hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
pleroma/changelog.d
History
Lain Soykaf 0615025f92
 fix(http): enforce max_body again under Hackney 4 
Hackney 4 ignores `with_body` and always returns a fully read binary, so
Tesla.Adapter.Hackney never reaches the clause that honours :max_body and
the option became a no-op. Only the gun path still enforced it, through
Pleroma.HTTP.Adapter.Gun. Pleroma.Web.RelMe relies on nothing else, so it
was fetching remote pages unbounded.

Add a middleware that applies the limit for every adapter: reject when
content-length already announces too much, and reject a body that came
back over the limit. Streaming bodies are left alone -- neither adapter
limits those and the caller owns the lease, so failing here on the header
would strand a connection RichMedia is still expected to release.

On the hackney path this bounds what callers are handed rather than peak
memory, since the adapter has read the body before any middleware runs.
2026-07-26 09:29:36 +04:00
..
account-favourites-order.fix Fix account favourites ordering 2026-05-25 18:09:18 +04:00
bandit-1.11.1.security fix(deps): update bandit 2026-07-02 10:26:12 +04:00
captcha-package.fix Use pleroma_captcha Hex package 2026-05-13 23:05:25 +04:00
context-cleanup.skip litepub-0.1.jsonld cleanup 2026-04-10 21:33:20 +02:00
cowboy-2.16.1.security fix(deps): update cowboy 2026-07-02 10:36:53 +04:00
cowlib-2.17.1.security fix(deps): update cowlib 2026-07-02 10:35:41 +04:00
decimal-3.1.1.security fix(deps): update decimal 2026-07-02 10:50:20 +04:00
disabling-chats.change changelog 2026-07-24 00:59:15 +02:00
docker-arm32v7-pr-forbid-build.skip Woodpecker CI: Do not build arm/v7 in PR, simplify 2026-07-20 11:17:09 +02:00
docker-baseimage-ssl.fix Dockerfile: update base images to fix problems with SSL handshakes 2026-07-18 11:15:45 +03:00
docker-e2e-image.skip Add custom Docker image for FE E2E tests 2026-05-05 21:34:10 +02:00
earmark-mdex.security fix(deps): replace mdex with earmark parser 2026-07-23 13:02:28 +04:00
elixir-1-19.add Elixir 1.19: Added features changelog (ConfigDB blacklist) 2026-07-18 16:10:22 +02:00
elixir-1-19.fix Elixir 1.19: Added changelogs 2026-03-25 19:35:46 +00:00
featured-collection-page.fix Fix paged featured collection fetches 2026-05-22 22:11:37 +04:00
fix-preferred-frontend.fix StaticNotFoundPlug: Move 404 on non-existing static files to a new plug 2026-07-20 15:18:49 +00:00
grouped-notifications-api.add Persist notification group keys 2026-05-23 11:38:33 +04:00
grouped_notifications_flag.skip Grouped Notifications: Add feature flag to instance view and nodeinfo 2026-06-10 22:54:06 +02:00
gun-pool-rework.fix fix(http): forward plain HTTP proxy requests 2026-07-22 20:35:51 +04:00
hackney-4.0.3.security fix(deps): update hackney 2026-07-02 10:57:12 +04:00
hashtag-timeline.fix changelog 2026-07-21 01:26:06 +02:00
host-header-verification.security EnsureHostMatchesPlug: Ensure Host header matches instance URI 2026-05-12 16:50:28 +02:00
http-signatures-0.1.3.fix Add changelog for http_signatures update 2026-05-11 21:12:34 +04:00
iceshrimpnet-reports-fix.fix Handle reports with just actor ap id as the object 2026-05-13 00:56:56 +02:00
jason-1.4.5.change chore(deps): update jason 2026-07-02 10:48:06 +04:00
list-emoji.add Allow attaching emojis to user lists 2026-06-23 16:08:52 +02:00
logger-backends.change Elixir 1.19: Added changelogs 2026-03-25 19:35:46 +00:00
majic-1.2.0.change Update majic to 1.2.0 2026-05-13 18:39:40 +04:00
mastodon-websocket-protocol.fix Fix WebSocket protocol token handshakes 2026-05-22 16:30:14 +04:00
max-body-hackney.fix fix(http): enforce max_body again under Hackney 4 2026-07-26 09:29:36 +04:00
mediaproxy-content-type.fix fix(media-proxy): safely detect extensionless images 2026-07-25 00:06:03 +04:00
mfm-backend.add Add changelog for MFM support 2026-05-11 15:05:00 +04:00
mfm-extend.skip "changelog" 2026-05-18 21:07:12 +03:00
mix-audit.add chore(deps): add mix audit 2026-07-02 10:20:59 +04:00
oauth-user-preload.change perf(oauth): avoid duplicate user preload 2026-07-24 16:01:34 +04:00
oban-plugins-lazarus-hex.change Use Hex release for oban_plugins_lazarus 2026-05-13 19:10:15 +04:00
phoenix-1.8.8.security fix(deps): update phoenix 2026-07-02 10:31:34 +04:00
phoenix-sec-websocket-headers.change Switch Phoenix back to upstream 2026-01-18 10:40:10 +01:00
pleroma-fe-link.fix Update Pleroma-FE build artifacts URL 2026-05-06 13:55:45 +00:00
plug-1.20.2.security fix(deps): update plug 2026-07-02 10:27:21 +04:00
plug-cowboy-2.9.0.security fix(deps): update plug_cowboy 2026-07-02 10:33:50 +04:00
poll-voters-count-inflation.fix Add changelog for votersCount inflation fix 2026-05-06 11:48:20 +04:00
postgrex-0.22.2.security fix(deps): update postgrex 2026-07-02 10:39:34 +04:00
publisher-worker-atoms.fix fix(workers): avoid dynamic publisher atoms 2026-07-24 16:01:24 +04:00
quic-unused.security fix(deps): remove unused quic lock 2026-07-02 10:40:53 +04:00
reject-third-party-reports.fix Reject third-party remote reports 2026-05-12 23:50:30 +04:00
remote-ip-hex.change Use upstream remote_ip package 2026-05-13 20:04:12 +04:00
reverse-proxy-hackney-leak.fix Merge remote-tracking branch 'origin/develop' into audit-mix-audit-report 2026-07-25 19:54:48 +04:00
rss.fix Improve RSS compliance 2026-07-10 16:57:13 +00:00
stream-domain-block-following.fix fix(streaming): preserve followed domain exception 2026-07-24 16:01:46 +04:00
unit-testing-build-vix.skip Woodpecker CI: Build Vix in unit test pipelines instead of downloading 2026-07-20 11:16:25 +02:00
user-cache-keys.fix fix(user): correct cache key invalidation 2026-07-24 16:01:13 +04:00
user-search-sorting.change Add changelog 2026-01-01 10:04:55 +04:00
weblate-ci.skip Woodpecker CI: Do not trigger on Weblate MRs 2026-05-14 12:34:27 +02:00
woodpecker-armv7-fixups.fix Woodpecker CI: include armv7 arch in combined Docker tags 2026-07-20 16:49:53 +02:00
wss-necroposts.fix changelog 2026-05-24 23:41:59 +02:00