hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge branch 'stable' into 'release/2.6.0'

Browse source 
# Conflicts:
#   .gitlab-ci.yml
#   lib/pleroma/web/common_api/utils.ex
#   lib/pleroma/web/xml.ex
#   mix.exs
#   test/pleroma/web/activity_pub/transmogrifier/emoji_react_handling_test.exs
#   test/pleroma/web/common_api/utils_test.exs
#   test/pleroma/web/mastodon_api/update_credentials_test.exs
#   test/pleroma/web/xml_test.exs
This commit is contained in:
tusooa 2023-10-31 01:07:43 +00:00
commit ad45b06b3f
5 changed files with 20 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
changelog.d/akkoma-xml-remote-entities.security Normal file
View file

@ -0,0 +1 @@
Fix XML External Entity (XXE) loading vulnerability allowing to fetch arbitary files from the server's filesystem

1
changelog.d/check-attachment-attribution.security Normal file
View file

@ -0,0 +1 @@
CommonAPI: Prevent users from accessing media of other users by creating a status with reused attachment ID

1
changelog.d/emoji-pack-sanitization.security Normal file
View file

@ -0,0 +1 @@
Emoji pack loader sanitizes pack names

1
changelog.d/otp_perms.security Normal file
View file

@ -0,0 +1 @@
- Reduced permissions of config files and directories, distros requiring greater permissions like group-read need to pre-create the directories