Commit Graph

15895 Commits

Author SHA1 Message Date
Mark Felder
18a0c923d0 Resolve information disclosure vulnerability through emoji pack archive download endpoint
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.

The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.

Reported by: graf@poast.org
2023-08-04 08:39:55 +02:00
Haelwenn
819fccb7d1 Merge branch 'tusooa/3154-attachment-type-check' into 'develop'
Restrict attachments to only uploaded files only

Closes #3154

See merge request pleroma/pleroma!3923
2023-08-03 10:01:32 +00:00
tusooa
b08cbe76f1 Merge branch 'fix/2927-disallow-unauthenticated-access' into 'develop'
/api/v1/statuses/:id/context: filter context activities using Visibility.visible_for_user?/2

See merge request pleroma/pleroma!3801
2023-07-28 15:05:46 +00:00
faried nawaz
11ce81d4af add changelog entry 2023-07-28 18:49:05 +05:00
Faried Nawaz
e5e76ec445 cleaner ecto query to handle restrict_unauthenticated for activities
This fix is for this case:

  config :pleroma, :restrict_unauthenticated,
    activities: %{local: true, remote: true}
2023-07-28 18:45:59 +05:00
faried nawaz
dc4de79d43 status context: perform visibility check on activities around a status
issue #2927
2023-07-28 18:45:59 +05:00
tusooa
ea4225a646
Restrict attachments to only uploaded files only 2023-07-18 18:39:59 -04:00
Haelwenn
93ad16cca0 Merge branch '2023-06-deps-update' into 'develop'
2023-06 deps update + de-override plug

See merge request pleroma/pleroma!3911
2023-07-17 20:37:47 +00:00
Haelwenn
e38207162b Merge branch 'tusooa/2775-emoji-policy' into 'develop'
EmojiPolicy

Closes #2775

See merge request pleroma/pleroma!3842
2023-07-07 16:27:30 +00:00
tusooa
1459d64508
Make regex-to-string descriptor reusable 2023-07-07 07:09:35 -04:00
tusooa
ba3aa4f86d
Fix edge cases 2023-07-07 06:58:32 -04:00
tusooa
0d914e17be
Add changelog 2023-07-07 06:58:32 -04:00
tusooa
d670dbdbd3
Test that unicode emoji reactions are not affected 2023-07-07 06:58:32 -04:00
tusooa
ef8a6c539a
Make EmojiPolicy aware of custom emoji reactions 2023-07-07 06:58:31 -04:00
tusooa
20d193c91d
Improve config examples for EmojiPolicy 2023-07-07 06:58:31 -04:00
tusooa
18a8378beb
Update config cheatsheet 2023-07-07 06:58:31 -04:00
tusooa
f50422c380
Move emoji_policy.ex to the right place 2023-07-07 06:58:31 -04:00
tusooa
7eb8abf7bb
EmojiPolicy: Implement delist 2023-07-07 06:58:31 -04:00
tusooa
80ce6482f6
EmojiPolicy: implement remove by shortcode 2023-07-07 06:58:31 -04:00
tusooa
28ff828caa
Add emoji policy to remove emojis matching certain urls
https://git.pleroma.social/pleroma/pleroma/-/issues/2775
2023-07-07 06:58:22 -04:00
tusooa
7da6a82dbd Merge branch 'deprecate-scrobbles' into 'develop'
Deprecate audio scrobbling

See merge request pleroma/pleroma!3919
2023-07-04 02:46:10 +00:00
Haelwenn
624a5ccb2e Merge branch 'hotfix/docs-broken-links' into 'develop'
docs: Fix broken links

See merge request pleroma/pleroma!3920
2023-07-04 02:26:19 +00:00
Haelwenn (lanodan) Monnier
0c3709173f docs: Fix broken links 2023-07-04 04:23:48 +02:00
Haelwenn
53f4d6f238 Merge branch 'fix/pipeline-triggers' into 'develop'
CI: Fix pipeline tokens & exit status

See merge request pleroma/pleroma!3918
2023-07-04 02:04:24 +00:00
Haelwenn (lanodan) Monnier
3d79ceb23a Deprecate audio scrobbling 2023-07-04 03:40:11 +02:00
Haelwenn (lanodan) Monnier
8c3363a5e7 CI: Use CI_JOB_TOKEN for cross-repo pipeline triggers 2023-07-04 03:25:37 +02:00
Haelwenn (lanodan) Monnier
10249d1e42 CI: Let curl return non-0 on http failure code
Otherwise it silently fails
2023-07-04 03:24:13 +02:00
Haelwenn
6fbbf80800 Merge branch 'gentoo_otp' into 'develop'
Packaged installation guide for gentoo

See merge request pleroma/pleroma!3906
2023-07-03 21:04:23 +00:00
Haelwenn
2b9cd25cf4 Merge branch 'tusooa/media-altdomain' into 'develop'
Add instructions to serve media on another domain

See merge request pleroma/pleroma!3892
2023-07-02 21:30:16 +00:00
Haelwenn
0262916978 Merge branch 'testfix/system-config-use' into 'develop'
release_runtime_provider_test: Explicitely use non-existant config file

See merge request pleroma/pleroma!3910
2023-07-02 21:28:15 +00:00
Haelwenn
a31a4c522f Merge branch 'tusooa/3131-handle-report-from-deactivated-user' into 'develop'
Fix handling report from a deactivated user

Closes #3131

See merge request pleroma/pleroma!3915
2023-07-02 21:27:15 +00:00
Haelwenn
379590d438 Merge branch 'tusooa/3142-featured-collection-shouldnt-break-user-fetch' into 'develop'
Fix user fetch completely broken if featured collection is not in a supported form

See merge request pleroma/pleroma!3914
2023-07-02 21:25:45 +00:00
Haelwenn
8cf231c0d1 Merge branch 'tusooa/3151-amd64-runner' into 'develop'
Force the use of amd64 runners for jobs using ci-base

Closes #3151

See merge request pleroma/pleroma!3913
2023-07-02 20:20:49 +00:00
tusooa
6e4de2383f
Fix handling report from a deactivated user 2023-07-02 11:15:34 -04:00
tusooa
a1621839cc
Fix user fetch completely broken if featured collection is not in a supported form 2023-07-02 11:03:09 -04:00
tusooa
63b9f76782
Force the use of amd64 runners for jobs using ci-base 2023-07-01 23:25:04 -04:00
tusooa
48e490cd58 Merge branch 'bugfix/full-revert-media-host-validation' into 'develop'
Merge Revert "Merge branch 'validate-host' into 'develop'"

Closes #3136

See merge request pleroma/pleroma!3909
2023-07-01 21:54:18 +00:00
Haelwenn (lanodan) Monnier
bf2b4b9400 README.md: Update packaging state (GURU, AUR) 2023-06-27 21:13:02 +02:00
Haelwenn
043a00991d Merge branch 'instance-nodeinfo-metadata' into 'develop'
instances: Store some metadata based on NodeInfo

See merge request pleroma/pleroma!3853
2023-06-27 18:58:04 +00:00
Haelwenn
ae0ca49451 Merge branch 'tusooa/3119-bio-update' into 'develop'
Show more informative errors when profile exceeds char limits

Closes #3119

See merge request pleroma/pleroma!3886
2023-06-27 18:49:43 +00:00
Haelwenn
41f2ee69a8 Merge branch 'from/upstream-develop/tusooa/backup-status' into 'develop'
Detail backup states

Closes #3024

See merge request pleroma/pleroma!3809
2023-06-27 12:08:11 +00:00
Haelwenn (lanodan) Monnier
d7e049d5e8 router: Fix usage of globs
warning: doing a prefix match with globs is deprecated, invalid segment "pleroma*path".
    You can either replace by a single segment match:
        /foo/bar-:var
    Or by mixing single segment match with globs:
        /foo/bar-:var/*rest
2023-06-27 10:42:10 +02:00
Haelwenn (lanodan) Monnier
3a67b8f287 endpoint: Use custom Multipart module for dynamic configuration 2023-06-27 10:41:25 +02:00
Haelwenn (lanodan) Monnier
9e69adf76f mix: Remove override on plug 2023-06-27 02:38:31 +02:00
Haelwenn (lanodan) Monnier
aa4c4ab2a0 mix: 2023-06 deps update
this fixes compatibility with Erlang OTP 26

Related: https://git.pleroma.social/pleroma/pleroma/-/issues/2913
2023-06-27 02:38:31 +02:00
Haelwenn (lanodan) Monnier
8bc51288be release_runtime_provider_test: Explicitely use non-existant config file 2023-06-27 00:20:29 +02:00
Haelwenn
4e26fbda08 Merge branch 'weblate-extract' into 'develop'
Extract translatable strings

See merge request pleroma/pleroma!3871
2023-06-22 19:40:18 +00:00
Haelwenn (lanodan) Monnier
dd9f8150fc Merge Revert "Merge branch 'validate-host' into 'develop'"
This reverts commit d998a114e2, reversing
changes made to da6b4003ac.
2023-06-22 21:28:25 +02:00
Haelwenn
4367579949 Merge branch 'fix/bypass-authorized-fetch-mode-json' into 'develop'
Prevent using a .json format to bypass authorized fetch mode

See merge request pleroma/pleroma!3908
2023-06-22 10:35:56 +00:00
weblate-extractor
8bf8906045 Extract translatable strings 2023-06-22 06:09:47 +00:00