96a6b4dbc8
Merge remote-tracking branch 'pleroma/develop' into merge-pleroma
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-08-05 15:22:01 +02:00
Haelwenn
d0f7a5c4f5
Merge branch 'mergeback/2.5.4' into 'develop'
...
Mergeback: 2.5.4
See merge request pleroma/pleroma!3930
2023-08-05 08:13:03 +00:00
Haelwenn (lanodan) Monnier
4099ddb3dc
Mergeback release 2.5.4
2023-08-05 08:58:05 +02:00
Mark Felder
6d48b0f1a9
Document and test that XXE processing is disabled
...
https://vuln.be/post/xxe-in-erlang-and-elixir/
2023-08-05 08:14:27 +02:00
FloatingGhost
307692cee8
Add unit test for external entity loading
2023-08-05 08:14:27 +02:00
Mae
ca0859b90f
Prevent XML parser from loading external entities
2023-08-04 22:35:13 -04:00
Alex Gleason
a2a85bc88e
Merge branch 'merge-pleroma' into 'develop'
...
Merge Pleroma (security fix)
See merge request soapbox-pub/rebased!263
2023-08-04 14:52:20 +00:00
Alex Gleason
fa4f0ae328
Merge remote-tracking branch 'pleroma/develop' into merge-pleroma
2023-08-04 09:32:59 -05:00
Haelwenn
1062185ba0
Merge branch 'mergeback/2.5.3' into 'develop'
...
Mergeback: 2.5.3
Closes #3135
See merge request pleroma/pleroma!3927
2023-08-04 09:38:01 +00:00
Haelwenn (lanodan) Monnier
6a0fd77c48
Release 2.5.53
2023-08-04 09:50:28 +02:00
Haelwenn (lanodan) Monnier
65ef8f19c5
release_runtime_provider_test: chmod config for hardened permissions
...
Git doesn't manages file permissions precisely enough for us.
2023-08-04 09:50:28 +02:00
Haelwenn (lanodan) Monnier
9f0ad901ed
changelog: Entry for config permissions restrictions
...
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3135
2023-08-04 09:50:28 +02:00
Haelwenn (lanodan) Monnier
69caedc591
instance gen: Reduce permissions of pleroma directories and config files
2023-08-04 09:50:28 +02:00
Haelwenn (lanodan) Monnier
8cc8100120
Config: Restrict permissions of OTP config file
2023-08-04 09:50:28 +02:00
Mark Felder
2c79509453
Resolve information disclosure vulnerability through emoji pack archive download endpoint
...
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.
The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.
Reported by: graf@poast.org
2023-08-04 08:40:27 +02:00
Haelwenn
819fccb7d1
Merge branch 'tusooa/3154-attachment-type-check' into 'develop'
...
Restrict attachments to only uploaded files only
Closes #3154
See merge request pleroma/pleroma!3923
2023-08-03 10:01:32 +00:00
marcin mikołajczak
12bba8717d
Merge branch 'merge-pleroma' into 'develop'
...
merge Pleroma
See merge request soapbox-pub/rebased!261
2023-07-28 22:31:17 +00:00
tusooa
b08cbe76f1
Merge branch 'fix/2927-disallow-unauthenticated-access' into 'develop'
...
/api/v1/statuses/:id/context: filter context activities using Visibility.visible_for_user?/2
See merge request pleroma/pleroma!3801
2023-07-28 15:05:46 +00:00
faried nawaz
11ce81d4af
add changelog entry
2023-07-28 18:49:05 +05:00
Faried Nawaz
e5e76ec445
cleaner ecto query to handle restrict_unauthenticated for activities
...
This fix is for this case:
config :pleroma, :restrict_unauthenticated,
activities: %{local: true, remote: true}
2023-07-28 18:45:59 +05:00
faried nawaz
dc4de79d43
status context: perform visibility check on activities around a status
...
issue #2927
2023-07-28 18:45:59 +05:00
eb05a5524c
Remove test?
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-07-28 00:49:46 +02:00
f1592b2947
Merge remote-tracking branch 'pleroma/develop' into merge-pleroma
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-07-26 22:32:27 +02:00
marcin mikołajczak
c54e542f83
Merge branch 'instance-v2' into 'develop'
...
Show instance language in /api/v2/instance
See merge request soapbox-pub/rebased!260
2023-07-24 09:25:52 +00:00
6b045c1e81
Show instance language in /api/v2/instance
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-07-24 11:15:34 +02:00
marcin mikołajczak
9a275aa671
Merge branch 'static-pages-styles' into 'develop'
...
Improve authorization page permissions styles
See merge request soapbox-pub/rebased!259
2023-07-22 23:35:51 +00:00
95cf3933fa
Improve authorization page permissions styles
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-07-23 00:19:55 +02:00
tusooa
ea4225a646
Restrict attachments to only uploaded files only
2023-07-18 18:39:59 -04:00
Haelwenn
93ad16cca0
Merge branch '2023-06-deps-update' into 'develop'
...
2023-06 deps update + de-override plug
See merge request pleroma/pleroma!3911
2023-07-17 20:37:47 +00:00
marcin mikołajczak
8f073333b1
Merge branch 'last-status-format' into 'develop'
...
Display last_status_at in masto date format
See merge request soapbox-pub/rebased!258
2023-07-13 08:27:00 +00:00
ee0984a0c8
Use nil for empty last_status_at value
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-07-13 09:23:57 +02:00
marcin mikołajczak
7c28e26535
Display last_status_at in masto date format
2023-07-12 18:32:26 +00:00
marcin mikołajczak
d5998d31dd
Merge branch 'familiar_followers' into 'develop'
...
/api/v1/accounts/familiar_followers
See merge request soapbox-pub/rebased!257
2023-07-10 06:24:46 +00:00
4e0e5ce463
Fix tests
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-07-09 19:30:54 +02:00
5f5e95ebcd
Lint
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-07-09 19:10:19 +02:00
ba8c734818
Familiar followers query
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-07-09 19:03:06 +02:00
7579332262
Merge remote-tracking branch 'soapbox/develop' into familiar_followers
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-07-09 18:46:04 +02:00
Haelwenn
e38207162b
Merge branch 'tusooa/2775-emoji-policy' into 'develop'
...
EmojiPolicy
Closes #2775
See merge request pleroma/pleroma!3842
2023-07-07 16:27:30 +00:00
tusooa
1459d64508
Make regex-to-string descriptor reusable
2023-07-07 07:09:35 -04:00
tusooa
ba3aa4f86d
Fix edge cases
2023-07-07 06:58:32 -04:00
tusooa
0d914e17be
Add changelog
2023-07-07 06:58:32 -04:00
tusooa
d670dbdbd3
Test that unicode emoji reactions are not affected
2023-07-07 06:58:32 -04:00
tusooa
ef8a6c539a
Make EmojiPolicy aware of custom emoji reactions
2023-07-07 06:58:31 -04:00
tusooa
20d193c91d
Improve config examples for EmojiPolicy
2023-07-07 06:58:31 -04:00
tusooa
18a8378beb
Update config cheatsheet
2023-07-07 06:58:31 -04:00
tusooa
f50422c380
Move emoji_policy.ex to the right place
2023-07-07 06:58:31 -04:00
tusooa
7eb8abf7bb
EmojiPolicy: Implement delist
2023-07-07 06:58:31 -04:00
tusooa
80ce6482f6
EmojiPolicy: implement remove by shortcode
2023-07-07 06:58:31 -04:00
tusooa
28ff828caa
Add emoji policy to remove emojis matching certain urls
...
https://git.pleroma.social/pleroma/pleroma/-/issues/2775
2023-07-07 06:58:22 -04:00
tusooa
7da6a82dbd
Merge branch 'deprecate-scrobbles' into 'develop'
...
Deprecate audio scrobbling
See merge request pleroma/pleroma!3919
2023-07-04 02:46:10 +00:00
