d1 Merge branch 'tusooa/3154-attachment-type-check' into 'develop' 
Restrict attachments to only uploaded files only

Closes #3154

See merge request pleroma/pleroma!3923
 2023-08-03 10:01:32 +00:00
faried nawaz
11ce81d4af add changelog entry 2023-07-28 18:49:05 +05:00
tusooa
ea4225a646
Restrict attachments to only uploaded files only 2023-07-18 18:39:59 -04:00
Haelwenn
93ad16cca0 Merge branch '2023-06-deps-update' into 'develop' 
2023-06 deps update + de-override plug

See merge request pleroma/pleroma!3911
 2023-07-17 20:37:47 +00:00
tusooa
0d914e17be
Add changelog 2023-07-07 06:58:32 -04:00
tusooa
7da6a82dbd Merge branch 'deprecate-scrobbles' into 'develop' 
Deprecate audio scrobbling

See merge request pleroma/pleroma!3919
 2023-07-04 02:46:10 +00:00
Haelwenn (lanodan) Monnier
0c3709173f docs: Fix broken links 2023-07-04 04:23:48 +02:00
Haelwenn
53f4d6f238 Merge branch 'fix/pipeline-triggers' into 'develop' 
CI: Fix pipeline tokens & exit status

See merge request pleroma/pleroma!3918
 2023-07-04 02:04:24 +00:00
Haelwenn (lanodan) Monnier
3d79ceb23a Deprecate audio scrobbling 2023-07-04 03:40:11 +02:00
Haelwenn (lanodan) Monnier
8c3363a5e7 CI: Use CI_JOB_TOKEN for cross-repo pipeline triggers 2023-07-04 03:25:37 +02:00
Haelwenn
6fbbf80800 Merge branch 'gentoo_otp' into 'develop' 
Packaged installation guide for gentoo

See merge request pleroma/pleroma!3906
 2023-07-03 21:04:23 +00:00
Haelwenn
2b9cd25cf4 Merge branch 'tusooa/media-altdomain' into 'develop' 
Add instructions to serve media on another domain

See merge request pleroma/pleroma!3892
 2023-07-02 21:30:16 +00:00
Haelwenn
0262916978 Merge branch 'testfix/system-config-use' into 'develop' 
release_runtime_provider_test: Explicitely use non-existant config file

See merge request pleroma/pleroma!3910
 2023-07-02 21:28:15 +00:00
Haelwenn
a31a4c522f Merge branch 'tusooa/3131-handle-report-from-deactivated-user' into 'develop' 
Fix handling report from a deactivated user

Closes #3131

See merge request pleroma/pleroma!3915
 2023-07-02 21:27:15 +00:00
Haelwenn
379590d438 Merge branch 'tusooa/3142-featured-collection-shouldnt-break-user-fetch' into 'develop' 
Fix user fetch completely broken if featured collection is not in a supported form

See merge request pleroma/pleroma!3914
 2023-07-02 21:25:45 +00:00
tusooa
6e4de2383f
Fix handling report from a deactivated user 2023-07-02 11:15:34 -04:00
tusooa
a1621839cc
Fix user fetch completely broken if featured collection is not in a supported form 2023-07-02 11:03:09 -04:00
tusooa
63b9f76782
Force the use of amd64 runners for jobs using ci-base 2023-07-01 23:25:04 -04:00
tusooa
48e490cd58 Merge branch 'bugfix/full-revert-media-host-validation' into 'develop' 
Merge Revert "Merge branch 'validate-host' into 'develop'"

Closes #3136

See merge request pleroma/pleroma!3909
 2023-07-01 21:54:18 +00:00
Haelwenn
ae0ca49451 Merge branch 'tusooa/3119-bio-update' into 'develop' 
Show more informative errors when profile exceeds char limits

Closes #3119

See merge request pleroma/pleroma!3886
 2023-06-27 18:49:43 +00:00
Haelwenn (lanodan) Monnier
aa4c4ab2a0 mix: 2023-06 deps update 
this fixes compatibility with Erlang OTP 26

Related: https://git.pleroma.social/pleroma/pleroma/-/issues/2913
 2023-06-27 02:38:31 +02:00
Haelwenn (lanodan) Monnier
8bc51288be release_runtime_provider_test: Explicitely use non-existant config file 2023-06-27 00:20:29 +02:00
Haelwenn (lanodan) Monnier
dd9f8150fc Merge Revert "Merge branch 'validate-host' into 'develop'" 
This reverts commit d998a114e2, reversing
changes made to da6b4003ac.
 2023-06-22 21:28:25 +02:00
Sean King
994bfc4c09
Add changelog entry 2023-06-21 23:13:16 -06:00