hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
17,757 commits 2 branches 0 tags 241 MiB
Commit graph

10,429 commits

Author SHA1 Message Date
Alex Gleason
31eb3dc245
 		ObjectValidators: accept "quoteUrl" field 2023-09-13 19:19:02 -04:00
marcin mikołajczak
a3b17dac0b Rename test 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-09-11 00:33:53 +02:00
marcin mikołajczak
c5ed684273 Rename MapOfString to ContentLanguageMap 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-09-07 15:12:15 +02:00
marcin mikołajczak
28ef5ebd3c Update InstanceView.features 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-09-07 15:00:24 +02:00
Henry Jameson
303db126a8 Merge remote-tracking branch 'origin/tusooa/quote' into shigusegubu 2023-09-04 19:34:06 +03:00
Mint
1afde067b1 CommonAPI: Prevent users from accessing media of other users 2023-09-03 10:41:37 +02:00
marcin mikołajczak
b52d189fcc Move is_good_locale_code? to object validator 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-31 11:35:09 +02:00
tusooa
3d09bc320e
 		Make lint happy 2023-08-30 20:36:52 -04:00
tusooa
c525496e75 Merge branch 'develop' into 'tusooa/quote' 
# Conflicts:
#   lib/pleroma/constants.ex
 2023-08-31 00:35:37 +00:00
marcin mikołajczak
c160ef7b6a Remove test 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-20 13:00:13 +02:00
marcin mikołajczak
62340b50b5 Move maybe_add_content_map out of Transmogrifier, use code from tusooa's branch for MapOfString 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-19 19:03:48 +02:00
marcin mikołajczak
edc8689d91 Move maybe_add_language to CommonFixes 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-19 15:28:19 +02:00
Haelwenn
1e685c8302 Merge branch 'csp-flash' into 'develop' 
allow https: so that flash works across instances without need for media proxy

See merge request pleroma/pleroma!3879
 2023-08-16 13:37:49 +00:00
Haelwenn
d838d1990b Apply lanodan's suggestion(s) to 1 file(s) 2023-08-16 13:34:32 +00:00
marcin mikołajczak
b430b805c4 Lint 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-11 16:44:19 +02:00
marcin mikołajczak
366559c5a3 Make status.language == nil for 'und' value 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-11 14:59:58 +02:00
marcin mikołajczak
79e46ce73f InstanceView: Add common_information function 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-11 13:57:22 +02:00
marcin mikołajczak
04c8f6b4d1 Add ObjectValidators.LanguageCode type 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-11 13:44:30 +02:00
Haelwenn
049045cf2a Apply lanodan's suggestion 2023-08-11 11:44:13 +00:00
marcin mikołajczak
9effa24f30 Implement api/v2/instance route 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-11 00:08:05 +02:00
marcin mikołajczak
4745a41393 Allow to specify post language 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-11 00:07:03 +02:00
mae
48b1e9bdc7 Completely disable xml entity resolution 2023-08-05 14:17:04 +02:00
Mae
ca0859b90f Prevent XML parser from loading external entities 2023-08-04 22:35:13 -04:00
Haelwenn (lanodan) Monnier
69caedc591 instance gen: Reduce permissions of pleroma directories and config files 2023-08-04 09:50:28 +02:00
Haelwenn (lanodan) Monnier
8cc8100120 Config: Restrict permissions of OTP config file 2023-08-04 09:50:28 +02:00
Mark Felder
2c79509453 Resolve information disclosure vulnerability through emoji pack archive download endpoint 
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.

The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.

Reported by: graf@poast.org
 2023-08-04 08:40:27 +02:00
Haelwenn
819fccb7d1 Merge branch 'tusooa/3154-attachment-type-check' into 'develop' 
Restrict attachments to only uploaded files only

Closes #3154

See merge request pleroma/pleroma!3923
 2023-08-03 10:01:32 +00:00
Faried Nawaz
e5e76ec445 cleaner ecto query to handle restrict_unauthenticated for activities 
This fix is for this case:

  config :pleroma, :restrict_unauthenticated,
    activities: %{local: true, remote: true}
 2023-07-28 18:45:59 +05:00
faried nawaz
dc4de79d43 status context: perform visibility check on activities around a status 
issue #2927
 2023-07-28 18:45:59 +05:00
tusooa
ea4225a646
 		Restrict attachments to only uploaded files only 2023-07-18 18:39:59 -04:00
Haelwenn
93ad16cca0 Merge branch '2023-06-deps-update' into 'develop' 
2023-06 deps update + de-override plug

See merge request pleroma/pleroma!3911
 2023-07-17 20:37:47 +00:00
tusooa
bffa258a23
 		Fix quote_visible attribute 2023-07-13 06:56:06 -04:00
tusooa
2436c9d61d
 		Expose quote_id parameter on the api 2023-07-13 06:56:06 -04:00
tusooa
5ebabcd582
 		Do not mention original poster when quoting 2023-07-13 06:56:00 -04:00
tusooa
44eb648179
 		Fix config descriptions for mrf inline quote 2023-07-12 22:07:51 -04:00
tusooa
01eafc0372
 		Make InlineQuotePolicy history aware 2023-07-12 14:37:12 -04:00
tusooa
05beada21b
 		Add mrf to force link tag of quoting posts 2023-07-12 14:30:58 -04:00
tusooa
f8b01788eb
 		Keep incoming Link tag 2023-07-12 14:08:24 -04:00
tusooa
8f252fd99b
 		Parse object link as quoteUrl 2023-07-12 11:09:10 -04:00
tusooa
2c70857f9f
 		Allow more flexibility in InlineQuotePolicy 2023-07-12 09:30:43 -04:00
tusooa
3bb384d378
 		Allow local quote and private self-quote 2023-07-10 18:27:23 -04:00
tusooa
44cea92fbc
 		Unify logic for normalizing quoteUri 2023-07-10 18:14:14 -04:00
Alex Gleason
52c81cdf68
 		InlineQuotePolicy: skip objects which already have an .inline-quote span 2023-07-10 17:52:10 -04:00
Alex Gleason
34cf4222c1
 		Actually, don't send _misskey_quote anymore 2023-07-10 17:52:10 -04:00
Alex Gleason
5df951f670
 		InlineQuotePolicy: improve the way Markdown quotes are displayed by other software 2023-07-10 17:52:10 -04:00
Alex Gleason
32e284ed2c
 		Handle Fedibird's new quoteUri field 2023-07-10 17:52:10 -04:00
Alex Gleason
f89874596e
 		Transmogrifier: federate quotes with _misskey_quote field 2023-07-10 17:52:10 -04:00
Alex Gleason
f8b420932e
 		StatusView: return quote post inside a reblog 2023-07-10 17:52:10 -04:00
Alex Gleason
63f8c33353
 		InlineQuotePolicy: don't add line breaks to markdown posts 2023-07-10 17:52:10 -04:00
Alex Gleason
029a1045d4
 		StatusView: add quote_visible param 2023-07-10 17:52:09 -04:00