hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
pleroma/changelog.d
History
Lain Soykaf db43aec782
 fix(search): fetch remote statuses only when resolving is allowed 
Status search fetched any http(s) query from its remote server, for
anonymous users, on every result page and with resolve=false, so anyone
could make the server fetch URLs. As in Mastodon and in Pleroma's user
search, fetch only with resolve=true, on the first page, and for
anonymous users only if [:instance, :limit_to_local_content] is false.

Based on Akkoma ca9e33ed2 and 17efec060.

Co-authored-by: Oneric <oneric@oneric.stub>
2026-10-31 12:30:57 +04:00
..
actor-containment.security fix(federation): reject actors that point at other hosts 2026-10-27 21:37:20 +04:00
ap-c2s-oauth-scopes.security fix(activitypub): check OAuth scopes on C2S endpoints 2026-10-26 12:49:58 +04:00
attachment-zero-size.fix test(status_view): cover attachments with zero dimensions 2026-10-27 17:27:41 +04:00
bandit-1.14.1.security Sec: Update bandit to version 1.14.1 2026-10-29 09:24:08 +04:00
ci-cheap-changelog-check.skip ci: fetch only the target branch tip trees in check-changelog 2026-10-29 12:37:02 +04:00
empty-proxy-url.fix
exif-heic-gps.security build: bump exif_stripper to 0.1.3 2026-10-28 11:35:47 +04:00
exif-stripper.change refactor(upload): make Exiftool filters deprecated aliases of Exif filters 2026-10-27 17:29:15 +04:00
federation-reject-instances.security fix(federation): do not deliver to instances rejected by SimplePolicy 2026-10-27 12:38:18 +04:00
fetch-id-containment.security fix(fetcher): require fetched documents to have the fetched id 2026-10-27 21:58:41 +04:00
filter-regex-escape.fix fix(filters): treat phrases as literal text in the regex 2026-10-27 12:36:09 +04:00
filter-whole-word.fix fix(filters): honour whole_word 2026-10-27 12:50:04 +04:00
get-actor-crash.fix fix(containment): return nil for actor shapes without an id 2026-10-27 22:03:13 +04:00
gin-fuzzy-search-limit.fix fix(search): set gin_fuzzy_search_limit only for search queries 2026-10-29 11:26:02 +04:00
jose-1.11.13.security Sec: Update jose to version 1.11.13 2026-10-29 09:24:14 +04:00
legacy-sequences.fix
mastodon-quote-entity.add feat(api): add the Mastodon quote entity to statuses 2026-10-28 11:38:49 +04:00
media-proxy-network-path.security chore: add changelog entry for network-path media proxy fix 2026-10-27 17:30:08 +04:00
mention-notify-access.security fix(notifications): handle unknown users when filtering tagged mentions 2026-10-27 12:39:02 +04:00
notification-filter-nil-content.fix fix(notifications): skip the filter check for objects without content 2026-10-27 12:53:21 +04:00
oauth-profile-scope.add feat(oauth): support the profile scope 2026-10-26 12:29:51 +04:00
oauth-tokens-scopes.security fix(oauth): require security scopes to list and revoke tokens 2026-10-26 12:28:04 +04:00
object-age-non-public.security test(mrf): cover ObjectAgePolicy with private, direct and unlisted posts 2026-10-27 12:35:16 +04:00
rate-limiter-test-flake.skip test(rate_limiter): use windows that cannot expire during the test 2026-10-27 16:10:14 +04:00
refetch-containment.security fix(fetcher): keep id and author fixed when refetching objects 2026-10-27 21:58:46 +04:00
release-2.11.1.skip Prepare 2.11.1 release 2026-10-26 22:02:51 +04:00
remove-dead-pleroma-api-controllers.skip chore: remove unrouted PleromaAPI token and password controllers 2026-10-26 12:44:32 +04:00
search-remote-fetch.security fix(search): fetch remote statuses only when resolving is allowed 2026-10-31 12:30:57 +04:00
shared-inbox.change perf(federation): always prefer the shared inbox 2026-10-27 20:45:32 +04:00
signature-freshness.security fix(federation): enforce the signature policy on incoming requests 2026-10-27 21:46:40 +04:00
stats-peers-from-instances.change fix(stats): leave our own host out of the peers 2026-10-29 10:42:54 +04:00
status-id-action-rate-limit.fix fix(mastodon_api): rate limit status actions per status id 2026-10-30 10:40:18 +04:00
user-fetch-display-url.fix fix(user): update the known user when fetched from a display URL 2026-10-27 21:58:46 +04:00
user-query-is-active.fix fix(user): use deactivated: false for familiar followers 2026-10-27 17:26:20 +04:00