Commit graph

10,594 commits

Author SHA1 Message Date
Lain Soykaf
621d86a31d
Validate WebFinger nicknames against actors 2026-05-03 18:02:59 +04:00
Lain Soykaf
00dd1b5103
Add failed-signature retry regression tests 2026-05-03 10:19:33 +04:00
Lain Soykaf
4acd8c4e72
Log failed-signature retry rejections 2026-05-02 21:08:04 +04:00
Lain Soykaf
a1f7413832
Merge branch 'develop' of https://git.pleroma.social/pleroma/pleroma into update-spoofing 2026-05-02 16:10:33 +04:00
Lain Soykaf
4337e0eb1b
Fail closed on unresolved signed payloads
Reject unknown remote Update targets and invalidate signed payloads when their signer identity cannot be mapped, avoiding crashes and fail-open signature state.
2026-05-01 12:33:26 +04:00
Lain Soykaf
7756f491d5
Split failed-signature inbox retries
Route failed-signature ActivityPub inbox retries through a dedicated worker so legacy and malformed retry jobs fail closed before processing.
2026-05-01 08:43:42 +04:00
Phantasm
42683e79df
ReceiverWorker: Check that signature matches actor 2026-04-30 01:37:34 +02:00
Phantasm
af6d12c0a5
UpdateValidator: Check Actor owns Object or updates itself 2026-04-30 01:36:58 +02:00
Phantasm
7f97e21910
pleroma_ctl: Properly handle user arguments with whitespace
When user supplied arguments to pleroma_ctl include whitespace
that has been properly quoted, all arguments were sent to
ReleaseTasks in one string, which then String.split/1 the input on any
whitespace. This broke Mix tasks that accept certain user input like
instance gen and user management.

To fix this, pleroma_ctl now sends the arguments in list
form. Additionally pleroma_ctl arguments now need to be pre-processed.

Fixes pleroma/pleroma#7874
2026-04-24 18:04:31 +02:00
feld
a3404e91bc Merge pull request 'DigestEmailsWorker: Change Oban queue to "background"' (#7865) from phnt/oban-digest-queue into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7865
2026-04-01 19:08:40 +00:00
Phantasm
c8baad165b
lint: fix warnings throughout codebase 2026-03-31 16:23:11 +02:00
Phantasm
799199f6b5 DigestEmailsWorker: Change Oban queue to "background"
The mailer queue has been long gone and that left Oban jobs always
stuck in the "available" state that would never execute.
2026-03-26 22:38:26 +00:00
feld
9db47790bb Merge pull request 'reverse_proxy,endpoint,uploaded_media: add immutable cache-control flag' (#7835) from Yonle/pleroma:develop into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7835
2026-03-26 21:28:50 +00:00
nicole mikołajczyk
9e22baa66a Merge pull request 'Federate votersCount correctly' (#7858) from mkljczk/pleroma:poll-voters-count into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7858
2026-03-26 11:55:36 +00:00
nicole mikołajczyk
5aa3c8a06e Federate votersCount correctly
Signed-off-by: nicole mikołajczyk <git@mkljczk.pl>
Assisted-by: your mother
Signed-off-by: nicole mikołajczyk <git@mkljczk.pl>
2026-03-26 12:42:59 +01:00
Mark Felder
f06a0eab50 Move object_to_search_data/1 to Pleroma.Search
This standardizes this functionality within the Search module so
it doesn't need to be imported by other search backends from Meilisearch

Also integrate its filtering rules into Search.indexable?/1 for consistency
2026-03-25 14:47:39 -07:00
Mark Felder
ea78e76837 Fix add_to_index/1 to adhere to the typespec 2026-03-25 14:46:38 -07:00
feld
1d819195b6 Merge pull request 'Search: filter indexable activities before inserting Oban jobs' (#7538) from gitlab-mr-iid-4161 into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7538
2026-03-25 20:38:15 +00:00
Mark Felder
7cc9ba6f06 Merge remote-tracking branch 'origin/develop' into gitlab-mr-iid-4161 2026-03-25 13:31:07 -07:00
feld
63c9c7ea92 Merge pull request 'Harden rate limiter to deal with configuration issues' (#7795) from gitlab-mr-iid-4418 into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7795
2026-03-25 19:55:08 +00:00
feld
d1bd24ba64 Merge pull request 'ReverseProxy: Follow redirects recursively until redirect_limit' (#7812) from gitlab-mr-iid-4435 into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7812
2026-03-25 19:53:47 +00:00
feld
106a52eb2e Merge pull request 'Restore embed route' (#7857) from mkljczk/pleroma:restore-embeds into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7857
2026-03-25 19:52:16 +00:00
feld
eabfb2bd47 Merge pull request 'Fix LiveDashboard redirect not working when user added a path segment' (#7830) from live-dashboard-fix-redirect into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7830
2026-03-25 19:49:40 +00:00
feld
876913d2af Merge pull request 'Fix error codes for missing static files' (#7850) from shibao/pleroma:static-fix into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7850
Reviewed-by: Phantasm <phnt@noreply.git.pleroma.social>
2026-03-25 19:49:05 +00:00
feld
93d05efdb1 Merge pull request 'credo: fix ordering of aliases missed in pleroma/pleroma!7841' (#7852) from phnt/pleroma:credo-alias-fixes into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7852
2026-03-25 19:48:02 +00:00
Phantasm
08ba0d46d7 ActivityDraft: Add missing __MODULE__ matches and drop unneeded ones 2026-03-25 19:35:46 +00:00
Phantasm
1743a837dd Elixir 1.19: Set merged logger config correctly, remove log level test 2026-03-25 19:35:46 +00:00
Phantasm
0ac1b65ba9 Elixir 1.19: Fix improper deprecation warning wording 2026-03-25 19:35:46 +00:00
Phantasm
0f262bb2f3 Elixir 1.19: Replace ugly old logger config checks with config merging
Side note: Going up in log levels doesn't work properly.
 - debug->info works
 - info->debug does not work
2026-03-25 19:35:46 +00:00
Phantasm
aed0eb3333 Elixir 1.19: Warn on old config of :console Logger and conflicts 2026-03-25 19:35:46 +00:00
Phantasm
6ffd25682d Elixir 1.19: Add deprecation warning for :logger, :console configs 2026-03-25 19:35:46 +00:00
Phantasm
a4137243b6 Elixir 1.19: Reword Logger backends deprecation warning 2026-03-25 19:35:46 +00:00
Phantasm
a4c929c527 Lint 2026-03-25 19:35:46 +00:00
Phantasm
2a23eacee8 Elixir 1.19: Only match once on structs
Second match is not needed and a simple Map update is recommended by
the compiler
2026-03-25 19:35:46 +00:00
Phantasm
17a563aeb4 Elixir 1.19: Inject @compile autoload opt to MRF policies
Descriptions of MRF policies are gathered at compile-time and use
Pleroma.Docs.Generator.list_behaviour_implementations func, which
depends on modules implementing the queried behaviour to be loaded.
Otherwise descriptions for MRFs can be missing from the AdminAPI route.

Note: @behaviour cannot be injected in the __using__ macro. It causes a
loop in the compiler which leads to memory exhaustion. Hence why
@behaviour is still defined separately in the MRFs.
2026-03-25 19:35:46 +00:00
Phantasm
39409a784d Elixir 1.19: Warn on adding :console to Logger backends
Logger.Backend.Console still exists, but it is unused in our
configuration. Instead logging to console is done from Logger's
"default_handler".
2026-03-25 19:35:46 +00:00
Phantasm
3ebf4b1056 Elixir 1.19: Move deprecated logger syntax check to DeprecationWarnings 2026-03-25 19:35:46 +00:00
Phantasm
0393f0f92d Elixir 1.19: Move Logger backends under a specific config key 2026-03-25 19:35:46 +00:00
Phantasm
926cad3a76 Elixir 1.19: Refactor Logger configuration to what Elixir 1.15+ expects
Elixir 1.19 started emitting warnings about our use of:
config :logger, :console and
config :logger, backends: []
which got split in 1.15 to :default_handler, :default_formatter, and
LoggerBackends.add(backend) respectively.

On Pleroma startup it is now necessary to add the additional logger
backends at runtime (done with configure_logger() in application.ex).
New config key :pleroma, :logger_backends: [] has replaced the older
backends array. The logger_backends package is now used to facilitate
usage of other logger backends besides the default one (:logger_std_h
from OTP).

Warnings were added to Pleroma startup to warn about the usage of
:logger, backends and additional logic was introduced to make addition
of ExSyslogger to admin's configuration less dumb.

Ref: https://hexdocs.pm/logger/1.15.0/Logger.html#module-backends-and-backwards-compatibility
2026-03-25 19:35:46 +00:00
Phantasm
dd2f0a32d8 lint 2026-03-25 19:35:46 +00:00
Phantasm
5777d8e8d3 Elixir 1.19: Fix deprecation warning when invoking ParallelCompiler
warning: you must pass return_diagnostics: true when invoking Kernel.ParallelCompiler functions
  (elixir 1.19.5) lib/kernel/parallel_compiler.ex:324: Kernel.ParallelCompiler.spawn_workers/3
  (pleroma 2.10.0-7-ga7a74d5e-elixir-1-19+test) lib/pleroma/html.ex:13: Pleroma.HTML.compile_scrubbers/0
  (pleroma 2.10.0-7-ga7a74d5e-elixir-1-19+test) lib/pleroma/application.ex:48: Pleroma.Application.start/2
  (kernel 10.5) application_master.erl:299: :application_master.start_it_old/4

warning: you must pass return_diagnostics: true when invoking Kernel.ParallelCompiler functions
  (elixir 1.19.5) lib/kernel/parallel_compiler.ex:324: Kernel.ParallelCompiler.spawn_workers/3
  (pleroma 2.10.0-7-ga7a74d5e-elixir-1-19+test) lib/pleroma/application.ex:121: Pleroma.Application.load_custom_modules/0
  (pleroma 2.10.0-7-ga7a74d5e-elixir-1-19+test) lib/pleroma/application.ex:60: Pleroma.Application.start/2
  (kernel 10.5) application_master.erl:299: :application_master.start_it_old/4
2026-03-25 19:35:46 +00:00
Phantasm
6a926bf605 Elixir 1.19: Fix typing violation on struct updates in CommonAPI.Activity*
warning: a struct for Pleroma.Web.CommonAPI.ActivityDraft is expected on struct update:

         %Pleroma.Web.CommonAPI.ActivityDraft{draft | object: object}

     but got type:

         dynamic()

     where "draft" was given the type:

         # type: dynamic()
         # from: lib/pleroma/web/common_api/activity_draft.ex:91:22
         draft

     when defining the variable "draft", you must also pattern match on "%Pleroma.Web.CommonAPI.ActivityDraft{}".

     hint: given pattern matching is enough to catch typing errors, you may optionally convert the struct update into a map update. For example, instead of:

         user = some_function()
         %User{user | name: "John Doe"}

     it is enough to write:

         %User{} = user = some_function()
         %{user | name: "John Doe"}

     typing violation found at:
     │
 102 │     %__MODULE__{draft | object: object}
     │     ~
     │
     └─ lib/pleroma/web/common_api/activity_draft.ex:102:5: Pleroma.Web.CommonAPI.ActivityDraft.listen_object/1
2026-03-25 19:35:46 +00:00
Phantasm
7c79e4416f Elixir 1.19: Fix typing violation on struct updates in Web.ApiSpec.Rend*
warning: a struct for OpenApiSpex.Cast.Error is expected on struct update:

        %OpenApiSpex.Cast.Error{err | name: err.value}

    but got type:

        dynamic(%{..., name: nil, reason: :invalid_enum})

    where "err" was given the type:

        # type: dynamic(%{..., name: nil, reason: :invalid_enum})
        # from: lib/pleroma/web/api_spec/render_error.ex:20:45
        %{name: nil, reason: :invalid_enum} = err

    when defining the variable "err", you must also pattern match on "%OpenApiSpex.Cast.Error{}".

    hint: given pattern matching is enough to catch typing errors, you may optionally convert the struct update into a map update. For example, instead of:

        user = some_function()
        %User{user | name: "John Doe"}

    it is enough to write:

        %User{} = user = some_function()
        %{user | name: "John Doe"}

    typing violation found at:
    │
 21 │           %OpenApiSpex.Cast.Error{err | name: err.value}
    │           ~
    │
    └─ lib/pleroma/web/api_spec/render_error.ex:21:11: Pleroma.Web.ApiSpec.RenderError.call/2
2026-03-25 19:35:46 +00:00
Phantasm
6f62cb0ed3 Elixir 1.19: Fix typing violation on struct updates in Web.ApiSpec.Cast*
warning: a struct for Plug.Conn is expected on struct update:

         %Plug.Conn{conn | query_params: query_params}

     but got type:

         dynamic()

     where "conn" was given the type:

         # type: dynamic()
         # from: lib/pleroma/web/api_spec/cast_and_validate.ex:109:43
         conn

     when defining the variable "conn", you must also pattern match on "%Plug.Conn{}".

     hint: given pattern matching is enough to catch typing errors, you may optionally convert the struct update into a map update. For example, instead of:

         user = some_function()
         %User{user | name: "John Doe"}

     it is enough to write:

         %User{} = user = some_function()
         %{user | name: "John Doe"}

     typing violation found at:
     │
 133 │         conn = %Conn{conn | query_params: query_params}
     │                ~
     │
     └─ lib/pleroma/web/api_spec/cast_and_validate.ex:133:16: Pleroma.Web.ApiSpec.CastAndValidate.cast_and_validate/6
2026-03-25 19:35:46 +00:00
Phantasm
0d3085937c Elixir 1.19: Fix typing violation on struct updates in Pleroma.Upload
warning: a struct for Pleroma.Upload is expected on struct update:

        %Pleroma.Upload{
          upload
          | path:
              case upload.path do
                x when x === false or x === nil ->
                  <<to_string(upload.id)::binary, "/", to_string(upload.name)::binary>>

                x ->
                  x
              end
        }

    but got type:

        dynamic()

    where "upload" was given the type:

        # type: dynamic()
        # from: lib/pleroma/upload.ex:95:24
        {:ok, upload} <- prepare_upload(upload, opts)

    when defining the variable "upload", you must also pattern match on "%Pleroma.Upload{}".

    hint: given pattern matching is enough to catch typing errors, you may optionally convert the struct update into a map update. For example, instead of:

        user = some_function()
        %User{user | name: "John Doe"}

    it is enough to write:

        %User{} = user = some_function()
        %{user | name: "John Doe"}

    typing violation found at:
    │
 96 │          upload = %__MODULE__{upload | path: upload.path || "#{upload.id}/#{upload.name}"},
    │                   ~
    │
    └─ lib/pleroma/upload.ex:96:19: Pleroma.Upload.store/2
2026-03-25 19:35:46 +00:00
Phantasm
0fc046a75e Elixir 1.19: Fix typing violation on struct updates in MFA.Changeset
warning: a struct for Pleroma.MFA.Settings is expected on struct update:

        %Pleroma.MFA.Settings{settings | enabled: false}

    but got type:

        dynamic()

    where "settings" was given the type:

        # type: dynamic()
        # from: lib/pleroma/mfa/changeset.ex:11:14
        settings = Pleroma.MFA.fetch_settings(Ecto.Changeset.apply_changes(changeset))

    when defining the variable "settings", you must also pattern match on "%Pleroma.MFA.Settings{}".

    hint: given pattern matching is enough to catch typing errors, you may optionally convert the struct update into a map update. For example, instead of:

        user = some_function()
        %User{user | name: "John Doe"}

    it is enough to write:

        %User{} = user = some_function()
        %{user | name: "John Doe"}

    typing violation found at:
    │
 17 │       put_change(changeset, %Settings{settings | enabled: false})
    │                             ~
    │
    └─ lib/pleroma/mfa/changeset.ex:17:29: Pleroma.MFA.Changeset.disable/2

---

    warning: a struct for Pleroma.MFA.Settings is expected on struct update:

        %Pleroma.MFA.Settings{
          settings
          | totp: %Pleroma.MFA.Settings.TOTP{confirmed: false, delivery_type: "app", secret: nil}
        }

    but got type:

        dynamic()

    where "settings" was given the type:

        # type: dynamic()
        # from: lib/pleroma/mfa/changeset.ex:23:74
        %Pleroma.User{multi_factor_authentication_settings: settings} = user

    when defining the variable "settings", you must also pattern match on "%Pleroma.MFA.Settings{}".

    hint: given pattern matching is enough to catch typing errors, you may optionally convert the struct update into a map update. For example, instead of:

        user = some_function()
        %User{user | name: "John Doe"}

    it is enough to write:

        %User{} = user = some_function()
        %{user | name: "John Doe"}

    typing violation found at:
    │
 25 │     |> put_change(%Settings{settings | totp: %Settings.TOTP{}})
    │                   ~
    │
    └─ lib/pleroma/mfa/changeset.ex:25:19: Pleroma.MFA.Changeset.disable_totp/1
2026-03-25 19:35:46 +00:00
Phantasm
a72f9cff23 Elixir 1.19: Fix typing violation on struct updates in Pleroma.Marker
warning: a struct for Pleroma.Marker is expected on struct update:

        %Pleroma.Marker{marker | user: user}

    but got type:

        dynamic()

    where "marker" was given the type:

        # type: dynamic()
        # from: lib/pleroma/marker.ex
        {:ok, marker}

    when defining the variable "marker", you must also pattern match on "%Pleroma.Marker{}".

    hint: given pattern matching is enough to catch typing errors, you may optionally convert the struct update into a map update. For example, instead of:

        user = some_function()
        %User{user | name: "John Doe"}

    it is enough to write:

        %User{} = user = some_function()
        %{user | name: "John Doe"}

    typing violation found at:
    │
 81 │       {:ok, marker} -> %__MODULE__{marker | user: user}
    │                        ~
    │
    └─ lib/pleroma/marker.ex:81:24: Pleroma.Marker.get_marker/2
2026-03-25 19:35:46 +00:00
Phantasm
750266f2e3 ActivityDraft: Add missing __MODULE__ matches and drop unneeded ones 2026-03-25 11:16:12 -07:00
Phantasm
ee55764501 lint 2026-03-25 11:14:42 -07:00
Phantasm
531041041a Elixir 1.19: Fix deprecation warning when invoking ParallelCompiler
warning: you must pass return_diagnostics: true when invoking Kernel.ParallelCompiler functions
  (elixir 1.19.5) lib/kernel/parallel_compiler.ex:324: Kernel.ParallelCompiler.spawn_workers/3
  (pleroma 2.10.0-7-ga7a74d5e-elixir-1-19+test) lib/pleroma/html.ex:13: Pleroma.HTML.compile_scrubbers/0
  (pleroma 2.10.0-7-ga7a74d5e-elixir-1-19+test) lib/pleroma/application.ex:48: Pleroma.Application.start/2
  (kernel 10.5) application_master.erl:299: :application_master.start_it_old/4

warning: you must pass return_diagnostics: true when invoking Kernel.ParallelCompiler functions
  (elixir 1.19.5) lib/kernel/parallel_compiler.ex:324: Kernel.ParallelCompiler.spawn_workers/3
  (pleroma 2.10.0-7-ga7a74d5e-elixir-1-19+test) lib/pleroma/application.ex:121: Pleroma.Application.load_custom_modules/0
  (pleroma 2.10.0-7-ga7a74d5e-elixir-1-19+test) lib/pleroma/application.ex:60: Pleroma.Application.start/2
  (kernel 10.5) application_master.erl:299: :application_master.start_it_old/4
2026-03-25 11:11:38 -07:00