Commit graph

10,463 commits

Author SHA1 Message Date
Lain Soykaf
4337e0eb1b
Fail closed on unresolved signed payloads
Reject unknown remote Update targets and invalidate signed payloads when their signer identity cannot be mapped, avoiding crashes and fail-open signature state.
2026-05-01 12:33:26 +04:00
Lain Soykaf
7756f491d5
Split failed-signature inbox retries
Route failed-signature ActivityPub inbox retries through a dedicated worker so legacy and malformed retry jobs fail closed before processing.
2026-05-01 08:43:42 +04:00
Phantasm
42683e79df
ReceiverWorker: Check that signature matches actor 2026-04-30 01:37:34 +02:00
Phantasm
af6d12c0a5
UpdateValidator: Check Actor owns Object or updates itself 2026-04-30 01:36:58 +02:00
feld
a3404e91bc Merge pull request 'DigestEmailsWorker: Change Oban queue to "background"' (#7865) from phnt/oban-digest-queue into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7865
2026-04-01 19:08:40 +00:00
Phantasm
c8baad165b
lint: fix warnings throughout codebase 2026-03-31 16:23:11 +02:00
Phantasm
799199f6b5 DigestEmailsWorker: Change Oban queue to "background"
The mailer queue has been long gone and that left Oban jobs always
stuck in the "available" state that would never execute.
2026-03-26 22:38:26 +00:00
feld
9db47790bb Merge pull request 'reverse_proxy,endpoint,uploaded_media: add immutable cache-control flag' (#7835) from Yonle/pleroma:develop into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7835
2026-03-26 21:28:50 +00:00
nicole mikołajczyk
9e22baa66a Merge pull request 'Federate votersCount correctly' (#7858) from mkljczk/pleroma:poll-voters-count into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7858
2026-03-26 11:55:36 +00:00
nicole mikołajczyk
5aa3c8a06e Federate votersCount correctly
Signed-off-by: nicole mikołajczyk <git@mkljczk.pl>
Assisted-by: your mother
Signed-off-by: nicole mikołajczyk <git@mkljczk.pl>
2026-03-26 12:42:59 +01:00
Mark Felder
f06a0eab50 Move object_to_search_data/1 to Pleroma.Search
This standardizes this functionality within the Search module so
it doesn't need to be imported by other search backends from Meilisearch

Also integrate its filtering rules into Search.indexable?/1 for consistency
2026-03-25 14:47:39 -07:00
Mark Felder
ea78e76837 Fix add_to_index/1 to adhere to the typespec 2026-03-25 14:46:38 -07:00
feld
1d819195b6 Merge pull request 'Search: filter indexable activities before inserting Oban jobs' (#7538) from gitlab-mr-iid-4161 into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7538
2026-03-25 20:38:15 +00:00
Mark Felder
7cc9ba6f06 Merge remote-tracking branch 'origin/develop' into gitlab-mr-iid-4161 2026-03-25 13:31:07 -07:00
feld
63c9c7ea92 Merge pull request 'Harden rate limiter to deal with configuration issues' (#7795) from gitlab-mr-iid-4418 into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7795
2026-03-25 19:55:08 +00:00
feld
d1bd24ba64 Merge pull request 'ReverseProxy: Follow redirects recursively until redirect_limit' (#7812) from gitlab-mr-iid-4435 into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7812
2026-03-25 19:53:47 +00:00
feld
106a52eb2e Merge pull request 'Restore embed route' (#7857) from mkljczk/pleroma:restore-embeds into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7857
2026-03-25 19:52:16 +00:00
feld
eabfb2bd47 Merge pull request 'Fix LiveDashboard redirect not working when user added a path segment' (#7830) from live-dashboard-fix-redirect into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7830
2026-03-25 19:49:40 +00:00
feld
876913d2af Merge pull request 'Fix error codes for missing static files' (#7850) from shibao/pleroma:static-fix into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7850
Reviewed-by: Phantasm <phnt@noreply.git.pleroma.social>
2026-03-25 19:49:05 +00:00
feld
93d05efdb1 Merge pull request 'credo: fix ordering of aliases missed in pleroma/pleroma!7841' (#7852) from phnt/pleroma:credo-alias-fixes into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7852
2026-03-25 19:48:02 +00:00
Phantasm
750266f2e3 ActivityDraft: Add missing __MODULE__ matches and drop unneeded ones 2026-03-25 11:16:12 -07:00
Phantasm
ee55764501 lint 2026-03-25 11:14:42 -07:00
Phantasm
531041041a Elixir 1.19: Fix deprecation warning when invoking ParallelCompiler
warning: you must pass return_diagnostics: true when invoking Kernel.ParallelCompiler functions
  (elixir 1.19.5) lib/kernel/parallel_compiler.ex:324: Kernel.ParallelCompiler.spawn_workers/3
  (pleroma 2.10.0-7-ga7a74d5e-elixir-1-19+test) lib/pleroma/html.ex:13: Pleroma.HTML.compile_scrubbers/0
  (pleroma 2.10.0-7-ga7a74d5e-elixir-1-19+test) lib/pleroma/application.ex:48: Pleroma.Application.start/2
  (kernel 10.5) application_master.erl:299: :application_master.start_it_old/4

warning: you must pass return_diagnostics: true when invoking Kernel.ParallelCompiler functions
  (elixir 1.19.5) lib/kernel/parallel_compiler.ex:324: Kernel.ParallelCompiler.spawn_workers/3
  (pleroma 2.10.0-7-ga7a74d5e-elixir-1-19+test) lib/pleroma/application.ex:121: Pleroma.Application.load_custom_modules/0
  (pleroma 2.10.0-7-ga7a74d5e-elixir-1-19+test) lib/pleroma/application.ex:60: Pleroma.Application.start/2
  (kernel 10.5) application_master.erl:299: :application_master.start_it_old/4
2026-03-25 11:11:38 -07:00
Phantasm
f60a317c2f Elixir 1.19: Only match once on structs
Second match is not needed and a simple Map update is recommended by
the compiler
2026-03-25 11:11:17 -07:00
Phantasm
8417629b4b Elixir 1.19: Fix typing violation on struct updates in CommonAPI.Activity*
warning: a struct for Pleroma.Web.CommonAPI.ActivityDraft is expected on struct update:

         %Pleroma.Web.CommonAPI.ActivityDraft{draft | object: object}

     but got type:

         dynamic()

     where "draft" was given the type:

         # type: dynamic()
         # from: lib/pleroma/web/common_api/activity_draft.ex:91:22
         draft

     when defining the variable "draft", you must also pattern match on "%Pleroma.Web.CommonAPI.ActivityDraft{}".

     hint: given pattern matching is enough to catch typing errors, you may optionally convert the struct update into a map update. For example, instead of:

         user = some_function()
         %User{user | name: "John Doe"}

     it is enough to write:

         %User{} = user = some_function()
         %{user | name: "John Doe"}

     typing violation found at:
     │
 102 │     %__MODULE__{draft | object: object}
     │     ~
     │
     └─ lib/pleroma/web/common_api/activity_draft.ex:102:5: Pleroma.Web.CommonAPI.ActivityDraft.listen_object/1
2026-03-25 11:09:36 -07:00
Phantasm
958d250fe5 Elixir 1.19: Fix typing violation on struct updates in Web.ApiSpec.Rend*
warning: a struct for OpenApiSpex.Cast.Error is expected on struct update:

        %OpenApiSpex.Cast.Error{err | name: err.value}

    but got type:

        dynamic(%{..., name: nil, reason: :invalid_enum})

    where "err" was given the type:

        # type: dynamic(%{..., name: nil, reason: :invalid_enum})
        # from: lib/pleroma/web/api_spec/render_error.ex:20:45
        %{name: nil, reason: :invalid_enum} = err

    when defining the variable "err", you must also pattern match on "%OpenApiSpex.Cast.Error{}".

    hint: given pattern matching is enough to catch typing errors, you may optionally convert the struct update into a map update. For example, instead of:

        user = some_function()
        %User{user | name: "John Doe"}

    it is enough to write:

        %User{} = user = some_function()
        %{user | name: "John Doe"}

    typing violation found at:
    │
 21 │           %OpenApiSpex.Cast.Error{err | name: err.value}
    │           ~
    │
    └─ lib/pleroma/web/api_spec/render_error.ex:21:11: Pleroma.Web.ApiSpec.RenderError.call/2
2026-03-25 11:09:27 -07:00
Phantasm
19e05b4a7b Elixir 1.19: Fix typing violation on struct updates in Web.ApiSpec.Cast*
warning: a struct for Plug.Conn is expected on struct update:

         %Plug.Conn{conn | query_params: query_params}

     but got type:

         dynamic()

     where "conn" was given the type:

         # type: dynamic()
         # from: lib/pleroma/web/api_spec/cast_and_validate.ex:109:43
         conn

     when defining the variable "conn", you must also pattern match on "%Plug.Conn{}".

     hint: given pattern matching is enough to catch typing errors, you may optionally convert the struct update into a map update. For example, instead of:

         user = some_function()
         %User{user | name: "John Doe"}

     it is enough to write:

         %User{} = user = some_function()
         %{user | name: "John Doe"}

     typing violation found at:
     │
 133 │         conn = %Conn{conn | query_params: query_params}
     │                ~
     │
     └─ lib/pleroma/web/api_spec/cast_and_validate.ex:133:16: Pleroma.Web.ApiSpec.CastAndValidate.cast_and_validate/6
2026-03-25 11:09:16 -07:00
Phantasm
5b6af83e86 Elixir 1.19: Fix typing violation on struct updates in Pleroma.Upload
warning: a struct for Pleroma.Upload is expected on struct update:

        %Pleroma.Upload{
          upload
          | path:
              case upload.path do
                x when x === false or x === nil ->
                  <<to_string(upload.id)::binary, "/", to_string(upload.name)::binary>>

                x ->
                  x
              end
        }

    but got type:

        dynamic()

    where "upload" was given the type:

        # type: dynamic()
        # from: lib/pleroma/upload.ex:95:24
        {:ok, upload} <- prepare_upload(upload, opts)

    when defining the variable "upload", you must also pattern match on "%Pleroma.Upload{}".

    hint: given pattern matching is enough to catch typing errors, you may optionally convert the struct update into a map update. For example, instead of:

        user = some_function()
        %User{user | name: "John Doe"}

    it is enough to write:

        %User{} = user = some_function()
        %{user | name: "John Doe"}

    typing violation found at:
    │
 96 │          upload = %__MODULE__{upload | path: upload.path || "#{upload.id}/#{upload.name}"},
    │                   ~
    │
    └─ lib/pleroma/upload.ex:96:19: Pleroma.Upload.store/2
2026-03-25 11:09:10 -07:00
Phantasm
1b9cd83d88 Elixir 1.19: Fix typing violation on struct updates in MFA.Changeset
warning: a struct for Pleroma.MFA.Settings is expected on struct update:

        %Pleroma.MFA.Settings{settings | enabled: false}

    but got type:

        dynamic()

    where "settings" was given the type:

        # type: dynamic()
        # from: lib/pleroma/mfa/changeset.ex:11:14
        settings = Pleroma.MFA.fetch_settings(Ecto.Changeset.apply_changes(changeset))

    when defining the variable "settings", you must also pattern match on "%Pleroma.MFA.Settings{}".

    hint: given pattern matching is enough to catch typing errors, you may optionally convert the struct update into a map update. For example, instead of:

        user = some_function()
        %User{user | name: "John Doe"}

    it is enough to write:

        %User{} = user = some_function()
        %{user | name: "John Doe"}

    typing violation found at:
    │
 17 │       put_change(changeset, %Settings{settings | enabled: false})
    │                             ~
    │
    └─ lib/pleroma/mfa/changeset.ex:17:29: Pleroma.MFA.Changeset.disable/2

---

    warning: a struct for Pleroma.MFA.Settings is expected on struct update:

        %Pleroma.MFA.Settings{
          settings
          | totp: %Pleroma.MFA.Settings.TOTP{confirmed: false, delivery_type: "app", secret: nil}
        }

    but got type:

        dynamic()

    where "settings" was given the type:

        # type: dynamic()
        # from: lib/pleroma/mfa/changeset.ex:23:74
        %Pleroma.User{multi_factor_authentication_settings: settings} = user

    when defining the variable "settings", you must also pattern match on "%Pleroma.MFA.Settings{}".

    hint: given pattern matching is enough to catch typing errors, you may optionally convert the struct update into a map update. For example, instead of:

        user = some_function()
        %User{user | name: "John Doe"}

    it is enough to write:

        %User{} = user = some_function()
        %{user | name: "John Doe"}

    typing violation found at:
    │
 25 │     |> put_change(%Settings{settings | totp: %Settings.TOTP{}})
    │                   ~
    │
    └─ lib/pleroma/mfa/changeset.ex:25:19: Pleroma.MFA.Changeset.disable_totp/1
2026-03-25 11:09:05 -07:00
Phantasm
dfaabb48ef Elixir 1.19: Fix typing violation on struct updates in Pleroma.Marker
warning: a struct for Pleroma.Marker is expected on struct update:

        %Pleroma.Marker{marker | user: user}

    but got type:

        dynamic()

    where "marker" was given the type:

        # type: dynamic()
        # from: lib/pleroma/marker.ex
        {:ok, marker}

    when defining the variable "marker", you must also pattern match on "%Pleroma.Marker{}".

    hint: given pattern matching is enough to catch typing errors, you may optionally convert the struct update into a map update. For example, instead of:

        user = some_function()
        %User{user | name: "John Doe"}

    it is enough to write:

        %User{} = user = some_function()
        %{user | name: "John Doe"}

    typing violation found at:
    │
 81 │       {:ok, marker} -> %__MODULE__{marker | user: user}
    │                        ~
    │
    └─ lib/pleroma/marker.ex:81:24: Pleroma.Marker.get_marker/2
2026-03-25 11:08:56 -07:00
nicole mikołajczyk
6bbfba7f6e Merge pull request 'Allow fine-grained announce visibilities (ported from Akkoma)' (#7832) from mkljczk/pleroma:boost-visibilities into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7832
2026-03-21 20:45:30 +00:00
nicole mikołajczyk
23cc812366 Restore embed route
Signed-off-by: nicole mikołajczyk <git@mkljczk.pl>
Assisted-by: your mother
Signed-off-by: nicole mikołajczyk <git@mkljczk.pl>
2026-03-19 15:26:29 +01:00
nicole mikołajczyk
d0ef58a59d Merge pull request 'Normalize Hubzilla alsoKnownAs from string to array' (#7821) from phnt/pleroma:normalize-alsoKnownAs into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7821
2026-03-10 12:05:22 +00:00
nicole mikołajczyk
37cb2f9273 Merge pull request 'Avoid code duplication in UserView' (#7817) from mkljczk/pleroma:user-view-repeat into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7817
2026-03-10 12:04:43 +00:00
nicole mikołajczyk
d1787966a6 Merge branch 'develop' into exclusive-lists 2026-03-10 12:03:13 +00:00
Phantasm
a0131ff733
credo: fix ordering of aliases missed in pleroma/pleroma!7841 2026-03-08 21:19:49 +01:00
shibao
4e1ba489ec fix 404s for missing static files 2026-03-08 11:28:21 +00:00
Phantasm
d95d7f6eba Merge pull request 'Gopher: Fix crash on (re)boot when ConfigDB is enabled' (#7826) from fix-gopher-crash into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7826
2026-03-08 08:46:54 +00:00
nicole mikołajczyk
40bc79e5ce Merge pull request 'Various bookmark folders-related improvements' (#7829) from mkljczk/pleroma:bookmark-folders into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7829
2026-03-06 16:50:30 +00:00
nicole mikołajczyk
87b4e3f3ff Avoid code duplication in UserView
Signed-off-by: nicole mikołajczyk <git@mkljczk.pl>
2026-03-06 17:50:15 +01:00
nicole mikołajczyk
a1bb81bddb Merge pull request 'Don't use the confusing TwitterAPI namespace' (#7841) from mkljczk/pleroma:twitter-api-removal into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7841
2026-03-06 16:24:33 +00:00
nicole mikołajczyk
499b2ed118 remove unused alias
Signed-off-by: nicole mikołajczyk <git@mkljczk.pl>
2026-03-06 17:23:54 +01:00
Phantasm
3760480813 lint 2026-03-05 20:21:19 +00:00
Phantasm
5f321b0b5b Favicon Plug: Halt Plug pipeline when favicon not found 2026-03-05 20:21:19 +00:00
Phantasm
662c9f36ac Favicon Plug: Update moduledoc and rename to adhere to convention 2026-03-05 20:21:19 +00:00
Phantasm
d03ae43ee0 Favicon Plug: Simplify and pass when not requesting favicon 2026-03-05 20:21:19 +00:00
Yonle
8975129680 webplug(favicon): remove check on url path. 2026-03-05 20:21:19 +00:00
Yonle
96f252023e constants: remove favicon.png from static_only_files 2026-03-05 20:21:19 +00:00
Yonle
0879dd3950 endpoint: reorder: handle favicon plug first 2026-03-05 20:21:19 +00:00
Yonle
8abd25950a endpoint: use favicon plug 2026-03-05 20:21:19 +00:00