hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
16,951 commits 1 branch 0 tags 221 MiB
Commit graph

10,042 commits

Author SHA1 Message Date
Alex Gleason
31eb3dc245
 		ObjectValidators: accept "quoteUrl" field 2023-09-13 19:19:02 -04:00
marcin mikołajczak
a3b17dac0b Rename test 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-09-11 00:33:53 +02:00
marcin mikołajczak
c5ed684273 Rename MapOfString to ContentLanguageMap 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-09-07 15:12:15 +02:00
marcin mikołajczak
28ef5ebd3c Update InstanceView.features 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-09-07 15:00:24 +02:00
Mint
1afde067b1 CommonAPI: Prevent users from accessing media of other users 2023-09-03 10:41:37 +02:00
marcin mikołajczak
b52d189fcc Move is_good_locale_code? to object validator 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-31 11:35:09 +02:00
tusooa
3d09bc320e
 		Make lint happy 2023-08-30 20:36:52 -04:00
marcin mikołajczak
c160ef7b6a Remove test 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-20 13:00:13 +02:00
marcin mikołajczak
62340b50b5 Move maybe_add_content_map out of Transmogrifier, use code from tusooa's branch for MapOfString 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-19 19:03:48 +02:00
marcin mikołajczak
edc8689d91 Move maybe_add_language to CommonFixes 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-19 15:28:19 +02:00
Haelwenn
1e685c8302 Merge branch 'csp-flash' into 'develop' 
allow https: so that flash works across instances without need for media proxy

See merge request pleroma/pleroma!3879
 2023-08-16 13:37:49 +00:00
Haelwenn
d838d1990b Apply lanodan's suggestion(s) to 1 file(s) 2023-08-16 13:34:32 +00:00
marcin mikołajczak
b430b805c4 Lint 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-11 16:44:19 +02:00
marcin mikołajczak
366559c5a3 Make status.language == nil for 'und' value 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-11 14:59:58 +02:00
marcin mikołajczak
79e46ce73f InstanceView: Add common_information function 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-11 13:57:22 +02:00
marcin mikołajczak
04c8f6b4d1 Add ObjectValidators.LanguageCode type 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-11 13:44:30 +02:00
Haelwenn
049045cf2a Apply lanodan's suggestion 2023-08-11 11:44:13 +00:00
marcin mikołajczak
9effa24f30 Implement api/v2/instance route 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-11 00:08:05 +02:00
marcin mikołajczak
4745a41393 Allow to specify post language 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-11 00:07:03 +02:00
mae
48b1e9bdc7 Completely disable xml entity resolution 2023-08-05 14:17:04 +02:00
Mae
ca0859b90f Prevent XML parser from loading external entities 2023-08-04 22:35:13 -04:00
Haelwenn (lanodan) Monnier
69caedc591 instance gen: Reduce permissions of pleroma directories and config files 2023-08-04 09:50:28 +02:00
Haelwenn (lanodan) Monnier
8cc8100120 Config: Restrict permissions of OTP config file 2023-08-04 09:50:28 +02:00
Mark Felder
2c79509453 Resolve information disclosure vulnerability through emoji pack archive download endpoint 
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.

The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.

Reported by: graf@poast.org
 2023-08-04 08:40:27 +02:00
Haelwenn
819fccb7d1 Merge branch 'tusooa/3154-attachment-type-check' into 'develop' 
Restrict attachments to only uploaded files only

Closes #3154

See merge request pleroma/pleroma!3923
 2023-08-03 10:01:32 +00:00
Faried Nawaz
e5e76ec445 cleaner ecto query to handle restrict_unauthenticated for activities 
This fix is for this case:

  config :pleroma, :restrict_unauthenticated,
    activities: %{local: true, remote: true}
 2023-07-28 18:45:59 +05:00
faried nawaz
dc4de79d43 status context: perform visibility check on activities around a status 
issue #2927
 2023-07-28 18:45:59 +05:00
tusooa
ea4225a646
 		Restrict attachments to only uploaded files only 2023-07-18 18:39:59 -04:00
Haelwenn
93ad16cca0 Merge branch '2023-06-deps-update' into 'develop' 
2023-06 deps update + de-override plug

See merge request pleroma/pleroma!3911
 2023-07-17 20:37:47 +00:00
tusooa
1459d64508
 		Make regex-to-string descriptor reusable 2023-07-07 07:09:35 -04:00
tusooa
ba3aa4f86d
 		Fix edge cases 2023-07-07 06:58:32 -04:00
tusooa
ef8a6c539a
 		Make EmojiPolicy aware of custom emoji reactions 2023-07-07 06:58:31 -04:00
tusooa
20d193c91d
 		Improve config examples for EmojiPolicy 2023-07-07 06:58:31 -04:00
tusooa
f50422c380
 		Move emoji_policy.ex to the right place 2023-07-07 06:58:31 -04:00
tusooa
7eb8abf7bb
 		EmojiPolicy: Implement delist 2023-07-07 06:58:31 -04:00
tusooa
80ce6482f6
 		EmojiPolicy: implement remove by shortcode 2023-07-07 06:58:31 -04:00
tusooa
28ff828caa
 		Add emoji policy to remove emojis matching certain urls 
https://git.pleroma.social/pleroma/pleroma/-/issues/2775
 2023-07-07 06:58:22 -04:00
Haelwenn (lanodan) Monnier
3d79ceb23a Deprecate audio scrobbling 2023-07-04 03:40:11 +02:00
Haelwenn
a31a4c522f Merge branch 'tusooa/3131-handle-report-from-deactivated-user' into 'develop' 
Fix handling report from a deactivated user

Closes #3131

See merge request pleroma/pleroma!3915
 2023-07-02 21:27:15 +00:00
tusooa
6e4de2383f
 		Fix handling report from a deactivated user 2023-07-02 11:15:34 -04:00
tusooa
a1621839cc
 		Fix user fetch completely broken if featured collection is not in a supported form 2023-07-02 11:03:09 -04:00
tusooa
48e490cd58 Merge branch 'bugfix/full-revert-media-host-validation' into 'develop' 
Merge Revert "Merge branch 'validate-host' into 'develop'"

Closes #3136

See merge request pleroma/pleroma!3909
 2023-07-01 21:54:18 +00:00
Haelwenn
043a00991d Merge branch 'instance-nodeinfo-metadata' into 'develop' 
instances: Store some metadata based on NodeInfo

See merge request pleroma/pleroma!3853
 2023-06-27 18:58:04 +00:00
Haelwenn
ae0ca49451 Merge branch 'tusooa/3119-bio-update' into 'develop' 
Show more informative errors when profile exceeds char limits

Closes #3119

See merge request pleroma/pleroma!3886
 2023-06-27 18:49:43 +00:00
Haelwenn
41f2ee69a8 Merge branch 'from/upstream-develop/tusooa/backup-status' into 'develop' 
Detail backup states

Closes #3024

See merge request pleroma/pleroma!3809
 2023-06-27 12:08:11 +00:00
Haelwenn (lanodan) Monnier
d7e049d5e8 router: Fix usage of globs 
warning: doing a prefix match with globs is deprecated, invalid segment "pleroma*path".
    You can either replace by a single segment match:
        /foo/bar-:var
    Or by mixing single segment match with globs:
        /foo/bar-:var/*rest
 2023-06-27 10:42:10 +02:00
Haelwenn (lanodan) Monnier
3a67b8f287 endpoint: Use custom Multipart module for dynamic configuration 2023-06-27 10:41:25 +02:00
Haelwenn (lanodan) Monnier
dd9f8150fc Merge Revert "Merge branch 'validate-host' into 'develop'" 
This reverts commit d998a114e2, reversing
changes made to da6b4003ac.
 2023-06-22 21:28:25 +02:00
Sean King
a5a354a36e
 		Prevent bypassing authorized fetch mode with a json file 2023-06-21 23:10:56 -06:00
lain
4e6ea7cc91 Merge branch 'tusooa/3054-banned-delete' into 'develop' 
Fix deleting banned users' statuses

See merge request pleroma/pleroma!3889
 2023-06-11 13:17:12 +00:00