Anon/pleroma
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
16,240 Commits 1 Branch 0 Tags 222 MiB
79c418bcb7
Commit Graph

379 Commits

Author SHA1 Message Date
Haelwenn
4c20713ecd Merge branch 'otp26' into 'develop' 
OTP26 support

See merge request pleroma/pleroma!4025
 2024-01-17 09:51:56 +00:00
Haelwenn
9b39bc6aa8 Merge branch 'mrf-regex-error' into 'develop' 
MRF: Log sensible regex error for subdomain_match

See merge request pleroma/pleroma!4026
 2024-01-15 08:24:54 +00:00
Haelwenn
c29430b018 Merge branch 'mrf-steal-emoji-extname' into 'develop' 
MRF.StealEmojiPolicy: Properly add fallback extension to filenames missing one

See merge request pleroma/pleroma!4029
 2024-01-15 08:24:24 +00:00
Mark Felder
12c052551b Allow the Remote Fetcher to attempt fetching an unreachable instance 2024-01-14 14:05:43 -05:00
tusooa
d3a4f5b7d7 Merge branch 'nil-contentMap' into 'develop' 
Support objects with a nil contentMap (firefish)

Closes #3231

See merge request pleroma/pleroma!4030
 2024-01-13 22:23:21 +00:00
feld
9cc46c5538 Merge branch 'qtfaststart-fix' into 'develop' 
Fix MediaProxy crashing on some videos

See merge request pleroma/pleroma!4024
 2024-01-13 04:35:32 +00:00
Mint
3c30eadd5e Fix duplicate inbox deliveries 2024-01-11 20:48:35 +03:00
Haelwenn (lanodan) Monnier
7651198508 Support objects with a nil contentMap (firefish) 
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3231
 2024-01-11 07:16:45 +01:00
Haelwenn (lanodan) Monnier
4ca65c6182 MRF.StealEmojiPolicy: Properly add fallback extension to filenames missing one 2024-01-07 19:37:35 +01:00
Ekaterina Vaartis
29158681f9 Fetch count before downloading the pack and use that as page size 2024-01-07 17:07:50 +03:00
Ekaterina Vaartis
69e4ebbb8e Make remote emoji packs API use specifically the V1 URL 
Akkoma does not understand it without V1, and it works either way with
normal pleroma, so no reason to not do this
 2024-01-07 15:30:52 +03:00
Alexander Tumin
32d8e0d496 Fix authentication check on account rendering when bio is defined 2024-01-04 16:57:48 +03:00
Haelwenn (lanodan) Monnier
6af49270a9 MRF: Log sensible error for subdomains_regex 2024-01-02 15:37:41 +01:00
Mark Felder
63a74f7b6d Support for Erlang OTP 26 2023-12-29 23:22:31 -05:00
Haelwenn
f74f5e0a56 Merge branch 'publisher' into 'develop' 
Discard some failed publisher jobs

See merge request pleroma/pleroma!4022
 2023-12-29 23:18:34 +00:00
Mark Felder
50edef5bc1 Change QTFastStart to recover gracefully if it encounters an error during bitstring matching 
This fixes issues with internal errors when trying to serve the video
 2023-12-29 14:12:44 -05:00
feld
8ac4458630 Merge branch 'finch-redirects' into 'develop' 
Fix following redirects with Finch

See merge request pleroma/pleroma!4023
 2023-12-29 17:00:58 +00:00
lain
a6fc97ffec Merge branch 'bugfix/chat-attachment-empty-array' into 'develop' 
ChatMessage: Tolerate attachment field set to an empty array

Closes #3224

See merge request pleroma/pleroma!4020
 2023-12-29 08:12:27 +00:00
Mark Felder
2950397d47 Fix following redirects with Finch 2023-12-29 00:50:50 -05:00
Mark Felder
7ebca7ecfa Activity publishing failures will prevent the job from retrying if the publishing request returns a 403 or 410 2023-12-29 00:25:33 -05:00
Mark Felder
77949d4590 Make the Publisher log error less noisy 2023-12-29 00:25:11 -05:00
Haelwenn (lanodan) Monnier
39dc6c65ef ChatMessage: Tolerate attachment field set to an empty array 
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3224
 2023-12-29 05:32:47 +01:00
Mark Felder
d519a535e1 Changelog 2023-12-28 23:32:21 -05:00
Mark Felder
aa070c7daf Handle 401s as I have observed it in the wild 2023-12-28 23:09:33 -05:00
Mark Felder
013f7c4f8f Changelog 2023-12-28 14:55:26 -05:00
Haelwenn
ddc321a094 Merge branch 'tusooa/3205-group-actor' into 'develop' 
Implement group actors

See merge request pleroma/pleroma!3969
 2023-12-28 10:46:53 +00:00
Mark Felder
ad0a5deb67 Prevent requeuing Remote Fetcher jobs that exceed thread depth 2023-12-27 22:28:41 -05:00
marcin mikołajczak
017e35fbf1 Fix some more typos 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-12-28 00:17:04 +01:00
Mark Felder
53db65678d Separate files for each distinct sentence in the changelog 2023-12-27 15:44:31 -05:00
marcin mikołajczak
f6fee39e42 Add changelog 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-12-27 21:24:20 +01:00
Mark Felder
1a337dcc18 These functions in Pleroma.Instances should be defdelegates to Pleroma.Instances.Instance 2023-12-27 12:44:16 -05:00
tusooa
e9d2fadd8e
Add changelog for group actors 2023-12-27 12:28:11 -05:00
Mark Felder
5f51094138 Update changelog 2023-12-27 11:09:42 -05:00
Mark Felder
73c4c6d7de Revert "Mark instances as unreachable when returning a 403 from an object fetch" 
This reverts commit d472bafec1.
 2023-12-26 17:20:36 -05:00
Mark Felder
9c0040124a Skip remote fetch jobs for unreachable instances 2023-12-26 16:28:05 -05:00
Mark Felder
c4f0a3b570 Changelogs 2023-12-26 16:08:36 -05:00
marcin mikołajczak
9fc6676d8c Merge remote-tracking branch 'origin/develop' into instance-contact-account 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-12-22 13:54:44 +01:00
marcin mikołajczak
28e5e65676 Merge remote-tracking branch 'origin/develop' into webfinger-fix 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-12-22 13:29:56 +01:00
lain
5f1d707367 Merge branch 'bad_inbox_request' into 'develop' 
Return a 400 from a bad delivery attempt to the inbox

Closes #2884

See merge request pleroma/pleroma!4009
 2023-12-22 11:04:25 +00:00
Haelwenn
bd50892c25 Merge branch 'instance-v2' into 'develop' 
Implement api/v2/instance route

See merge request pleroma/pleroma!3939
 2023-12-21 21:14:46 +00:00
Mark Felder
7e3bbdded5 Elixir 1.13 is the minimum required version 2023-12-20 23:39:12 +00:00
Mark Felder
928bda2e43 Fix invalid string comparison for OTP versions and replace with config 
Old way was wrong for multiple reasons. If we do this as a config value it fixes :slave.start/3 being picked up as a compile warning on OTP26.

Also if we want to do any real clustering we'll need something like this to support OTP25 and older.
 2023-12-20 23:13:33 +00:00
Mark Felder
d9fe41a301 More deprecation fixes 2023-12-20 16:47:58 -05:00
Mark Felder
3c80c86437 Chase deprecations/warnings for Elixir 1.15 2023-12-20 20:17:25 +00:00
Mark Felder
bf57fd82bb Clarify location of test.secret.exs file 2023-12-20 14:12:06 -05:00
Mark Felder
f43f33e307 Return a 400 from a bad delivery attempt to the inbox 
This stops the backend from generating 500 errors from these events.
 2023-12-19 13:56:17 -05:00
Mark Felder
e2066994b1 Fix Web Push notification delivery 
Finch does not automatically append header content-type: octet-stream for binary payloads.
 2023-12-19 10:56:55 -05:00
Haelwenn (lanodan) Monnier
086ba59d03 HTTPSignaturePlug: Add :authorized_fetch_mode_exceptions 2023-12-16 19:25:51 +01:00
Lain Soykaf
77bb1bb6c8 Actually write changelog 2023-12-16 21:41:28 +04:00
Lain Soykaf
a0f70cf7d0 Add changelog 2023-12-16 20:40:51 +04:00
tusooa
f5559f3aff
Skip changelog for 2.6.1 mergeback 2023-12-15 19:45:23 -05:00
tusooa
453cb6a388
Merge remote-tracking branch 'upstream/stable' into mergeback/2.6.1 2023-12-15 19:43:07 -05:00
Yonle
cb1b52d980 ap userview: add outbox field. 
Signed-off-by: Yonle <yonle@lecturify.net>
 2023-12-15 09:55:06 +04:00
tusooa
ad6a6aa07b
Bump version to 2.6.1 2023-12-14 20:14:41 -05:00
Haelwenn (lanodan) Monnier
b1ea63b4c6
changelog.d/system-cflags.fix: New entry 2023-12-14 20:13:25 -05:00
Haelwenn (lanodan) Monnier
35090f6eac
TwitterAPI: Return proper error when healthcheck is disabled 2023-12-14 20:11:01 -05:00
Haelwenn (lanodan) Monnier
1b22f13488
docs: Put a max version on erlang and elixir 
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3194
 2023-12-14 07:29:54 -05:00
Henry Jameson
e635ee8b39
changelog 2023-12-14 07:28:52 -05:00
Lain Soykaf
40fa1099bf StatusViewTest: Fix tests. 2023-12-13 11:19:08 +04:00
lain
29d202e1df Merge branch 'add-opengraph-rich-media-proxy' into 'develop' 
Add media proxy to opengraph rich media cards

See merge request pleroma/pleroma!3997
 2023-12-13 06:23:16 +00:00
Alexander Tumin
e7af2addd8 Add media proxy to opengraph rich media cards 2023-12-12 18:32:02 +03:00
Lain Soykaf
8da1fd329d Merge branch 'develop' of git.pleroma.social:pleroma/pleroma into no-async-clear-config 2023-12-12 12:29:22 +04:00
Lain Soykaf
7371e72e6c Dockerfile: Use platform libvips. 2023-12-12 11:36:34 +04:00
Lain Soykaf
18ab36d70c Merge branch 'develop' of git.pleroma.social:pleroma/pleroma into no-async-clear-config 2023-12-12 10:55:19 +04:00
lain
41c02b3d16 Merge branch 'authorize-interaction' into 'develop' 
Support /authorize-interaction route used by Mastodon

See merge request pleroma/pleroma!3957
 2023-12-11 09:31:18 +00:00
Lain Soykaf
7cf65cfeea Changelog 2023-12-11 12:48:53 +04:00
lain
e7974afd37 Merge branch 'optimistic-inbox' into 'develop' 
Optimistic Inbox

See merge request pleroma/pleroma!3989
 2023-12-11 07:32:42 +00:00
Lain Soykaf
221f18dc33 Tests: Don't run tests that use clear_config asynchronously. 2023-12-10 16:27:23 +04:00
lain
a7f82ff82e Merge branch 'scrubbers-html4-GtS' into 'develop' 
scrubbers/default: Add more formatting elements from HTML4 / GoToSocial

See merge request pleroma/pleroma!3979
 2023-12-10 12:18:22 +00:00
feld
a67fc30d81 Merge branch 'kphrx-develop-patch-87655' into 'develop' 
Remove checking ImageMagick's commands for AnalyzeMetadata filter

See merge request pleroma/pleroma!3987
 2023-12-09 14:08:13 +00:00
Mark Felder
1b5964979f Optimistic Inbox 2023-12-08 18:13:43 -05:00
Mark Felder
003d3312fd Permit the index creation to run concurrently 2023-12-08 15:48:00 -05:00
kPherox
0818a9136d
add changelog 2023-12-07 20:33:23 +09:00
Lain Soykaf
6a191a91ab Merge branch 'develop' of git.pleroma.social:pleroma/pleroma into last_status_at 2023-12-07 11:18:39 +04:00
lain
2656199dc7 Merge branch 'more-test-fixes' into 'develop' 
More test fixes

See merge request pleroma/pleroma!3984
 2023-12-07 05:26:06 +00:00
Mark Felder
1ad0d94d6f Change set_reachable/1 to an upsert 2023-12-06 15:50:00 -05:00
Lain Soykaf
30084b7332 Add changelog. 2023-11-30 09:55:04 +04:00
HJ
6a6a631c81 Merge branch 'neetzsche/add_url_to_scrobbles' into 'develop' 
Add optional URL value for scrobbles

See merge request pleroma/pleroma!3977
 2023-11-29 15:59:19 +00:00
lain
bc7fcc2dba Merge branch 'vips' into 'develop' 
Docs: Remove rust references

See merge request pleroma/pleroma!3983
 2023-11-29 15:43:09 +00:00
Lain Soykaf
cd6adef471 Add changelog 2023-11-29 19:42:40 +04:00
lain
1955b3c557 Merge branch 'vips' into 'develop' 
Replace ImageMagick with Vips

See merge request pleroma/pleroma!3771
 2023-11-29 06:03:37 +00:00
lain
35774d44b2 Merge branch 'generate-unset-user-keys-migration' into 'develop' 
Fix GenerateUnsetUserKeys migration

See merge request pleroma/pleroma!3976
 2023-11-28 12:34:32 +00:00
Lain Soykaf
10525ac7f8 Docs: Remove rust references 2023-11-28 15:21:34 +04:00
Lain Soykaf
da26964d2b Changelog: Adjust blurhash change 2023-11-28 12:39:22 +04:00
lain
ef7bda61ad Merge branch 'promex' into 'develop' 
Switch to PromEx for prometheus metrics

See merge request pleroma/pleroma!3967
 2023-11-28 07:50:16 +00:00
lain
2b839197a9 Merge branch 'strip-fix' into 'develop' 
Strip fix

See merge request pleroma/pleroma!3981
 2023-11-27 15:30:13 +00:00
HJ
9c57f17af3 Merge branch 'frontends-docs' into 'develop' 
Front-ends management docs

See merge request pleroma/pleroma!3974
 2023-11-27 14:00:12 +00:00
NEETzsche
27df2c0ce6 Fix #strip_report_status_data 2023-11-27 17:56:43 +04:00
NEETzsche
510a7b64f1 Add optional URL value for scrobbles 2023-11-23 04:51:51 -07:00
HJ
4ebfc011fc Merge branch 'favicon' into 'develop' 
Make favicon configurable, embed favicon and manifest in server-generated meta

See merge request pleroma/pleroma!3963
 2023-11-19 08:52:37 +00:00
Henry Jameson
6513f54f73 changelog 2023-11-19 10:32:39 +02:00
feld
906b121a10 Merge branch 'develop' into 'vips' 
# Conflicts:
#   mix.exs
 2023-11-17 16:50:36 +00:00
Mark Felder
7988c62f6d Update changelogs 2023-11-17 11:21:46 -05:00
Haelwenn (lanodan) Monnier
06c58bce00 scrubbers/default: Add more formatting elements from HTML4 / GoToSocial 
Added: acronym, bdo, big, cite, dfn, ins, kbd, q, samp, s, tt, var, wbr
 2023-11-16 18:27:32 +01:00
Haelwenn (lanodan) Monnier
8ac7cc98c1 MastoAPI AccountView: Change last_status_at to be a date 
Changed in Mastodon 3.1.0 with: https://github.com/tootsuite/mastodon/pull/12966
 2023-11-16 15:52:01 +01:00
Haelwenn
ca1b18ba2d Merge branch 'federation_status-access' into 'develop' 
router: Make /federation_status publicly available

See merge request pleroma/pleroma!3937
 2023-11-15 08:20:37 +00:00
Haelwenn
50c896169c Merge branch 'cflags' into 'develop' 
Make eblurhash and elixir-captcha use system CFLAGS

See merge request pleroma/pleroma!3943
 2023-11-15 08:19:29 +00:00
Henry Jameson
a5aa8ea796 Add support for configuring a favicon and embed PWA manifest in server-generated-meta 2023-11-14 11:05:23 +01:00
Haelwenn (lanodan) Monnier
66f5ae0c5a router: Make /federation_status publicly available 2023-11-14 10:48:30 +01:00
Haelwenn (lanodan) Monnier
3831d31009 docs: Put a max version on erlang and elixir 
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3194
 2023-11-14 10:47:33 +01:00
Haelwenn (lanodan) Monnier
4472ab1fe9 changelog.d/system-cflags.fix: New entry 2023-11-14 10:45:00 +01:00
Haelwenn
bf2d6abaf2 Merge branch 'healthcheck-disabled-error' into 'develop' 
TwitterAPI: Return proper error when healthcheck is disabled

See merge request pleroma/pleroma!3953
 2023-11-14 09:41:26 +00:00
Mark Felder
ce42dac331 Change mediaproxy previews to use vips to generate thumbnails instead of ImageMagick 2023-11-13 15:41:39 -05:00
Mark Felder
1db10744f7 Use the "change" type 2023-11-13 15:35:00 -05:00
Mark Felder
66cb3294ed Switch to PromEx for prometheus metrics 
Recommending use of the separate HTTP server for exposing the metrics
and securing it externally on your firewall or reverse proxy. It will
listen on port 4021 by default.
 2023-11-13 15:34:59 -05:00
marcin mikołajczak
fe776d8b33 Fix GenerateUnsetUserKeys migration 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-11-13 14:18:22 +01:00
lain
752bc168f6 Merge branch 'quotes-count' into 'develop' 
Count and display post quotes

See merge request pleroma/pleroma!3956
 2023-11-12 13:38:09 +00:00
marcin mikołajczak
9a063deacc Count and display post quotes 2023-11-12 13:38:08 +00:00
lain
5f19fbc5a9 Merge branch 'phoenix1.7' into 'develop' 
Update to Phoenix 1.7

See merge request pleroma/pleroma!3900
 2023-11-12 13:34:27 +00:00
Lain Soykaf
5208bd8a95 Add changelog. 2023-11-12 15:00:51 +04:00
Marcin Mikołajczak
1e9333a9aa Merge remote-tracking branch 'origin/develop' into instance-v2 2023-11-08 20:46:57 +01:00
Mark Felder
e23672d82f Ensure benchee doesn't run unless we are executing benchmarks 2023-11-08 12:44:57 -05:00
Mark Felder
0ab853cab8 Merge branch 'develop' into phoenix1.7 2023-11-08 09:18:08 -05:00
Haelwenn (lanodan) Monnier
76c070fe86 ObjectValidators.BareUriTest: Replace calls of SafeText to BareUri 2023-11-08 02:17:50 +01:00
Mark Felder
a0e08c6ec2 Merge branch 'develop' into phoenix1.7 2023-11-07 16:05:04 -05:00
Mark Felder
bf426c53b4 Fix digest email processing, consolidate Oban queues 
The email related jobs can all share a single Oban queue
 2023-11-07 15:14:36 -05:00
marcin mikołajczak
c62696c8e7 Support /authorize-interaction route used by Mastodon 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-11-02 13:47:23 +01:00
marcin mikołajczak
6b9a347353 update changelog 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-11-02 13:31:59 +01:00
marcin mikołajczak
50e7706b26 Verify link ownership with rel="me" 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-11-02 13:30:46 +01:00
tusooa
aaf53d9d77
Bump package version for mergeback 2023-10-31 20:49:31 -04:00
tusooa
ad45b06b3f Merge branch 'stable' into 'release/2.6.0' 
# Conflicts:
#   .gitlab-ci.yml
#   lib/pleroma/web/common_api/utils.ex
#   lib/pleroma/web/xml.ex
#   mix.exs
#   test/pleroma/web/activity_pub/transmogrifier/emoji_react_handling_test.exs
#   test/pleroma/web/common_api/utils_test.exs
#   test/pleroma/web/mastodon_api/update_credentials_test.exs
#   test/pleroma/web/xml_test.exs
 2023-10-31 01:07:43 +00:00
marcin mikołajczak
e5bd1ee801 Add entry to @context, tests 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-10-29 00:02:17 +02:00
marcin mikołajczak
b6a9d87f16 Display reposted replies with exclude_replies: true 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-10-28 00:10:13 +02:00
marcin mikołajczak
6b8c5e12df Add contact account to InstanceView 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-10-26 23:32:08 +02:00
tusooa
a2a69709b5
Bump version to 2.6.0 2023-10-24 19:57:31 -04:00
tusooa
b748efe66a
Fix mentioning punycode domains when using Markdown 2023-10-16 21:35:25 -04:00
tusooa
3e7d2e29b3
Add changelog 2023-10-15 17:20:26 -04:00
Haelwenn (lanodan) Monnier
2f6fc6a7ab TwitterAPI: Return proper error when healthcheck is disabled 2023-09-24 23:32:17 +02:00
tusooa
d244c9d298
Add changelog 2023-09-13 19:19:05 -04:00
Mint
535a5ecad0 CommonAPI: Prevent users from accessing media of other users 
commit 1afde067b1 upstream.
 2023-09-03 11:19:13 +02:00
Mint
1afde067b1 CommonAPI: Prevent users from accessing media of other users 2023-09-03 10:41:37 +02:00
tusooa
3c5ecca377
Skip changelog 2023-08-30 20:37:45 -04:00
Haelwenn
1e685c8302 Merge branch 'csp-flash' into 'develop' 
allow https: so that flash works across instances without need for media proxy

See merge request pleroma/pleroma!3879
 2023-08-16 13:37:49 +00:00
marcin mikołajczak
9effa24f30 Implement api/v2/instance route 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-11 00:08:05 +02:00
tusooa
b729a8b140 Merge branch 'fix-dockerfile-perms' into 'develop' 
Fix config ownership in dockerfile to pass restriction test

See merge request pleroma/pleroma!3931
 2023-08-10 00:42:29 +00:00
Cat pony Black
c298e0165c Fix config ownership in dockerfile to pass restriction test 2023-08-08 19:07:48 +02:00
mae
48b1e9bdc7 Completely disable xml entity resolution 2023-08-05 14:17:04 +02:00
Haelwenn
17c336de66 Merge branch 'docs/gentoo-otp-intro' into 'develop' 
gentoo_otp_en.md: Indicate which install method it covers

See merge request pleroma/pleroma!3928
 2023-08-05 11:04:32 +00:00
Haelwenn (lanodan) Monnier
4099ddb3dc Mergeback release 2.5.4 2023-08-05 08:58:05 +02:00
Haelwenn (lanodan) Monnier
b631180b38 Release 2.5.4 2023-08-05 08:27:42 +02:00
Mark Felder
cc848b78dc Document and test that XXE processing is disabled 
https://vuln.be/post/xxe-in-erlang-and-elixir/
 2023-08-05 08:23:04 +02:00
Mark Felder
6d48b0f1a9 Document and test that XXE processing is disabled 
https://vuln.be/post/xxe-in-erlang-and-elixir/
 2023-08-05 08:14:27 +02:00
Haelwenn (lanodan) Monnier
0e321698d2 gentoo_otp_en.md: Indicate which install method it covers 2023-08-04 17:11:20 +02:00
Haelwenn (lanodan) Monnier
9f0ad901ed changelog: Entry for config permissions restrictions 
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3135
 2023-08-04 09:50:28 +02:00
Haelwenn (lanodan) Monnier
22df32b3f5 changelog: Entry for config permissions restrictions 
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3135
 2023-08-04 09:49:53 +02:00
Mark Felder
2c79509453 Resolve information disclosure vulnerability through emoji pack archive download endpoint 
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.

The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.

Reported by: graf@poast.org
 2023-08-04 08:40:27 +02:00
Mark Felder
18a0c923d0 Resolve information disclosure vulnerability through emoji pack archive download endpoint 
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.

The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.

Reported by: graf@poast.org
 2023-08-04 08:39:55 +02:00
Haelwenn
819fccb7d1 Merge branch 'tusooa/3154-attachment-type-check' into 'develop' 
Restrict attachments to only uploaded files only

Closes #3154

See merge request pleroma/pleroma!3923
 2023-08-03 10:01:32 +00:00
faried nawaz
11ce81d4af add changelog entry 2023-07-28 18:49:05 +05:00
tusooa
ea4225a646
Restrict attachments to only uploaded files only 2023-07-18 18:39:59 -04:00
tusooa
1ab4ab8d38
Extract translatable strings 2023-07-18 18:24:30 -04:00
Haelwenn
93ad16cca0 Merge branch '2023-06-deps-update' into 'develop' 
2023-06 deps update + de-override plug

See merge request pleroma/pleroma!3911
 2023-07-17 20:37:47 +00:00
tusooa
0d914e17be
Add changelog 2023-07-07 06:58:32 -04:00
tusooa
7da6a82dbd Merge branch 'deprecate-scrobbles' into 'develop' 
Deprecate audio scrobbling

See merge request pleroma/pleroma!3919
 2023-07-04 02:46:10 +00:00
Haelwenn (lanodan) Monnier
0c3709173f docs: Fix broken links 2023-07-04 04:23:48 +02:00
Haelwenn
53f4d6f238 Merge branch 'fix/pipeline-triggers' into 'develop' 
CI: Fix pipeline tokens & exit status

See merge request pleroma/pleroma!3918
 2023-07-04 02:04:24 +00:00
Haelwenn (lanodan) Monnier
3d79ceb23a Deprecate audio scrobbling 2023-07-04 03:40:11 +02:00
Haelwenn (lanodan) Monnier
8c3363a5e7 CI: Use CI_JOB_TOKEN for cross-repo pipeline triggers 2023-07-04 03:25:37 +02:00
Haelwenn
6fbbf80800 Merge branch 'gentoo_otp' into 'develop' 
Packaged installation guide for gentoo

See merge request pleroma/pleroma!3906
 2023-07-03 21:04:23 +00:00
Haelwenn
2b9cd25cf4 Merge branch 'tusooa/media-altdomain' into 'develop' 
Add instructions to serve media on another domain

See merge request pleroma/pleroma!3892
 2023-07-02 21:30:16 +00:00
Haelwenn
0262916978 Merge branch 'testfix/system-config-use' into 'develop' 
release_runtime_provider_test: Explicitely use non-existant config file

See merge request pleroma/pleroma!3910
 2023-07-02 21:28:15 +00:00
Haelwenn
a31a4c522f Merge branch 'tusooa/3131-handle-report-from-deactivated-user' into 'develop' 
Fix handling report from a deactivated user

Closes #3131

See merge request pleroma/pleroma!3915
 2023-07-02 21:27:15 +00:00
Haelwenn
379590d438 Merge branch 'tusooa/3142-featured-collection-shouldnt-break-user-fetch' into 'develop' 
Fix user fetch completely broken if featured collection is not in a supported form

See merge request pleroma/pleroma!3914
 2023-07-02 21:25:45 +00:00
tusooa
6e4de2383f
Fix handling report from a deactivated user 2023-07-02 11:15:34 -04:00
tusooa
a1621839cc
Fix user fetch completely broken if featured collection is not in a supported form 2023-07-02 11:03:09 -04:00
tusooa
63b9f76782
Force the use of amd64 runners for jobs using ci-base 2023-07-01 23:25:04 -04:00
tusooa
48e490cd58 Merge branch 'bugfix/full-revert-media-host-validation' into 'develop' 
Merge Revert "Merge branch 'validate-host' into 'develop'"

Closes #3136

See merge request pleroma/pleroma!3909
 2023-07-01 21:54:18 +00:00
Haelwenn
ae0ca49451 Merge branch 'tusooa/3119-bio-update' into 'develop' 
Show more informative errors when profile exceeds char limits

Closes #3119

See merge request pleroma/pleroma!3886
 2023-06-27 18:49:43 +00:00
Haelwenn (lanodan) Monnier
aa4c4ab2a0 mix: 2023-06 deps update 
this fixes compatibility with Erlang OTP 26

Related: https://git.pleroma.social/pleroma/pleroma/-/issues/2913
 2023-06-27 02:38:31 +02:00
Haelwenn (lanodan) Monnier
8bc51288be release_runtime_provider_test: Explicitely use non-existant config file 2023-06-27 00:20:29 +02:00
Haelwenn (lanodan) Monnier
dd9f8150fc Merge Revert "Merge branch 'validate-host' into 'develop'" 
This reverts commit d998a114e2, reversing
changes made to da6b4003ac.
 2023-06-22 21:28:25 +02:00
Sean King
994bfc4c09
Add changelog entry 2023-06-21 23:13:16 -06:00
Haelwenn (lanodan) Monnier
937fa36ec4 changelog.d/gentoo_otp.skip: Doc-only MR 2023-06-13 16:05:37 +02:00
Haelwenn (lanodan) Monnier
a663b73634 Add no_new_privs to OpenRC service files 2023-06-13 12:47:02 +02:00
lain
fdb5bec431 Merge branch 'unused_indexes' into 'develop' 
Remove unused indexes

See merge request pleroma/pleroma!3874
 2023-06-11 19:48:23 +00:00
lain
4e6ea7cc91 Merge branch 'tusooa/3054-banned-delete' into 'develop' 
Fix deleting banned users' statuses

See merge request pleroma/pleroma!3889
 2023-06-11 13:17:12 +00:00
Lain Soykaf
55dd8ef1c7 Merge branch 'develop' of git.pleroma.social:pleroma/pleroma into pleroma-double_mentions 2023-06-11 16:31:20 +04:00
Lain Soykaf
10dfa107d5 Update changelog 2023-06-11 16:22:03 +04:00
lain
16313af7eb Merge branch 'fix/metadata-tags' into 'develop' 
static frontend: fix meta tags

See merge request pleroma/pleroma!3885
 2023-06-11 11:57:16 +00:00
lain
1f4618d64b Merge branch 'cleanup/ostatus-user-upgrade' into 'develop' 
Cleanup OStatus-era user upgrades and ap_enabled indicator

See merge request pleroma/pleroma!3880
 2023-06-11 11:13:57 +00:00
feld
75900f21f0 Merge branch 'revert-mediaproxy-host-validation' into 'develop' 
Revert MediaProxy Host header validation

See merge request pleroma/pleroma!3902
 2023-06-11 11:10:51 +00:00
lain
1db29f734f Merge branch 'fep-fffd-url' into 'develop' 
CommonFields: Use BareUri for :url

Closes #3121

See merge request pleroma/pleroma!3884
 2023-06-11 11:02:39 +00:00
lain
b762a7503c Merge branch 'distro-docs-elixir-1.11' into 'develop' 
installation/debian_based_*: Elixir 1.11 means Debian 12+ and Ubuntu 22.04+

See merge request pleroma/pleroma!3898
 2023-06-11 10:42:22 +00:00
Mark Felder
1ca1b4b32f changelog.d 2023-06-07 09:25:57 -04:00
Mark Felder
fadcd7f1a9 Revert MediaProxy Host header validation 
Something is going wrong here even though the tests are correct.
 2023-06-07 09:19:22 -04:00
Mark Felder
c665d53295 Update to Phoenix 1.7 2023-06-03 14:06:28 -04:00
feld
86b38dd14b Merge branch 'develop' into 'phoenix1.7' 
# Conflicts:
#   mix.exs
 2023-06-02 15:41:40 +00:00
Lain Soykaf
40d40d67a3 Add changelog. 2023-06-02 17:09:58 +04:00
Haelwenn (lanodan) Monnier
313e68c180 mix: bump gettext to ~0.20 
Includes https://github.com/elixir-gettext/gettext/pull/304 in 0.20.0+
Includes https://github.com/elixir-gettext/expo/issues/91 in 0.22+ via expo 0.2.0+
 2023-06-02 03:06:32 +02:00
Mark Felder
f622f82c0e No user facing changes 2023-05-31 13:38:46 -04:00
Mark Felder
46c799f528 Use Phoenix.ConnTest.redirected_to/2 2023-05-31 09:54:37 -04:00
Haelwenn (lanodan) Monnier
737e45c102 installation/debian_based_jp: Elixir 1.11 means Debian 12+ and Ubuntu 22.04+ 
I checked for what each part of the debian&ubuntu sentences meant with the
help of Jisho.org, should be safe but it did make me notice that this guide
hasn't been updated in years
 2023-05-31 08:32:58 +02:00
Haelwenn
d998a114e2 Merge branch 'validate-host' into 'develop' 
Validate Host header for MediaProxy and Uploads

See merge request pleroma/pleroma!3896
 2023-05-31 00:50:01 +00:00
Mark Felder
b3c3bd99c3 Switch from serving a 400 to a 302 2023-05-30 16:56:09 -04:00
Mark Felder
9caa0b0be1 Add OnlyMedia Upload Filter to simplify restricting uploads to audio, image, and video types 2023-05-29 15:49:04 -04:00
Mark Felder
84974efe4c Host header validation is now required for MediaProxy and Uploads 2023-05-29 14:17:27 -04:00
faried nawaz
a1af122499
changelog entry 2023-05-29 02:52:49 +05:00
Haelwenn (lanodan) Monnier
869f0d24a6 Merge branch 'release/2.5.2' into mergeback/2.5.2 2023-05-26 23:47:50 +02:00
tusooa
408ea697aa
Add changelog 2023-05-26 17:28:41 -04:00
Mark Felder
4505bc1e58 Filter OEmbed HTML tags 2023-05-26 19:56:36 +02:00