hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
18,452 commits 2 branches 0 tags 251 MiB
Commit graph

351 commits

Author SHA1 Message Date
lain
3e9dc477c9 Merge pull request 'Uploads: replace exiftool with the built-in exif_stripper' (#8028) from lambadalambda/pleroma:feature/exif-stripper into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/8028
 2026-10-31 07:48:00 +00:00
Lain Soykaf
55bf6b851d
 		build: bump exif_stripper to 0.1.3 
0.1.3 strips GPS data from XMP (including DJI drone positions), reads
TIFF descriptions, and no longer reads whole images into memory.
 2026-10-28 11:35:47 +04:00
Lain Soykaf
20354e0aee
 		fix(fetcher): require fetched documents to have the fetched id 
The fetcher accepted any document whose id was on the same host as the
fetch URL. Anyone who can place a JSON file on a host, for example
through an upload, could pass it off as another object or actor from
that host.

The id of a fetched document must now be the URL it came from (after
redirects), ignoring a trailing slash, the fragment, the host case and
differences that our URL encoding removes.
If it differs, as for Mastodon's /@user/123 display URLs, we refetch
once from that id, which must be on the same host. The refetch must
not redirect and must match exactly.

Test mocks that served a document under a different URL now serve it
from its own id.

Based on Akkoma 8684964c5 and 940792f8b.
 2026-10-27 21:58:41 +04:00
Lain Soykaf
695dd340de
 		fix(federation): reject actors that point at other hosts 
A remote actor could set its inbox or shared inbox to a third-party
host, so our signed deliveries went there. It could also claim
another actor's followers collection, which the visibility checks
trust.

Validate fetched actors and incoming actor Updates: inbox,
endpoints.sharedInbox, followers, following, featured and the
publicKey id must be on the same host as the actor id.

Based on Akkoma f07eb4cb5. The Bridgy fixture gets the key id that
current Bridgy Fed serves.
 2026-10-27 21:37:20 +04:00
Lain Soykaf
d1deb9da45
 		build: bump exif_stripper to 0.1.2 
0.1.2 handles gridded HEIC photos (as iPhones write them), PNG files
with data after IEND and TIFF files, and bounds HEIC parsing by the
input size. Add tests for these files.
 2026-10-27 18:07:45 +04:00
Lain Soykaf
addbf23546
 		feat(upload): add Exif.StripLocation and Exif.ReadDescription filters 
Pure-Elixir filters based on exif_stripper. StripLocation also handles
WebP and HEIC/AVIF, which the exiftool filter skipped.
 2026-10-27 17:27:56 +04:00
lain
3c916891f6 Merge branch 'develop' into paradedb-search-backend 2026-07-26 09:15:42 +00:00
Lain Soykaf
6e73d043ef
 		test(config): exclude static fixture from test loader 2026-07-26 12:40:38 +04:00
Lain Soykaf
271c3a3dd8
 		fix(config): keep search startup settings static 2026-07-26 11:58:31 +04:00
lain
57ab0a9302 Merge branch 'develop' into gitlab-mr-iid-4428 2026-05-14 09:39:16 +00:00
Phantasm
f80c5744b1
 		Normalize Hubzilla alsoKnownAs from string to array 2026-02-12 18:47:22 +01:00
Lain Soykaf
3b3e369f83 AP ingest: fill missing attributedTo from activity 2026-01-17 02:46:59 +04:00
Lain Soykaf
9912a9f603 AP ingest: accept Emoji icon variants 2026-01-17 01:33:21 +04:00
Lain Soykaf
e9e3d255e5 AP ingest: infer tag type when missing 2026-01-17 00:12:48 +04:00
Lain Soykaf
e781a7ef9b AP ingest: harden attachment parsing 2026-01-17 00:08:19 +04:00
Lain Soykaf
bff67650e1 AP ingest: normalize inReplyTo shapes 2026-01-16 23:57:01 +04:00
Lain Soykaf
6701f61990 AP ingest: normalize quoteUrl fields 2026-01-16 23:27:06 +04:00
Lain Soykaf
39817fa547 AP ingest: normalize object url list 2026-01-16 23:25:07 +04:00
Lain Soykaf
0feb23a308 AP ingest: accept object type as list 2026-01-16 23:16:51 +04:00
Lain Soykaf
e67b4cd8b2 test(http): reproduce hackney follow_redirect crash via CONNECT proxy 
Hackney 1.25 crashes when follow_redirect is enabled behind an HTTPS CONNECT proxy and the Location header is relative (hackney_http_connect transport).
This test demonstrates the failure and verifies Tesla-level redirects work when hackney redirects are disabled.
 2026-01-16 21:17:40 +04:00
lain
1d366c0138 Merge branch 'transmogrifier/handle-as-public' into 'develop' 
Transmogrifier: convert "as:Public" to full w3 URL

See merge request pleroma/pleroma!4394
 2025-12-22 07:39:44 +00:00
Phantasm
4985902b02
 		Add Actor images normalization from array of urls to string 2025-12-15 00:00:57 +01:00
Phantasm
5cb141a54e MRF InlineQuotePolicy: Don't inline quoted post URL in Mastodon quotes 2025-11-29 18:12:32 +01:00
Mint
6ed9d681b9 Transmogrifier: convert "as:Public" to full w3 URL 2025-11-08 07:39:46 +03:00
Ekaterina Vaartis
7ecfb95331 Handle the Dislike activity by transforming into a thumbs-down emote 2025-06-16 14:18:15 +03:00
Phantasm
1be8deda73
 		Remove Pleroma.OTPVersion module 
Its last use was a check in lib/application.ex that was removed in
commit 0e53cb4940

Major OTP version can be fetched with System.otp_release/0.
If checking against minor versions and patch levels is needed,
revert this commit since it uses the recommended way of getting
a full OTP version string.
 2025-06-03 23:17:39 +02:00
lain
254b31bf1c Merge branch 'more-emoji-likes' into 'develop' 
More emoji likes

Closes #3364

See merge request pleroma/pleroma!4342
 2025-03-20 09:12:09 +00:00
lain
81960dccf2 Merge branch 'translate-posts' into 'develop' 
Support translation providers (DeepL, LibreTranslate)

See merge request pleroma/pleroma!4102
 2025-03-20 09:11:57 +00:00
Mark Felder
7763b9a87f Truncate the length of Rich Media title and description fields 
Some sites like Instagram are serving obnoxiously long metadata fields
 2025-03-19 10:29:45 -07:00
mkljczk
08de5f94e3 Merge remote-tracking branch 'origin/develop' into translate-posts 
Signed-off-by: mkljczk <git@mkljczk.pl>
 2025-03-19 17:59:24 +01:00
Lain Soykaf
e19ca7606d Transmogrifier: Also accept mitra emoji likes. 2025-03-18 15:53:27 +04:00
Lain Soykaf
2293d0826a Tests: Fix tests. 2025-03-11 17:53:05 +04:00
Mark Felder
cb073a9cd0 Rich Media Parser should use first og:image 2025-02-28 15:12:49 -08:00
mkljczk
013c60e13a Merge remote-tracking branch 'origin/develop' into translate-posts 2025-02-22 14:07:23 +01:00
Lain Soykaf
81ab906466 AnalyzeMetadata: Don't crash on grayscale image blurhash 2025-01-30 12:18:20 +04:00
mkljczk
8cd7716872 Fix Mastodon incoming edits with inlined "likes" 
Signed-off-by: mkljczk <git@mkljczk.pl>
 2025-01-28 22:47:42 +01:00
mkljczk
d818a3d762 Merge remote-tracking branch 'origin/develop' into translate-posts 2024-12-30 18:17:50 +01:00
Mark Felder
48a4661885 Simplify test, move data into a json fixture 
By removing the inReplyTo, tags, and cc we can simplify the test and it still passes signature validation
 2024-08-28 16:31:59 -04:00
marcin mikołajczak
f7a7517296 Merge remote-tracking branch 'origin/develop' into translate-posts 2024-08-02 09:42:17 +02:00
Mark Felder
a964368e31 Add test to fetch and validate an activity that originally failed signature 2024-07-25 14:34:55 -04:00
Lain Soykaf
ba88c5078a StripLocationTest: Add failing test for PNGs 2024-06-28 20:31:03 +04:00
marcin mikołajczak
b07fd324fb Merge remote-tracking branch 'origin/develop' into translate-posts 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2024-06-12 17:13:23 +02:00
Mark Felder
b5fcb82bff Test for missing FK indexes 2024-05-30 10:49:45 -04:00
Alex Gleason
b15f8b0642 Prevent webfinger spoofing 2024-05-22 12:57:45 +04:00
Lain Soykaf
d1b053f3ba Webfinger: Add test showing wrong webfinger behavior 2024-05-22 12:57:30 +04:00
marcin mikołajczak
d667049ca9 Merge remote-tracking branch 'origin/develop' into translate-posts 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2024-05-18 11:15:03 +02:00
feld
9988dc2227 Revert "Merge branch 'strip-object-actor' into 'develop'" 
This reverts merge request !4105
 2024-05-16 23:33:48 +00:00
feld
e944b15298 Merge branch 'strip-object-actor' into 'develop' 
Strip actor from objects before federating

Closes #3269

See merge request pleroma/pleroma!4105
 2024-05-15 20:51:47 +00:00
Mark Felder
d21aa1a77c Respect the TTL returned in OpenGraph tags 2024-05-07 19:54:56 -04:00
Mark Felder
dd03184811 Strip actor from objects before federating 2024-05-07 11:54:45 -04:00