Alex Gleason
abac3be7d5
Add slashes to endpoints in tests
2023-09-24 11:55:16 -05:00
Alex Gleason
91990f12e3
BasicAuthDecoderPlug: reformat, fix/add tests
2023-09-24 10:47:04 -05:00
niggy
b882bcc884
Lock insecure auth methods behind config setting
2023-09-22 03:50:35 +00:00
Alex Gleason
82d99b835e
Merge remote-tracking branch 'pleroma/develop' into merge-pleroma
2023-09-03 10:09:05 -05:00
Mint
1afde067b1
CommonAPI: Prevent users from accessing media of other users
2023-09-03 10:41:37 +02:00
acaae4c992
Fix tests
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-08-24 01:22:20 +02:00
f08184b0fa
Fix validate_webfinger when running a different domain for Webfinger
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-08-24 00:37:39 +02:00
Alex Gleason
2f52806410
Prevent webfinger spoofing
2023-08-23 13:10:19 -05:00
83054ebd5e
Replace deprecated Logger.warn/1 with Logger.warning
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-08-10 23:29:35 +02:00
96a6b4dbc8
Merge remote-tracking branch 'pleroma/develop' into merge-pleroma
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-08-05 15:22:01 +02:00
mae
48b1e9bdc7
Completely disable xml entity resolution
2023-08-05 14:17:04 +02:00
FloatingGhost
307692cee8
Add unit test for external entity loading
2023-08-05 08:14:27 +02:00
Alex Gleason
fa4f0ae328
Merge remote-tracking branch 'pleroma/develop' into merge-pleroma
2023-08-04 09:32:59 -05:00
Haelwenn (lanodan) Monnier
65ef8f19c5
release_runtime_provider_test: chmod config for hardened permissions
...
Git doesn't manages file permissions precisely enough for us.
2023-08-04 09:50:28 +02:00
Mark Felder
2c79509453
Resolve information disclosure vulnerability through emoji pack archive download endpoint
...
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.
The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.
Reported by: graf@poast.org
2023-08-04 08:40:27 +02:00
Haelwenn
819fccb7d1
Merge branch 'tusooa/3154-attachment-type-check' into 'develop'
...
Restrict attachments to only uploaded files only
Closes #3154
See merge request pleroma/pleroma!3923
2023-08-03 10:01:32 +00:00
faried nawaz
dc4de79d43
status context: perform visibility check on activities around a status
...
issue #2927
2023-07-28 18:45:59 +05:00
eb05a5524c
Remove test?
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-07-28 00:49:46 +02:00
f1592b2947
Merge remote-tracking branch 'pleroma/develop' into merge-pleroma
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-07-26 22:32:27 +02:00
tusooa
ea4225a646
Restrict attachments to only uploaded files only
2023-07-18 18:39:59 -04:00
4e0e5ce463
Fix tests
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-07-09 19:30:54 +02:00
7579332262
Merge remote-tracking branch 'soapbox/develop' into familiar_followers
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-07-09 18:46:04 +02:00
tusooa
1459d64508
Make regex-to-string descriptor reusable
2023-07-07 07:09:35 -04:00
tusooa
ba3aa4f86d
Fix edge cases
2023-07-07 06:58:32 -04:00
tusooa
d670dbdbd3
Test that unicode emoji reactions are not affected
2023-07-07 06:58:32 -04:00
tusooa
ef8a6c539a
Make EmojiPolicy aware of custom emoji reactions
2023-07-07 06:58:31 -04:00
tusooa
7eb8abf7bb
EmojiPolicy: Implement delist
2023-07-07 06:58:31 -04:00
tusooa
80ce6482f6
EmojiPolicy: implement remove by shortcode
2023-07-07 06:58:31 -04:00
tusooa
28ff828caa
Add emoji policy to remove emojis matching certain urls
...
https://git.pleroma.social/pleroma/pleroma/-/issues/2775
2023-07-07 06:58:22 -04:00
Haelwenn
0262916978
Merge branch 'testfix/system-config-use' into 'develop'
...
release_runtime_provider_test: Explicitely use non-existant config file
See merge request pleroma/pleroma!3910
2023-07-02 21:28:15 +00:00
Haelwenn
a31a4c522f
Merge branch 'tusooa/3131-handle-report-from-deactivated-user' into 'develop'
...
Fix handling report from a deactivated user
Closes #3131
See merge request pleroma/pleroma!3915
2023-07-02 21:27:15 +00:00
tusooa
6e4de2383f
Fix handling report from a deactivated user
2023-07-02 11:15:34 -04:00
tusooa
a1621839cc
Fix user fetch completely broken if featured collection is not in a supported form
2023-07-02 11:03:09 -04:00
tusooa
48e490cd58
Merge branch 'bugfix/full-revert-media-host-validation' into 'develop'
...
Merge Revert "Merge branch 'validate-host' into 'develop'"
Closes #3136
See merge request pleroma/pleroma!3909
2023-07-01 21:54:18 +00:00
Haelwenn
043a00991d
Merge branch 'instance-nodeinfo-metadata' into 'develop'
...
instances: Store some metadata based on NodeInfo
See merge request pleroma/pleroma!3853
2023-06-27 18:58:04 +00:00
Haelwenn
ae0ca49451
Merge branch 'tusooa/3119-bio-update' into 'develop'
...
Show more informative errors when profile exceeds char limits
Closes #3119
See merge request pleroma/pleroma!3886
2023-06-27 18:49:43 +00:00
Haelwenn
41f2ee69a8
Merge branch 'from/upstream-develop/tusooa/backup-status' into 'develop'
...
Detail backup states
Closes #3024
See merge request pleroma/pleroma!3809
2023-06-27 12:08:11 +00:00
Haelwenn (lanodan) Monnier
8bc51288be
release_runtime_provider_test: Explicitely use non-existant config file
2023-06-27 00:20:29 +02:00
Haelwenn (lanodan) Monnier
dd9f8150fc
Merge Revert "Merge branch 'validate-host' into 'develop'"
...
This reverts commit d998a114e2da6b4003ac
2023-06-22 21:28:25 +02:00
lain
4e6ea7cc91
Merge branch 'tusooa/3054-banned-delete' into 'develop'
...
Fix deleting banned users' statuses
See merge request pleroma/pleroma!3889
2023-06-11 13:17:12 +00:00
Lain Soykaf
6611c6ce4e
B ForceMentionsInContent: Fix test, refactor.
2023-06-11 16:45:31 +04:00
Lain Soykaf
55dd8ef1c7
Merge branch 'develop' of git.pleroma.social:pleroma/pleroma into pleroma-double_mentions
2023-06-11 16:31:20 +04:00
lain
16313af7eb
Merge branch 'fix/metadata-tags' into 'develop'
...
static frontend: fix meta tags
See merge request pleroma/pleroma!3885
2023-06-11 11:57:16 +00:00
lain
1f4618d64b
Merge branch 'cleanup/ostatus-user-upgrade' into 'develop'
...
Cleanup OStatus-era user upgrades and ap_enabled indicator
See merge request pleroma/pleroma!3880
2023-06-11 11:13:57 +00:00
feld
75900f21f0
Merge branch 'revert-mediaproxy-host-validation' into 'develop'
...
Revert MediaProxy Host header validation
See merge request pleroma/pleroma!3902
2023-06-11 11:10:51 +00:00
lain
1db29f734f
Merge branch 'fep-fffd-url' into 'develop'
...
CommonFields: Use BareUri for :url
Closes #3121
See merge request pleroma/pleroma!3884
2023-06-11 11:02:39 +00:00
Alex Gleason
e8928e2295
Merge branch 'merge-pleroma' into 'develop'
...
Merge Pleroma
See merge request soapbox-pub/rebased!247
2023-06-07 21:50:27 +00:00
Mark Felder
bc2fe1b672
Revert MediaProxy Host header validation
...
Something is going wrong here even though the tests are correct.
2023-06-07 10:26:36 -05:00
Mark Felder
fadcd7f1a9
Revert MediaProxy Host header validation
...
Something is going wrong here even though the tests are correct.
2023-06-07 09:19:22 -04:00
Mark Felder
b271041857
Use response_content_type test assertion from Phoenix.ConnTest
2023-06-05 15:43:44 -05:00
