Lain Soykaf f1337d8159 fix(fetcher): keep id and author fixed when refetching objects ... refetch_object (used for poll updates) accepted whatever the remote served. A hostile server could swap in another object or move the post to another author. The refetch now goes to the stored id without redirects, and the returned id and actor must equal the stored ones. Based on Akkoma 9061d148b and fee57eb37.		2026-10-27 21:58:46 +04:00
..
actor-containment.security	fix(federation): reject actors that point at other hosts	2026-10-27 21:37:20 +04:00
ap-c2s-oauth-scopes.security	fix(activitypub): check OAuth scopes on C2S endpoints	2026-10-26 12:49:58 +04:00
attachment-zero-size.fix	test(status_view): cover attachments with zero dimensions	2026-10-27 17:27:41 +04:00
federation-reject-instances.security	fix(federation): do not deliver to instances rejected by SimplePolicy	2026-10-27 12:38:18 +04:00
fetch-id-containment.security	fix(fetcher): require fetched documents to have the fetched id	2026-10-27 21:58:41 +04:00
filter-regex-escape.fix	fix(filters): treat phrases as literal text in the regex	2026-10-27 12:36:09 +04:00
filter-whole-word.fix	fix(filters): honour whole_word	2026-10-27 12:50:04 +04:00
legacy-sequences.fix	Delete legacy Postgres sequences	2026-08-24 14:51:58 -07:00
mention-notify-access.security	fix(notifications): handle unknown users when filtering tagged mentions	2026-10-27 12:39:02 +04:00
notification-filter-nil-content.fix	fix(notifications): skip the filter check for objects without content	2026-10-27 12:53:21 +04:00
oauth-profile-scope.add	feat(oauth): support the profile scope	2026-10-26 12:29:51 +04:00
oauth-tokens-scopes.security	fix(oauth): require security scopes to list and revoke tokens	2026-10-26 12:28:04 +04:00
object-age-non-public.security	test(mrf): cover ObjectAgePolicy with private, direct and unlisted posts	2026-10-27 12:35:16 +04:00
rate-limiter-test-flake.skip	test(rate_limiter): use windows that cannot expire during the test	2026-10-27 16:10:14 +04:00
refetch-containment.security	fix(fetcher): keep id and author fixed when refetching objects	2026-10-27 21:58:46 +04:00
release-2.11.1.skip	Prepare 2.11.1 release	2026-10-26 22:02:51 +04:00
remove-dead-pleroma-api-controllers.skip	chore: remove unrouted PleromaAPI token and password controllers	2026-10-26 12:44:32 +04:00
user-query-is-active.fix	fix(user): use deactivated: false for familiar followers	2026-10-27 17:26:20 +04:00