pleroma/changelog.d/search-remote-fetch.security
Lain Soykaf db43aec782
fix(search): fetch remote statuses only when resolving is allowed
Status search fetched any http(s) query from its remote server, for
anonymous users, on every result page and with resolve=false, so anyone
could make the server fetch URLs. As in Mastodon and in Pleroma's user
search, fetch only with resolve=true, on the first page, and for
anonymous users only if [:instance, :limit_to_local_content] is false.

Based on Akkoma ca9e33ed2 and 17efec060.

Co-authored-by: Oneric <oneric@oneric.stub>
2026-10-31 12:30:57 +04:00

1 line
142 B
Text

Status search only fetches remote URLs with resolve=true, on the first page, and for anonymous users only if limit_to_local_content allows it