Lain Soykaf
d0b5a05075
fix(admin-api): confirm created users
2026-07-24 23:14:03 +04:00
Lain Soykaf
836f4a2d69
fix(admin-api): reject explicit empty passwords
2026-07-24 22:52:23 +04:00
Lain Soykaf
3b3aad6065
fix(api): isolate sensitive idempotency responses
2026-07-24 22:45:50 +04:00
Lain Soykaf
d57fdcc7b0
fix(admin-api): create reset tokens atomically
2026-07-24 22:25:44 +04:00
Lain Soykaf
34d827730a
fix(admin-api): preserve user batch validation
2026-07-24 22:15:14 +04:00
nicole mikołajczyk
36bc7b116d
Allow creating accounts without a password in the AdminAPI, update docs
...
Signed-off-by: nicole mikołajczyk <git@mkljczk.pl>
2026-07-20 19:01:02 +02:00
nicole mikołajczyk
b0ae451942
Merge pull request 'Allow attaching emojis to user lists' ( #7929 ) from mkljczk/pleroma:list-emoji into develop
...
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7929
2026-06-29 12:51:43 +00:00
Phantasm
c290f022de
InstanceView: Add show.json render test
2026-06-26 01:59:54 +02:00
nicole mikołajczyk
c6d1cead83
Allow attaching emojis to user lists
...
Signed-off-by: nicole mikołajczyk <git@mkljczk.pl>
2026-06-23 16:08:52 +02:00
Phantasm
07c65adb0c
Grouped Notifications: Add feature flag to instance view and nodeinfo
2026-06-10 22:54:06 +02:00
lain
98cd1bbb9a
Merge pull request 'Add grouped notifications API' ( #7910 ) from issue-7905-grouped-notifications into develop
...
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7910
Reviewed-by: Phantasm <phnt@noreply.git.pleroma.social>
2026-06-05 09:23:26 +00:00
Lain Soykaf
fc9e6793ce
Address grouped notification review cleanup
2026-05-29 12:30:33 +04:00
lain
33fdc59bc1
Merge branch 'develop' into issue-7887-featured-collection
2026-05-25 11:24:10 +00:00
lain
c8c1f7d38b
Merge pull request 'Fix Websockets streaming API pushing old already federated posts to TL' ( #7907 ) from websockets-necroposts into develop
...
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7907
2026-05-25 10:25:36 +00:00
Lain Soykaf
4c9fc6287e
Remove unreachable WebSocket protocol match
2026-05-25 09:26:07 +04:00
Phantasm
0c0d687330
credo, lint
2026-05-24 23:41:59 +02:00
Phantasm
5f55c9653c
RichMedia: Disable websockets backfill streaming in StatusView
2026-05-24 23:41:59 +02:00
Phantasm
678fe8a064
RichMedia: Add support for disabling wss streaming out on backfill
2026-05-24 23:41:58 +02:00
Lain Soykaf
a2a23b327b
Keep cursor cleanup scoped to grouped notifications
2026-05-23 14:27:11 +04:00
Lain Soykaf
add3844c6d
Persist notification group keys
2026-05-23 11:38:33 +04:00
Lain Soykaf
b054c2aa42
Fix paged featured collection fetches
2026-05-22 22:11:37 +04:00
Lain Soykaf
1e65c7a69e
Add grouped notifications API
2026-05-22 20:36:52 +04:00
Lain Soykaf
9dd02ecd50
Fix WebSocket protocol token handshakes
2026-05-22 16:30:14 +04:00
lain
c7c453ca21
Merge branch 'develop' into gitlab-mr-iid-4426
2026-05-14 06:56:57 +00:00
lain
b90ac6b9c7
Merge branch 'develop' into host-verification
2026-05-14 06:01:31 +00:00
Lain Soykaf
c92d233233
Use upstream remote_ip package
2026-05-13 20:04:12 +04:00
lain
47ca427497
Merge pull request 'Better user search' ( #7793 ) from gitlab-mr-iid-4416 into develop
...
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7793
2026-05-13 09:53:52 +00:00
lain
ffff2098f0
Merge pull request 'Signatures: Only true is true.' ( #7892 ) from bump/http-signatures-0.1.3 into develop
...
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7892
2026-05-13 06:09:06 +00:00
Lain Soykaf
68e4bb53a2
Merge branch 'develop' into fix/reject-third-party-reports
2026-05-13 08:49:20 +04:00
nicole mikołajczyk
4d3aea1fce
Handle reports with just actor ap id as the object
...
Signed-off-by: nicole mikołajczyk <git@mkljczk.pl>
2026-05-13 00:56:56 +02:00
Phantasm
2b3ac2d7fe
lint
2026-05-13 00:44:33 +02:00
Phantasm
95b15190de
ActivityPubController: require validated host header
2026-05-13 00:32:57 +02:00
Phantasm
6c2d8209c9
SignatureRetryWorker: require validated host header
2026-05-13 00:32:54 +02:00
Phantasm
6f415cf3fc
EnsureHostMatchesPlug: Remove match against default scheme port
...
Checking against the default port of the Endpoint URL scheme is
redundant as normal instances will have the combination https/443
by default created by pleroma.instance gen, Tor-only instances should
have combination http/80 and local testing instances httt/XXXX.
The default scheme port doesn't add anything usefull in these configs.
2026-05-12 23:31:55 +02:00
Lain Soykaf
0cf865f025
Reject third-party remote reports
2026-05-12 23:50:30 +04:00
Phantasm
ea886dc36b
EnsureHostMatchesPlug: Ensure Host header matches instance URI
2026-05-12 16:50:28 +02:00
Lain Soykaf
71afba4825
Signature: Treat HTTP signature errors as invalid
2026-05-12 08:52:42 +04:00
Lain Soykaf
ab9fd33762
Fix Phoenix upstream migration regressions
2026-05-11 22:14:01 +04:00
Lain Soykaf
216a00f73f
Merge develop into Phoenix upstream migration
2026-05-11 22:13:46 +04:00
Lain Soykaf
47021b5aba
Fix MFM validator alias ordering
2026-05-11 16:37:59 +04:00
Lain Soykaf
6b86e31e5d
Add backend MFM support
2026-05-11 14:53:06 +04:00
Phantasm
4873991983
Update Pleroma-FE build artifacts URL
2026-05-06 13:55:45 +00:00
Lain Soykaf
727e9e7749
Fix votersCount inflation in multiple-choice polls
...
increase_vote_count/3 was incrementing votersCount on every vote
activity, causing inflation when a single voter picks multiple options.
Now only increments when the actor is a new unique voter, and preserves
existing votersCount otherwise.
Also adds is_integer guard to voters_count/1 to handle nil safely, and
adds tests for the voters_count clause ordering and edge cases.
2026-05-06 11:33:34 +04:00
Yonle
aec0deef8b
poll_view: try to read votersCount first, and then manually count local voters.
2026-05-05 13:50:11 +07:00
Lain Soykaf
621d86a31d
Validate WebFinger nicknames against actors
2026-05-03 18:02:59 +04:00
Lain Soykaf
00dd1b5103
Add failed-signature retry regression tests
2026-05-03 10:19:33 +04:00
Lain Soykaf
4acd8c4e72
Log failed-signature retry rejections
2026-05-02 21:08:04 +04:00
Lain Soykaf
a1f7413832
Merge branch 'develop' of https://git.pleroma.social/pleroma/pleroma into update-spoofing
2026-05-02 16:10:33 +04:00
Lain Soykaf
4337e0eb1b
Fail closed on unresolved signed payloads
...
Reject unknown remote Update targets and invalidate signed payloads when their signer identity cannot be mapped, avoiding crashes and fail-open signature state.
2026-05-01 12:33:26 +04:00
Lain Soykaf
7756f491d5
Split failed-signature inbox retries
...
Route failed-signature ActivityPub inbox retries through a dedicated worker so legacy and malformed retry jobs fail closed before processing.
2026-05-01 08:43:42 +04:00
