bigbuffet/pleroma
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
15985 commits 1 branch 0 tags 292 MiB
Commit graph

9502 commits

Author SHA1 Message Date
marcin mikołajczak
f6de23a1cf Add /api/1/soapbox scope for Rebased-specific routes 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-20 22:22:53 +02:00
marcin mikołajczak
83054ebd5e Replace deprecated Logger.warn/1 with Logger.warning 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-10 23:29:35 +02:00
marcin mikołajczak
96a6b4dbc8 Merge remote-tracking branch 'pleroma/develop' into merge-pleroma 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-05 15:22:01 +02:00
Mae
ca0859b90f Prevent XML parser from loading external entities 2023-08-04 22:35:13 -04:00
Alex Gleason
fa4f0ae328
Merge remote-tracking branch 'pleroma/develop' into merge-pleroma 2023-08-04 09:32:59 -05:00
Haelwenn (lanodan) Monnier
69caedc591 instance gen: Reduce permissions of pleroma directories and config files 2023-08-04 09:50:28 +02:00
Haelwenn (lanodan) Monnier
8cc8100120 Config: Restrict permissions of OTP config file 2023-08-04 09:50:28 +02:00
Mark Felder
2c79509453 Resolve information disclosure vulnerability through emoji pack archive download endpoint 
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.

The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.

Reported by: graf@poast.org
 2023-08-04 08:40:27 +02:00
Haelwenn
819fccb7d1 Merge branch 'tusooa/3154-attachment-type-check' into 'develop' 
Restrict attachments to only uploaded files only

Closes #3154

See merge request pleroma/pleroma!3923
 2023-08-03 10:01:32 +00:00
Faried Nawaz
e5e76ec445 cleaner ecto query to handle restrict_unauthenticated for activities 
This fix is for this case:

  config :pleroma, :restrict_unauthenticated,
    activities: %{local: true, remote: true}
 2023-07-28 18:45:59 +05:00
faried nawaz
dc4de79d43 status context: perform visibility check on activities around a status 
issue #2927
 2023-07-28 18:45:59 +05:00
marcin mikołajczak
f1592b2947 Merge remote-tracking branch 'pleroma/develop' into merge-pleroma 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-07-26 22:32:27 +02:00
marcin mikołajczak
c54e542f83 Merge branch 'instance-v2' into 'develop' 
Show instance language in /api/v2/instance

See merge request soapbox-pub/rebased!260
 2023-07-24 09:25:52 +00:00
marcin mikołajczak
6b045c1e81 Show instance language in /api/v2/instance 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-07-24 11:15:34 +02:00
marcin mikołajczak
95cf3933fa Improve authorization page permissions styles 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-07-23 00:19:55 +02:00
tusooa
ea4225a646
Restrict attachments to only uploaded files only 2023-07-18 18:39:59 -04:00
Haelwenn
93ad16cca0 Merge branch '2023-06-deps-update' into 'develop' 
2023-06 deps update + de-override plug

See merge request pleroma/pleroma!3911
 2023-07-17 20:37:47 +00:00
marcin mikołajczak
ee0984a0c8 Use nil for empty last_status_at value 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-07-13 09:23:57 +02:00
marcin mikołajczak
7c28e26535 Display last_status_at in masto date format 2023-07-12 18:32:26 +00:00
marcin mikołajczak
4e0e5ce463 Fix tests 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-07-09 19:30:54 +02:00
marcin mikołajczak
5f5e95ebcd Lint 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-07-09 19:10:19 +02:00
marcin mikołajczak
ba8c734818 Familiar followers query 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-07-09 19:03:06 +02:00
marcin mikołajczak
7579332262 Merge remote-tracking branch 'soapbox/develop' into familiar_followers 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-07-09 18:46:04 +02:00
tusooa
1459d64508
Make regex-to-string descriptor reusable 2023-07-07 07:09:35 -04:00
tusooa
ba3aa4f86d
Fix edge cases 2023-07-07 06:58:32 -04:00
tusooa
ef8a6c539a
Make EmojiPolicy aware of custom emoji reactions 2023-07-07 06:58:31 -04:00
tusooa
20d193c91d
Improve config examples for EmojiPolicy 2023-07-07 06:58:31 -04:00
tusooa
f50422c380
Move emoji_policy.ex to the right place 2023-07-07 06:58:31 -04:00
tusooa
7eb8abf7bb
EmojiPolicy: Implement delist 2023-07-07 06:58:31 -04:00
tusooa
80ce6482f6
EmojiPolicy: implement remove by shortcode 2023-07-07 06:58:31 -04:00
tusooa
28ff828caa
Add emoji policy to remove emojis matching certain urls 
https://git.pleroma.social/pleroma/pleroma/-/issues/2775
 2023-07-07 06:58:22 -04:00
Haelwenn (lanodan) Monnier
3d79ceb23a Deprecate audio scrobbling 2023-07-04 03:40:11 +02:00
Haelwenn
a31a4c522f Merge branch 'tusooa/3131-handle-report-from-deactivated-user' into 'develop' 
Fix handling report from a deactivated user

Closes #3131

See merge request pleroma/pleroma!3915
 2023-07-02 21:27:15 +00:00
tusooa
6e4de2383f
Fix handling report from a deactivated user 2023-07-02 11:15:34 -04:00
tusooa
a1621839cc
Fix user fetch completely broken if featured collection is not in a supported form 2023-07-02 11:03:09 -04:00
tusooa
48e490cd58 Merge branch 'bugfix/full-revert-media-host-validation' into 'develop' 
Merge Revert "Merge branch 'validate-host' into 'develop'"

Closes #3136

See merge request pleroma/pleroma!3909
 2023-07-01 21:54:18 +00:00
Haelwenn
043a00991d Merge branch 'instance-nodeinfo-metadata' into 'develop' 
instances: Store some metadata based on NodeInfo

See merge request pleroma/pleroma!3853
 2023-06-27 18:58:04 +00:00
Haelwenn
ae0ca49451 Merge branch 'tusooa/3119-bio-update' into 'develop' 
Show more informative errors when profile exceeds char limits

Closes #3119

See merge request pleroma/pleroma!3886
 2023-06-27 18:49:43 +00:00
Haelwenn
41f2ee69a8 Merge branch 'from/upstream-develop/tusooa/backup-status' into 'develop' 
Detail backup states

Closes #3024

See merge request pleroma/pleroma!3809
 2023-06-27 12:08:11 +00:00
Haelwenn (lanodan) Monnier
d7e049d5e8 router: Fix usage of globs 
warning: doing a prefix match with globs is deprecated, invalid segment "pleroma*path".
    You can either replace by a single segment match:
        /foo/bar-:var
    Or by mixing single segment match with globs:
        /foo/bar-:var/*rest
 2023-06-27 10:42:10 +02:00
Haelwenn (lanodan) Monnier
3a67b8f287 endpoint: Use custom Multipart module for dynamic configuration 2023-06-27 10:41:25 +02:00
Haelwenn (lanodan) Monnier
dd9f8150fc Merge Revert "Merge branch 'validate-host' into 'develop'" 
This reverts commit d998a114e2, reversing
changes made to da6b4003ac.
 2023-06-22 21:28:25 +02:00
Sean King
a5a354a36e
Prevent bypassing authorized fetch mode with a json file 2023-06-21 23:10:56 -06:00
marcin mikołajczak
cb7002b6c3 Move admin routes outside wrong role 2023-06-20 18:06:53 +00:00
lain
4e6ea7cc91 Merge branch 'tusooa/3054-banned-delete' into 'develop' 
Fix deleting banned users' statuses

See merge request pleroma/pleroma!3889
 2023-06-11 13:17:12 +00:00
Lain Soykaf
6611c6ce4e B ForceMentionsInContent: Fix test, refactor. 2023-06-11 16:45:31 +04:00
Lain Soykaf
55dd8ef1c7 Merge branch 'develop' of git.pleroma.social:pleroma/pleroma into pleroma-double_mentions 2023-06-11 16:31:20 +04:00
lain
16313af7eb Merge branch 'fix/metadata-tags' into 'develop' 
static frontend: fix meta tags

See merge request pleroma/pleroma!3885
 2023-06-11 11:57:16 +00:00
lain
1f4618d64b Merge branch 'cleanup/ostatus-user-upgrade' into 'develop' 
Cleanup OStatus-era user upgrades and ap_enabled indicator

See merge request pleroma/pleroma!3880
 2023-06-11 11:13:57 +00:00
feld
75900f21f0 Merge branch 'revert-mediaproxy-host-validation' into 'develop' 
Revert MediaProxy Host header validation

See merge request pleroma/pleroma!3902
 2023-06-11 11:10:51 +00:00