pleroma/lib/pleroma/web
Oneric 2a55239ca8
mrf/object_age: fix handling of non-public objects
Current logic unconditionally adds public adressing to "cc"
and follower adressing to "to" after attempting to strip it
from the other one. This creates serious problems:

First the bug prompting this investigation and fix,
unconditional addition creates duplicates when adressing
URIs already were in their intended final field; e.g.
this is prominently the case for all "unlisted" posts.
Since List.delete only removes the first occurence,
this then broke follower-adress stripping later on
making the policy ineffective.

It’s also just not safe in general wrt to non-public adressing:
e.g. pre-existing duplicates didn’t get fully stripped,
bespoke adressing modes with only one of public addressing
or follower addressing are mangled — and most importantly:
any belatedly received DM or follower-only post
also got public adressing added!
Shockingly this last point was actually asserted as "correct" in tests;
it appears to be a mistake from mindless match adjustments
while fixing crashes on nil adressing in
10c792110e.

Clean up this sloppy logic up, making sure no more duplicates are
added by us, all instances of relevant adresses are purged and only
readded when they actually existed to begin with.

(cherry picked from commit 932810c35ecba9d11fa4f11112c3444b62c45b65)
2026-10-27 12:27:09 +04:00
..
activity_pub mrf/object_age: fix handling of non-public objects 2026-10-27 12:27:09 +04:00
admin_api Merge pull request 'Allow creating accounts without a password in the AdminAPI, update docs' (#7937) from mkljczk/pleroma:admin-api-passwordless-user-creation into develop 2026-07-27 07:17:14 +00:00
api_spec feat(oauth): support the profile scope 2026-10-26 12:29:51 +04:00
auth Add change_password/3 to LDAP module 2024-10-11 15:45:09 -04:00
channels
common_api fix(formatter): preserve remote MFM mentions 2026-07-22 14:17:17 +04:00
fallback Fix LiveDashboard redirect not working when user added a path segment 2026-02-17 21:10:56 +01:00
federator test(workers): replace publisher mocks with Mox 2026-07-24 17:43:02 +04:00
feed fix(feed): complete Atom XML metadata 2026-07-24 21:04:35 +04:00
frontend_switcher analysis 2025-11-29 16:46:08 +01:00
mailer
mastodon_api feat(oauth): support the profile scope 2026-10-26 12:29:51 +04:00
media_proxy Revert "Merge pull request 'MediaProxy: detect images when there's no file extension' (#7933) from mediaproxy-content-type into develop" 2026-08-13 22:02:11 +02:00
metadata Fix OpenGraph/TwitterCard meta tag ordering for posts with multiple attachments 2025-02-28 13:36:00 -08:00
mongoose_im
nodeinfo Fix NodeInfo content-type 2025-12-02 14:39:22 +01:00
o_auth fix(oauth): require security scopes to list and revoke tokens 2026-10-26 12:28:04 +04:00
o_status Fix dialyzer errors due to deprecated usage of put_layout/2 2024-01-31 14:55:11 -05:00
pleroma_api chore: remove unrouted PleromaAPI token and password controllers 2026-10-26 12:44:32 +04:00
plugs IdempotencyPlug: Fix private function name typo 2026-09-03 00:07:25 +02:00
preload/providers credo: fix ordering of aliases missed in pleroma/pleroma!7841 2026-03-08 21:19:49 +01:00
push Send push notifications for statuses from subscribed accounts 2025-11-22 16:51:21 +01:00
remote_interaction is this what i was meant to do? 2026-03-03 00:23:14 +01:00
rich_media feat(http): rework Gun connection pooling 2026-07-17 20:35:17 +04:00
static_fe Fix dialyzer errors due to deprecated usage of put_layout/2 2024-01-31 14:55:11 -05:00
templates fix(feed): complete Atom XML metadata 2026-07-24 21:04:35 +04:00
utils
views Stream marker updates 2025-09-07 23:48:01 +02:00
web_finger Apply lambadalambda's suggestion(s) to 1 file(s) 2025-05-29 08:17:31 +00:00
api_spec.ex fix(webhooks): merge develop and harden delivery 2026-07-26 17:00:14 +04:00
common_api.ex fix(mastodon-api): harden admin moderation actions 2026-07-26 13:24:03 +04:00
controller_helper.ex Keep cursor cleanup scoped to grouped notifications 2026-05-23 14:27:11 +04:00
embed_controller.ex Restore embed route 2026-03-19 15:26:29 +01:00
endpoint.ex StaticNotFoundPlug: Remove unused plug options 2026-07-20 15:18:49 +00:00
federator.ex test(workers): replace publisher mocks with Mox 2026-07-24 17:43:02 +04:00
gettext.ex Credo.Check.Readability.PredicateFunctionNames 2024-01-26 16:59:58 -05:00
instance_document.ex File.mkdir_p -> Pleroma.Backports.mkdir_p 2025-06-16 12:48:47 +02:00
manifest_controller.ex
media_proxy.ex Move custom URI encoding functions to Pleroma.Utils.URIEncoding 2025-12-10 14:56:05 +01:00
metadata.ex Add metadata provider for ActivityPub alternate links 2024-10-12 23:45:18 +02:00
multipart.ex endpoint: Use custom Multipart module for dynamic configuration 2023-06-27 10:41:25 +02:00
o_auth.ex
plug.ex
preload.ex B Preload: Make sure that the preloaded json is html safe 2023-06-02 17:03:21 +04:00
push.ex push: make vapid_config fallback to empty array 2024-09-24 05:57:41 +02:00
registration.ex Don't use the confusing TwitterAPI namespace 2026-02-27 19:53:25 +01:00
rel_me.ex
router.ex fix(webhooks): merge develop and harden delivery 2026-07-26 17:00:14 +04:00
shout_channel.ex
streamer.ex Merge branch 'develop' into architecture-quick-wins 2026-07-24 14:09:44 +00:00
translation_helpers.ex
uploader_controller.ex
web_finger.ex WebFinger: Tighten the requirements. 2025-12-21 17:46:39 +04:00
xml.ex Switch formatting checks to Elixir 1.15 2024-06-12 15:18:47 -04:00