hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
17,057 commits 1 branch 0 tags 221 MiB
Commit graph

10,106 commits

Author SHA1 Message Date
Alex Gleason
59326247aa
 		CommonAPI: disallow quoting private posts through the API 2023-09-13 19:19:04 -04:00
Alex Gleason
57ef1d1211
 		Add InlineQuotePolicy to force quote URLs inline 2023-09-13 19:19:04 -04:00
Alex Gleason
1f19dd76f6
 		ActivityDraft: mix format, defensive actor ID 2023-09-13 19:19:04 -04:00
Alex Gleason
54a9897938
 		ActivityDraft: mention the OP of a quoted post 2023-09-13 19:19:04 -04:00
Alex Gleason
80ab2572a4
 		Return quote_url through the API, don't render quotes more than 1 level deep 2023-09-13 19:19:04 -04:00
Alex Gleason
5716f88a1d
 		InstanceView: add "quote_posting" feature 2023-09-13 19:19:03 -04:00
Alex Gleason
9600973917
 		mix format 2023-09-13 19:19:03 -04:00
Alex Gleason
d4fea8b559
 		ActivityDraft: allow quoting 2023-09-13 19:19:03 -04:00
Alex Gleason
6ac19c3999
 		ActivityDraft: create quote posts 2023-09-13 19:19:03 -04:00
Alex Gleason
0d9c443e51
 		StatusView: render the whole quoted status 2023-09-13 19:19:03 -04:00
Alex Gleason
ce5eb31723
 		StatusView: show quoted posts through the API, probably 2023-09-13 19:19:03 -04:00
Alex Gleason
cc4badaf60
 		Transmogrifier: fix quoteUrl here too 2023-09-13 19:19:03 -04:00
Alex Gleason
b022d6635d
 		Transmogrifier: fetch quoted post 2023-09-13 19:19:03 -04:00
Alex Gleason
795736af16
 		ObjectValidators: improve quoteUrl compatibility 2023-09-13 19:19:03 -04:00
Alex Gleason
31eb3dc245
 		ObjectValidators: accept "quoteUrl" field 2023-09-13 19:19:02 -04:00
marcin mikołajczak
a3b17dac0b Rename test 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-09-11 00:33:53 +02:00
marcin mikołajczak
c5ed684273 Rename MapOfString to ContentLanguageMap 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-09-07 15:12:15 +02:00
marcin mikołajczak
28ef5ebd3c Update InstanceView.features 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-09-07 15:00:24 +02:00
Mint
1afde067b1 CommonAPI: Prevent users from accessing media of other users 2023-09-03 10:41:37 +02:00
marcin mikołajczak
b52d189fcc Move is_good_locale_code? to object validator 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-31 11:35:09 +02:00
tusooa
3d09bc320e
 		Make lint happy 2023-08-30 20:36:52 -04:00
marcin mikołajczak
c160ef7b6a Remove test 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-20 13:00:13 +02:00
marcin mikołajczak
62340b50b5 Move maybe_add_content_map out of Transmogrifier, use code from tusooa's branch for MapOfString 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-19 19:03:48 +02:00
marcin mikołajczak
edc8689d91 Move maybe_add_language to CommonFixes 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-19 15:28:19 +02:00
Haelwenn
1e685c8302 Merge branch 'csp-flash' into 'develop' 
allow https: so that flash works across instances without need for media proxy

See merge request pleroma/pleroma!3879
 2023-08-16 13:37:49 +00:00
Haelwenn
d838d1990b Apply lanodan's suggestion(s) to 1 file(s) 2023-08-16 13:34:32 +00:00
marcin mikołajczak
b430b805c4 Lint 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-11 16:44:19 +02:00
marcin mikołajczak
366559c5a3 Make status.language == nil for 'und' value 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-11 14:59:58 +02:00
marcin mikołajczak
79e46ce73f InstanceView: Add common_information function 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-11 13:57:22 +02:00
marcin mikołajczak
04c8f6b4d1 Add ObjectValidators.LanguageCode type 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-11 13:44:30 +02:00
Haelwenn
049045cf2a Apply lanodan's suggestion 2023-08-11 11:44:13 +00:00
marcin mikołajczak
9effa24f30 Implement api/v2/instance route 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-11 00:08:05 +02:00
marcin mikołajczak
4745a41393 Allow to specify post language 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-11 00:07:03 +02:00
mae
48b1e9bdc7 Completely disable xml entity resolution 2023-08-05 14:17:04 +02:00
Mae
ca0859b90f Prevent XML parser from loading external entities 2023-08-04 22:35:13 -04:00
Haelwenn (lanodan) Monnier
69caedc591 instance gen: Reduce permissions of pleroma directories and config files 2023-08-04 09:50:28 +02:00
Haelwenn (lanodan) Monnier
8cc8100120 Config: Restrict permissions of OTP config file 2023-08-04 09:50:28 +02:00
Mark Felder
2c79509453 Resolve information disclosure vulnerability through emoji pack archive download endpoint 
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.

The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.

Reported by: graf@poast.org
 2023-08-04 08:40:27 +02:00
Haelwenn
819fccb7d1 Merge branch 'tusooa/3154-attachment-type-check' into 'develop' 
Restrict attachments to only uploaded files only

Closes #3154

See merge request pleroma/pleroma!3923
 2023-08-03 10:01:32 +00:00
Faried Nawaz
e5e76ec445 cleaner ecto query to handle restrict_unauthenticated for activities 
This fix is for this case:

  config :pleroma, :restrict_unauthenticated,
    activities: %{local: true, remote: true}
 2023-07-28 18:45:59 +05:00
faried nawaz
dc4de79d43 status context: perform visibility check on activities around a status 
issue #2927
 2023-07-28 18:45:59 +05:00
tusooa
ea4225a646
 		Restrict attachments to only uploaded files only 2023-07-18 18:39:59 -04:00
Haelwenn
93ad16cca0 Merge branch '2023-06-deps-update' into 'develop' 
2023-06 deps update + de-override plug

See merge request pleroma/pleroma!3911
 2023-07-17 20:37:47 +00:00
tusooa
1459d64508
 		Make regex-to-string descriptor reusable 2023-07-07 07:09:35 -04:00
tusooa
ba3aa4f86d
 		Fix edge cases 2023-07-07 06:58:32 -04:00
tusooa
ef8a6c539a
 		Make EmojiPolicy aware of custom emoji reactions 2023-07-07 06:58:31 -04:00
tusooa
20d193c91d
 		Improve config examples for EmojiPolicy 2023-07-07 06:58:31 -04:00
tusooa
f50422c380
 		Move emoji_policy.ex to the right place 2023-07-07 06:58:31 -04:00
tusooa
7eb8abf7bb
 		EmojiPolicy: Implement delist 2023-07-07 06:58:31 -04:00
tusooa
80ce6482f6
 		EmojiPolicy: implement remove by shortcode 2023-07-07 06:58:31 -04:00