moon
/
honkoma
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
15,125 Commits 2 Branches 0 Tags 201 MiB
Commit Graph

15125 Commits

Author SHA1 Message Date
Cat pony Black c298e0165c Fix config ownership in dockerfile to pass restriction test 2023-08-08 19:07:48 +02:00
Haelwenn d0f7a5c4f5 Merge branch 'mergeback/2.5.4' into 'develop' 
Mergeback: 2.5.4

See merge request pleroma/pleroma!3930
 2023-08-05 08:13:03 +00:00
Haelwenn (lanodan) Monnier 4099ddb3dc Mergeback release 2.5.4 2023-08-05 08:58:05 +02:00
Mark Felder 6d48b0f1a9 Document and test that XXE processing is disabled 
https://vuln.be/post/xxe-in-erlang-and-elixir/
 2023-08-05 08:14:27 +02:00
FloatingGhost 307692cee8 Add unit test for external entity loading 2023-08-05 08:14:27 +02:00
Mae ca0859b90f Prevent XML parser from loading external entities 2023-08-04 22:35:13 -04:00
Haelwenn 1062185ba0 Merge branch 'mergeback/2.5.3' into 'develop' 
Mergeback: 2.5.3

Closes #3135

See merge request pleroma/pleroma!3927
 2023-08-04 09:38:01 +00:00
Haelwenn (lanodan) Monnier 6a0fd77c48 Release 2.5.53 2023-08-04 09:50:28 +02:00
Haelwenn (lanodan) Monnier 65ef8f19c5 release_runtime_provider_test: chmod config for hardened permissions 
Git doesn't manages file permissions precisely enough for us.
 2023-08-04 09:50:28 +02:00
Haelwenn (lanodan) Monnier 9f0ad901ed changelog: Entry for config permissions restrictions 
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3135
 2023-08-04 09:50:28 +02:00
Haelwenn (lanodan) Monnier 69caedc591 instance gen: Reduce permissions of pleroma directories and config files 2023-08-04 09:50:28 +02:00
Haelwenn (lanodan) Monnier 8cc8100120 Config: Restrict permissions of OTP config file 2023-08-04 09:50:28 +02:00
Mark Felder 2c79509453 Resolve information disclosure vulnerability through emoji pack archive download endpoint 
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.

The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.

Reported by: graf@poast.org
 2023-08-04 08:40:27 +02:00
Haelwenn 819fccb7d1 Merge branch 'tusooa/3154-attachment-type-check' into 'develop' 
Restrict attachments to only uploaded files only

Closes #3154

See merge request pleroma/pleroma!3923
 2023-08-03 10:01:32 +00:00
tusooa b08cbe76f1 Merge branch 'fix/2927-disallow-unauthenticated-access' into 'develop' 
/api/v1/statuses/:id/context: filter context activities using Visibility.visible_for_user?/2

See merge request pleroma/pleroma!3801
 2023-07-28 15:05:46 +00:00
faried nawaz 11ce81d4af add changelog entry 2023-07-28 18:49:05 +05:00
Faried Nawaz e5e76ec445 cleaner ecto query to handle restrict_unauthenticated for activities 
This fix is for this case:

  config :pleroma, :restrict_unauthenticated,
    activities: %{local: true, remote: true}
 2023-07-28 18:45:59 +05:00
faried nawaz dc4de79d43 status context: perform visibility check on activities around a status 
issue #2927
 2023-07-28 18:45:59 +05:00
tusooa ea4225a646
Restrict attachments to only uploaded files only 2023-07-18 18:39:59 -04:00
Haelwenn 93ad16cca0 Merge branch '2023-06-deps-update' into 'develop' 
2023-06 deps update + de-override plug

See merge request pleroma/pleroma!3911
 2023-07-17 20:37:47 +00:00
Haelwenn e38207162b Merge branch 'tusooa/2775-emoji-policy' into 'develop' 
EmojiPolicy

Closes #2775

See merge request pleroma/pleroma!3842
 2023-07-07 16:27:30 +00:00
tusooa 1459d64508
Make regex-to-string descriptor reusable 2023-07-07 07:09:35 -04:00
tusooa ba3aa4f86d
Fix edge cases 2023-07-07 06:58:32 -04:00
tusooa 0d914e17be
Add changelog 2023-07-07 06:58:32 -04:00
tusooa d670dbdbd3
Test that unicode emoji reactions are not affected 2023-07-07 06:58:32 -04:00
tusooa ef8a6c539a
Make EmojiPolicy aware of custom emoji reactions 2023-07-07 06:58:31 -04:00
tusooa 20d193c91d
Improve config examples for EmojiPolicy 2023-07-07 06:58:31 -04:00
tusooa 18a8378beb
Update config cheatsheet 2023-07-07 06:58:31 -04:00
tusooa f50422c380
Move emoji_policy.ex to the right place 2023-07-07 06:58:31 -04:00
tusooa 7eb8abf7bb
EmojiPolicy: Implement delist 2023-07-07 06:58:31 -04:00
tusooa 80ce6482f6
EmojiPolicy: implement remove by shortcode 2023-07-07 06:58:31 -04:00
tusooa 28ff828caa
Add emoji policy to remove emojis matching certain urls 
https://git.pleroma.social/pleroma/pleroma/-/issues/2775
 2023-07-07 06:58:22 -04:00
tusooa 7da6a82dbd Merge branch 'deprecate-scrobbles' into 'develop' 
Deprecate audio scrobbling

See merge request pleroma/pleroma!3919
 2023-07-04 02:46:10 +00:00
Haelwenn 624a5ccb2e Merge branch 'hotfix/docs-broken-links' into 'develop' 
docs: Fix broken links

See merge request pleroma/pleroma!3920
 2023-07-04 02:26:19 +00:00
Haelwenn (lanodan) Monnier 0c3709173f docs: Fix broken links 2023-07-04 04:23:48 +02:00
Haelwenn 53f4d6f238 Merge branch 'fix/pipeline-triggers' into 'develop' 
CI: Fix pipeline tokens & exit status

See merge request pleroma/pleroma!3918
 2023-07-04 02:04:24 +00:00
Haelwenn (lanodan) Monnier 3d79ceb23a Deprecate audio scrobbling 2023-07-04 03:40:11 +02:00
Haelwenn (lanodan) Monnier 8c3363a5e7 CI: Use CI_JOB_TOKEN for cross-repo pipeline triggers 2023-07-04 03:25:37 +02:00
Haelwenn (lanodan) Monnier 10249d1e42 CI: Let curl return non-0 on http failure code 
Otherwise it silently fails
 2023-07-04 03:24:13 +02:00
Haelwenn 6fbbf80800 Merge branch 'gentoo_otp' into 'develop' 
Packaged installation guide for gentoo

See merge request pleroma/pleroma!3906
 2023-07-03 21:04:23 +00:00
Haelwenn 2b9cd25cf4 Merge branch 'tusooa/media-altdomain' into 'develop' 
Add instructions to serve media on another domain

See merge request pleroma/pleroma!3892
 2023-07-02 21:30:16 +00:00
Haelwenn 0262916978 Merge branch 'testfix/system-config-use' into 'develop' 
release_runtime_provider_test: Explicitely use non-existant config file

See merge request pleroma/pleroma!3910
 2023-07-02 21:28:15 +00:00
Haelwenn a31a4c522f Merge branch 'tusooa/3131-handle-report-from-deactivated-user' into 'develop' 
Fix handling report from a deactivated user

Closes #3131

See merge request pleroma/pleroma!3915
 2023-07-02 21:27:15 +00:00
Haelwenn 379590d438 Merge branch 'tusooa/3142-featured-collection-shouldnt-break-user-fetch' into 'develop' 
Fix user fetch completely broken if featured collection is not in a supported form

See merge request pleroma/pleroma!3914
 2023-07-02 21:25:45 +00:00
Haelwenn 8cf231c0d1 Merge branch 'tusooa/3151-amd64-runner' into 'develop' 
Force the use of amd64 runners for jobs using ci-base

Closes #3151

See merge request pleroma/pleroma!3913
 2023-07-02 20:20:49 +00:00
tusooa 6e4de2383f
Fix handling report from a deactivated user 2023-07-02 11:15:34 -04:00
tusooa a1621839cc
Fix user fetch completely broken if featured collection is not in a supported form 2023-07-02 11:03:09 -04:00
tusooa 63b9f76782
Force the use of amd64 runners for jobs using ci-base 2023-07-01 23:25:04 -04:00
tusooa 48e490cd58 Merge branch 'bugfix/full-revert-media-host-validation' into 'develop' 
Merge Revert "Merge branch 'validate-host' into 'develop'"

Closes #3136

See merge request pleroma/pleroma!3909
 2023-07-01 21:54:18 +00:00
Haelwenn (lanodan) Monnier bf2b4b9400 README.md: Update packaging state (GURU, AUR) 2023-06-27 21:13:02 +02:00