Merge remote-tracking branch 'origin/develop' into instance-v2

2023-11-08 20:46:57 +01:00 · 2023-11-08 20:46:57 +01:00 · 1e9333a9aa
commit 1e9333a9aa
parent c6cedbb810 a51f3937ee
186 changed files with 2726 additions and 225 deletions
--- a/changelog.d/2023-06-deps-update.skip
+++ b/changelog.d/2023-06-deps-update.skip
--- a/changelog.d/3126.fix
+++ b/changelog.d/3126.fix
@ -1 +0,0 @@
-MediaProxy responses now return a sandbox CSP header
--- a/changelog.d/3801.fix
+++ b/changelog.d/3801.fix
@ -1 +0,0 @@
-Filter context activities using Visibility.visible_for_user?
--- a/changelog.d/3848.add
+++ b/changelog.d/3848.add
@ -1 +0,0 @@
-Add OAuth scope descriptions
--- a/changelog.d/3870.skip
+++ b/changelog.d/3870.skip
--- a/changelog.d/3872.remove
+++ b/changelog.d/3872.remove
@ -1 +0,0 @@
-remove BBS/SSH feature, replaced by an external bridge.
--- a/changelog.d/3873.fix
+++ b/changelog.d/3873.fix
@ -1 +0,0 @@
-UploadedMedia: Add missing disposition_type to Content-Disposition
--- a/changelog.d/3874.remove
+++ b/changelog.d/3874.remove
@ -1 +0,0 @@
-Remove a few unused indexes.
--- a/changelog.d/3876.skip
+++ b/changelog.d/3876.skip
--- a/changelog.d/3877.skip
+++ b/changelog.d/3877.skip
--- a/changelog.d/3878.skip
+++ b/changelog.d/3878.skip
--- a/changelog.d/3880.remove
+++ b/changelog.d/3880.remove
@ -1 +0,0 @@
-Cleanup OStatus-era user upgrades and ap_enabled indicator
--- a/changelog.d/3882.add
+++ b/changelog.d/3882.add
@ -1 +0,0 @@
-Allow lang attribute in status text
--- a/changelog.d/3883.fix
+++ b/changelog.d/3883.fix
@ -1 +0,0 @@
-Fix abnormal behaviour when refetching a poll
--- a/changelog.d/3884.fix
+++ b/changelog.d/3884.fix
@ -1 +0,0 @@
-Allow non-HTTP(s) URIs in "url" fields for compatibility with "FEP-fffd: Proxy Objects"
--- a/changelog.d/3885.fix
+++ b/changelog.d/3885.fix
@ -1 +0,0 @@
-Fix opengraph and twitter card meta tags
--- a/changelog.d/3888.fix
+++ b/changelog.d/3888.fix
@ -1 +0,0 @@
-ForceMentionsInContent: fix double mentions for Mastodon/Misskey posts
--- a/changelog.d/3891.fix
+++ b/changelog.d/3891.fix
@ -1 +0,0 @@
-OEmbed HTML tags are now filtered
--- a/changelog.d/3893.skip
+++ b/changelog.d/3893.skip
--- a/changelog.d/3897.add
+++ b/changelog.d/3897.add
@ -1 +0,0 @@
-OnlyMedia Upload Filter
--- a/changelog.d/3899.skip
+++ b/changelog.d/3899.skip
--- a/changelog.d/3901.security
+++ b/changelog.d/3901.security
@ -1 +0,0 @@
-Preload: Make generated JSON html-safe. It already was html safe because it only consists of config data that is base64 encoded, but this will keep it safe it that ever changes.
--- a/changelog.d/3902.skip
+++ b/changelog.d/3902.skip
--- a/changelog.d/3909.skip
+++ b/changelog.d/3909.skip
--- a/changelog.d/amd64-runner.skip
+++ b/changelog.d/amd64-runner.skip
--- a/changelog.d/attachment-type-check.fix
+++ b/changelog.d/attachment-type-check.fix
@ -1 +0,0 @@
-Restrict attachments to only uploaded files only
--- a/changelog.d/bare_uri_test.skip
+++ b/changelog.d/bare_uri_test.skip
--- a/changelog.d/benchee.skip
+++ b/changelog.d/benchee.skip
--- a/changelog.d/changelog-improve.skip
+++ b/changelog.d/changelog-improve.skip
--- a/changelog.d/check-attachment-attribution.security
+++ b/changelog.d/check-attachment-attribution.security
@ -0,0 +1 @@
+CommonAPI: Prevent users from accessing media of other users by creating a status with reused attachment ID
--- a/changelog.d/delete-status-of-banned-user.fix
+++ b/changelog.d/delete-status-of-banned-user.fix
@ -1 +0,0 @@
-Fix error 404 when deleting status of a banned user
--- a/changelog.d/deprecate-scrobbles.remove
+++ b/changelog.d/deprecate-scrobbles.remove
@ -1 +0,0 @@
-Deprecate Pleroma's audio scrobbling
--- a/changelog.d/digest_emails.fix
+++ b/changelog.d/digest_emails.fix
@ -0,0 +1 @@
+Fix the processing of email digest jobs.
--- a/changelog.d/disable-xml-entity-resolution.security
+++ b/changelog.d/disable-xml-entity-resolution.security
@ -1 +0,0 @@
-Disable XML entity resolution completely to fix a dos vulnerability
--- a/changelog.d/distro-docs-elixir-1.11.skip
+++ b/changelog.d/distro-docs-elixir-1.11.skip
--- a/changelog.d/dockerfile-config-perms.fix
+++ b/changelog.d/dockerfile-config-perms.fix
@ -1 +0,0 @@
- Fix config ownership in dockerfile to pass restriction test
--- a/changelog.d/emoji-policy.add
+++ b/changelog.d/emoji-policy.add
@ -1 +0,0 @@
-Implement MRF policy to reject or delist according to emojis
--- a/changelog.d/featured-collection-shouldnt-break-user-fetch.fix
+++ b/changelog.d/featured-collection-shouldnt-break-user-fetch.fix
@ -1 +0,0 @@
-Fix user fetch completely broken if featured collection is not in a supported form
--- a/changelog.d/fix-object-test.fix
+++ b/changelog.d/fix-object-test.fix
@ -1 +0,0 @@
-Correctly handle the situation when a poll has both "anyOf" and "oneOf" but one of them being empty
--- a/changelog.d/gentoo_otp.skip
+++ b/changelog.d/gentoo_otp.skip
--- a/changelog.d/gentoo_otp_hotfix.skip
+++ b/changelog.d/gentoo_otp_hotfix.skip
--- a/changelog.d/gentoo_otp_intro.skip
+++ b/changelog.d/gentoo_otp_intro.skip
--- a/changelog.d/handle-report-from-deactivated-user.fix
+++ b/changelog.d/handle-report-from-deactivated-user.fix
@ -1 +0,0 @@
-Fix handling report from a deactivated user
--- a/changelog.d/media-altdomain.skip
+++ b/changelog.d/media-altdomain.skip
--- a/changelog.d/no_new_privs.add
+++ b/changelog.d/no_new_privs.add
@ -1 +0,0 @@
-(hardening) Add no_new_privs=yes to OpenRC service files
--- a/changelog.d/pipeline-triggers.skip
+++ b/changelog.d/pipeline-triggers.skip
--- a/changelog.d/prevent-bypassing-authorized-fetch-mode.fix
+++ b/changelog.d/prevent-bypassing-authorized-fetch-mode.fix
@ -1 +0,0 @@
-Prevent using the .json format to bypass authorized fetch mode
--- a/changelog.d/testfix-system-config-use.skip
+++ b/changelog.d/testfix-system-config-use.skip
--- a/changelog.d/update-credentials-limit-error.fix
+++ b/changelog.d/update-credentials-limit-error.fix
@ -1 +0,0 @@
-Show more informative errors when profile exceeds char limits
				`@ -1 +0,0 @@`
				`MediaProxy responses now return a sandbox CSP header`
				`@ -1 +0,0 @@`
				`Filter context activities using Visibility.visible_for_user?`
				`@ -1 +0,0 @@`
				`remove BBS/SSH feature, replaced by an external bridge.`
				`@ -1 +0,0 @@`
				`UploadedMedia: Add missing disposition_type to Content-Disposition`
				`@ -1 +0,0 @@`
				`Cleanup OStatus-era user upgrades and ap_enabled indicator`
				`@ -1 +0,0 @@`
				`Fix abnormal behaviour when refetching a poll`
				`@ -1 +0,0 @@`
				`Allow non-HTTP(s) URIs in "url" fields for compatibility with "FEP-fffd: Proxy Objects"`
				`@ -1 +0,0 @@`
				`ForceMentionsInContent: fix double mentions for Mastodon/Misskey posts`
				`@ -1 +0,0 @@`
				`Preload: Make generated JSON html-safe. It already was html safe because it only consists of config data that is base64 encoded, but this will keep it safe it that ever changes.`
				`@ -1 +0,0 @@`
				`Restrict attachments to only uploaded files only`