Haelwenn
17c336de66
Merge branch 'docs/gentoo-otp-intro' into 'develop'
...
gentoo_otp_en.md: Indicate which install method it covers
See merge request pleroma/pleroma!3928
2023-08-05 11:04:32 +00:00
Haelwenn
d0f7a5c4f5
Merge branch 'mergeback/2.5.4' into 'develop'
...
Mergeback: 2.5.4
See merge request pleroma/pleroma!3930
2023-08-05 08:13:03 +00:00
Haelwenn
1f4be2b349
Merge branch 'releases/2.5.4' into 'stable'
...
Release 2.5.4
See merge request pleroma/pleroma!3929
2023-08-05 08:12:25 +00:00
Haelwenn (lanodan) Monnier
4099ddb3dc
Mergeback release 2.5.4
2023-08-05 08:58:05 +02:00
Haelwenn (lanodan) Monnier
b631180b38
Release 2.5.4
2023-08-05 08:27:42 +02:00
Mark Felder
cc848b78dc
Document and test that XXE processing is disabled
...
https://vuln.be/post/xxe-in-erlang-and-elixir/
2023-08-05 08:23:04 +02:00
FloatingGhost
77d57c974a
Add unit test for external entity loading
2023-08-05 08:23:04 +02:00
Mae
fc10e07ffb
Prevent XML parser from loading external entities
2023-08-05 08:23:04 +02:00
Mark Felder
6d48b0f1a9
Document and test that XXE processing is disabled
...
https://vuln.be/post/xxe-in-erlang-and-elixir/
2023-08-05 08:14:27 +02:00
FloatingGhost
307692cee8
Add unit test for external entity loading
2023-08-05 08:14:27 +02:00
Mae
ca0859b90f
Prevent XML parser from loading external entities
2023-08-04 22:35:13 -04:00
Haelwenn (lanodan) Monnier
0e321698d2
gentoo_otp_en.md: Indicate which install method it covers
2023-08-04 17:11:20 +02:00
Alex Gleason
a2a85bc88e
Merge branch 'merge-pleroma' into 'develop'
...
Merge Pleroma (security fix)
See merge request soapbox-pub/rebased!263
2023-08-04 14:52:20 +00:00
Alex Gleason
fa4f0ae328
Merge remote-tracking branch 'pleroma/develop' into merge-pleroma
2023-08-04 09:32:59 -05:00
Haelwenn
ff2f3862ab
Merge branch 'release/2.5.3' into 'stable'
...
Release 2.5.3
See merge request pleroma/pleroma!3926
2023-08-04 09:45:48 +00:00
Haelwenn
1062185ba0
Merge branch 'mergeback/2.5.3' into 'develop'
...
Mergeback: 2.5.3
Closes #3135
See merge request pleroma/pleroma!3927
2023-08-04 09:38:01 +00:00
Haelwenn (lanodan) Monnier
6a0fd77c48
Release 2.5.53
2023-08-04 09:50:28 +02:00
Haelwenn (lanodan) Monnier
65ef8f19c5
release_runtime_provider_test: chmod config for hardened permissions
...
Git doesn't manages file permissions precisely enough for us.
2023-08-04 09:50:28 +02:00
Haelwenn (lanodan) Monnier
9f0ad901ed
changelog: Entry for config permissions restrictions
...
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3135
2023-08-04 09:50:28 +02:00
Haelwenn (lanodan) Monnier
69caedc591
instance gen: Reduce permissions of pleroma directories and config files
2023-08-04 09:50:28 +02:00
Haelwenn (lanodan) Monnier
8cc8100120
Config: Restrict permissions of OTP config file
2023-08-04 09:50:28 +02:00
Haelwenn (lanodan) Monnier
57f7453748
Release 2.5.3
2023-08-04 09:49:53 +02:00
Haelwenn (lanodan) Monnier
5ac2b7417d
test: Fix warnings
2023-08-04 09:49:53 +02:00
Haelwenn (lanodan) Monnier
c37561214a
Force the use of amd64 runners for jobs using ci-base
2023-08-04 09:49:53 +02:00
Haelwenn (lanodan) Monnier
76e408e42d
release_runtime_provider_test: chmod config for hardened permissions
...
Git doesn't manages file permissions precisely enough for us.
2023-08-04 09:49:53 +02:00
Haelwenn (lanodan) Monnier
22df32b3f5
changelog: Entry for config permissions restrictions
...
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3135
2023-08-04 09:49:53 +02:00
Haelwenn (lanodan) Monnier
bd7381f2f4
instance gen: Reduce permissions of pleroma directories and config files
2023-08-04 09:49:53 +02:00
Haelwenn (lanodan) Monnier
4befb3b1d0
Config: Restrict permissions of OTP config file
2023-08-04 09:49:53 +02:00
Mark Felder
2c79509453
Resolve information disclosure vulnerability through emoji pack archive download endpoint
...
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.
The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.
Reported by: graf@poast.org
2023-08-04 08:40:27 +02:00
Mark Felder
18a0c923d0
Resolve information disclosure vulnerability through emoji pack archive download endpoint
...
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.
The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.
Reported by: graf@poast.org
2023-08-04 08:39:55 +02:00
Haelwenn
819fccb7d1
Merge branch 'tusooa/3154-attachment-type-check' into 'develop'
...
Restrict attachments to only uploaded files only
Closes #3154
See merge request pleroma/pleroma!3923
2023-08-03 10:01:32 +00:00
marcin mikołajczak
12bba8717d
Merge branch 'merge-pleroma' into 'develop'
...
merge Pleroma
See merge request soapbox-pub/rebased!261
2023-07-28 22:31:17 +00:00
tusooa
b08cbe76f1
Merge branch 'fix/2927-disallow-unauthenticated-access' into 'develop'
...
/api/v1/statuses/:id/context: filter context activities using Visibility.visible_for_user?/2
See merge request pleroma/pleroma!3801
2023-07-28 15:05:46 +00:00
faried nawaz
11ce81d4af
add changelog entry
2023-07-28 18:49:05 +05:00
Faried Nawaz
e5e76ec445
cleaner ecto query to handle restrict_unauthenticated for activities
...
This fix is for this case:
config :pleroma, :restrict_unauthenticated,
activities: %{local: true, remote: true}
2023-07-28 18:45:59 +05:00
faried nawaz
dc4de79d43
status context: perform visibility check on activities around a status
...
issue #2927
2023-07-28 18:45:59 +05:00
eb05a5524c
Remove test?
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-07-28 00:49:46 +02:00
f1592b2947
Merge remote-tracking branch 'pleroma/develop' into merge-pleroma
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-07-26 22:32:27 +02:00
marcin mikołajczak
c54e542f83
Merge branch 'instance-v2' into 'develop'
...
Show instance language in /api/v2/instance
See merge request soapbox-pub/rebased!260
2023-07-24 09:25:52 +00:00
6b045c1e81
Show instance language in /api/v2/instance
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-07-24 11:15:34 +02:00
marcin mikołajczak
9a275aa671
Merge branch 'static-pages-styles' into 'develop'
...
Improve authorization page permissions styles
See merge request soapbox-pub/rebased!259
2023-07-22 23:35:51 +00:00
95cf3933fa
Improve authorization page permissions styles
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-07-23 00:19:55 +02:00
tusooa
ea4225a646
Restrict attachments to only uploaded files only
2023-07-18 18:39:59 -04:00
Haelwenn
93ad16cca0
Merge branch '2023-06-deps-update' into 'develop'
...
2023-06 deps update + de-override plug
See merge request pleroma/pleroma!3911
2023-07-17 20:37:47 +00:00
marcin mikołajczak
8f073333b1
Merge branch 'last-status-format' into 'develop'
...
Display last_status_at in masto date format
See merge request soapbox-pub/rebased!258
2023-07-13 08:27:00 +00:00
ee0984a0c8
Use nil for empty last_status_at value
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-07-13 09:23:57 +02:00
marcin mikołajczak
7c28e26535
Display last_status_at in masto date format
2023-07-12 18:32:26 +00:00
marcin mikołajczak
d5998d31dd
Merge branch 'familiar_followers' into 'develop'
...
/api/v1/accounts/familiar_followers
See merge request soapbox-pub/rebased!257
2023-07-10 06:24:46 +00:00
4e0e5ce463
Fix tests
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-07-09 19:30:54 +02:00
5f5e95ebcd
Lint
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-07-09 19:10:19 +02:00
