Merge branch 'develop' into 'public-polls'

# Conflicts:
#   docs/development/API/differences_in_mastoapi_responses.md
This commit is contained in:
Haelwenn 2024-01-21 12:03:29 +00:00
commit ab3f03a04a
482 changed files with 4258 additions and 1373 deletions

View File

@ -1,11 +1,13 @@
image: git.pleroma.social:5050/pleroma/pleroma/ci-base
variables: &global_variables
# Only used for the release
ELIXIR_VER: 1.12.3
POSTGRES_DB: pleroma_test
POSTGRES_USER: postgres
POSTGRES_PASSWORD: postgres
DB_HOST: postgres
DB_PORT: 5432
DB_PORT: "5432"
MIX_ENV: test
workflow:
@ -26,6 +28,7 @@ cache: &global_cache_policy
stages:
- check-changelog
- build
- lint
- test
- benchmark
- deploy
@ -69,7 +72,7 @@ check-changelog:
tags:
- amd64
build:
build-1.12.3:
extends:
- .build_changes_policy
- .using-ci-base
@ -77,10 +80,20 @@ build:
script:
- mix compile --force
build-1.15.7-otp-25:
extends:
- .build_changes_policy
- .using-ci-base
stage: build
image: git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.15
allow_failure: true
script:
- mix compile --force
spec-build:
extends:
- .using-ci-base
stage: test
stage: build
rules:
- changes:
- ".gitlab-ci.yml"
@ -108,7 +121,7 @@ benchmark:
- mix ecto.migrate
- mix pleroma.load_testing
unit-testing:
unit-testing-1.12.3:
extends:
- .build_changes_policy
- .using-ci-base
@ -116,12 +129,11 @@ unit-testing:
cache: &testing_cache_policy
<<: *global_cache_policy
policy: pull
services:
services: &testing_services
- name: postgres:13-alpine
alias: postgres
command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
script:
script: &testing_script
- mix ecto.create
- mix ecto.migrate
- mix test --cover --preload-modules
@ -132,50 +144,39 @@ unit-testing:
coverage_format: cobertura
path: coverage.xml
unit-testing-erratic:
unit-testing-1.15.7-otp-25:
extends:
- .build_changes_policy
- .using-ci-base
stage: test
image: git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.15-otp25
allow_failure: true
cache: *testing_cache_policy
services: *testing_services
script: *testing_script
unit-testing-1.12-erratic:
extends:
- .build_changes_policy
- .using-ci-base
stage: test
retry: 2
allow_failure: true
cache: &testing_cache_policy
<<: *global_cache_policy
policy: pull
services:
- name: postgres:13-alpine
alias: postgres
command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
cache: *testing_cache_policy
services: *testing_services
script:
- mix ecto.create
- mix ecto.migrate
- mix test --only=erratic
# Removed to fix CI issue. In this early state it wasn't adding much value anyway.
# TODO Fix and reinstate federated testing
# federated-testing:
# stage: test
# cache: *testing_cache_policy
# services:
# - name: minibikini/postgres-with-rum:12
# alias: postgres
# command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
# script:
# - mix deps.get
# - mix ecto.create
# - mix ecto.migrate
# - epmd -daemon
# - mix test --trace --only federated
unit-testing-rum:
unit-testing-1.12-rum:
extends:
- .build_changes_policy
- .using-ci-base
stage: test
cache: *testing_cache_policy
services:
- name: minibikini/postgres-with-rum:12
- name: git.pleroma.social:5050/pleroma/pleroma/postgres-with-rum-13
alias: postgres
command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
variables:
@ -187,10 +188,10 @@ unit-testing-rum:
- "mix ecto.migrate --migrations-path priv/repo/optional_migrations/rum_indexing/"
- mix test --preload-modules
lint:
formatting-1.13:
extends: .build_changes_policy
image: &current_elixir elixir:1.12-alpine
stage: test
image: &formatting_elixir elixir:1.13-alpine
stage: lint
cache: *testing_cache_policy
before_script: &current_bfr_script
- apk update
@ -201,25 +202,38 @@ lint:
script:
- mix format --check-formatted
analysis:
extends:
- .build_changes_policy
- .using-ci-base
stage: test
cache: *testing_cache_policy
script:
- mix credo --strict --only=warnings,todo,fixme,consistency,readability
cycles:
cycles-1.13:
extends: .build_changes_policy
image: *current_elixir
stage: test
image: *formatting_elixir
stage: lint
cache: {}
before_script: *current_bfr_script
script:
- mix compile
- mix xref graph --format cycles --label compile | awk '{print $0} END{exit ($0 != "No cycles found")}'
analysis:
extends:
- .build_changes_policy
- .using-ci-base
stage: lint
cache: *testing_cache_policy
script:
- mix credo --strict --only=warnings,todo,fixme,consistency,readability
dialyzer:
extends:
- .build_changes_policy
- .using-ci-base
stage: lint
allow_failure: true
when: manual
cache: *testing_cache_policy
tags:
- feld
script:
- mix dialyzer
docs-deploy:
stage: deploy
cache: *testing_cache_policy
@ -294,7 +308,7 @@ stop_review_app:
amd64:
stage: release
image: elixir:1.11.4
image: elixir:$ELIXIR_VER
only: &release-only
- stable@pleroma/pleroma
- develop@pleroma/pleroma
@ -318,8 +332,9 @@ amd64:
- deps
variables: &release-variables
MIX_ENV: prod
VIX_COMPILATION_MODE: PLATFORM_PROVIDED_LIBVIPS
before_script: &before-release
- apt-get update && apt-get install -y cmake libmagic-dev
- apt-get update && apt-get install -y cmake libmagic-dev libvips-dev erlang-dev
- echo "import Config" > config/prod.secret.exs
- mix local.hex --force
- mix local.rebar --force
@ -334,13 +349,13 @@ amd64-musl:
stage: release
artifacts: *release-artifacts
only: *release-only
image: elixir:1.11.4-alpine
image: elixir:$ELIXIR_VER-alpine
tags:
- amd64
cache: *release-cache
variables: *release-variables
before_script: &before-release-musl
- apk add git build-base cmake file-dev openssl
- apk add git build-base cmake file-dev openssl vips-dev
- echo "import Config" > config/prod.secret.exs
- mix local.hex --force
- mix local.rebar --force
@ -352,7 +367,7 @@ arm:
only: *release-only
tags:
- arm32-specified
image: arm32v7/elixir:1.11.4
image: arm32v7/elixir:$ELIXIR_VER
cache: *release-cache
variables: *release-variables
before_script: *before-release
@ -364,7 +379,7 @@ arm-musl:
only: *release-only
tags:
- arm32-specified
image: arm32v7/elixir:1.11.4-alpine
image: arm32v7/elixir:$ELIXIR_VER-alpine
cache: *release-cache
variables: *release-variables
before_script: *before-release-musl
@ -376,7 +391,7 @@ arm64:
only: *release-only
tags:
- arm
image: arm64v8/elixir:1.11.4
image: arm64v8/elixir:$ELIXIR_VER
cache: *release-cache
variables: *release-variables
before_script: *before-release
@ -388,7 +403,7 @@ arm64-musl:
only: *release-only
tags:
- arm
image: arm64v8/elixir:1.11.4-alpine
image: arm64v8/elixir:$ELIXIR_VER-alpine
cache: *release-cache
variables: *release-variables
before_script: *before-release-musl

View File

@ -3,7 +3,7 @@
`<code>` can be anything, but we recommend using a more or less unique identifier to avoid collisions, such as the branch name.
`<type>` can be `add`, `remove`, `fix`, `security` or `skip`. `skip` is only used if there is no user-visible change in the MR (for example, only editing comments in the code). Otherwise, choose a type that corresponds to your change.
`<type>` can be `add`, `change`, `remove`, `fix`, `security` or `skip`. `skip` is only used if there is no user-visible change in the MR (for example, only editing comments in the code). Otherwise, choose a type that corresponds to your change.
In the file, write the changelog entry. For example, if an MR adds group functionality, we can create a file named `group.add` and write `Add group functionality` in it.

View File

@ -1,6 +1,6 @@
### Release checklist
* [ ] Bump version in `mix.exs`
* [ ] Compile a changelog
* [ ] Compile a changelog with the `tools/collect-changelog` script
* [ ] Create an MR with an announcement to pleroma.social
#### post-merge
* [ ] Tag the release on the merge commit

1
.rgignore Normal file
View File

@ -0,0 +1 @@
priv/static

View File

@ -4,24 +4,81 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
## Unreleased
## 2.6.1
### Changed
- - Document maximum supported version of Erlang & Elixir
### Added
- [docs] add frontends management documentation
### Fixed
- TwitterAPI: Return proper error when healthcheck is disabled
- Fix eblurhash and elixir-captcha not using system cflags
## 2.6.0
### Security
- Preload: Make generated JSON html-safe. It already was html safe because it only consists of config data that is base64 encoded, but this will keep it safe it that ever changes.
- CommonAPI: Prevent users from accessing media of other users by creating a status with reused attachment ID
- Disable XML entity resolution completely to fix a dos vulnerability
### Added
- Support for Image activities, namely from Hubzilla
- Add OAuth scope descriptions
- Allow lang attribute in status text
- OnlyMedia Upload Filter
- Implement MRF policy to reject or delist according to emojis
- (hardening) Add no_new_privs=yes to OpenRC service files
- Implement quotes
- Add unified streaming endpoint
### Fixed
- rel="me" was missing its cache
- MediaProxy responses now return a sandbox CSP header
- Filter context activities using Visibility.visible_for_user?
- UploadedMedia: Add missing disposition_type to Content-Disposition
- fix not being able to fetch flash file from remote instance
- Fix abnormal behaviour when refetching a poll
- Allow non-HTTP(s) URIs in "url" fields for compatibility with "FEP-fffd: Proxy Objects"
- Fix opengraph and twitter card meta tags
- ForceMentionsInContent: fix double mentions for Mastodon/Misskey posts
- OEmbed HTML tags are now filtered
- Restrict attachments to only uploaded files only
- Fix error 404 when deleting status of a banned user
- Fix config ownership in dockerfile to pass restriction test
- Fix user fetch completely broken if featured collection is not in a supported form
- Correctly handle the situation when a poll has both "anyOf" and "oneOf" but one of them being empty
- Fix handling report from a deactivated user
- Prevent using the .json format to bypass authorized fetch mode
- Fix mentioning punycode domains when using Markdown
- Show more informative errors when profile exceeds char limits
### Removed
- BREAKING: Support for passwords generated with `crypt(3)` (Gnu Social migration artifact)
- remove BBS/SSH feature, replaced by an external bridge.
- Remove a few unused indexes.
- Cleanup OStatus-era user upgrades and ap_enabled indicator
- Deprecate Pleroma's audio scrobbling
## 2.5.4
## Security
- Fix XML External Entity (XXE) loading vulnerability allowing to fetch arbitary files from the server's filesystem
- Fix XML External Entity (XXE) loading vulnerability allowing to fetch arbitrary files from the server's filesystem
## 2.5.3
### Security
- Emoji pack loader sanitizes pack names
- Reduced permissions of config files and directories, distros requiring greater permissions like group-read need to pre-create the directories
## 2.5.5
## Security
- Prevent users from accessing media of other users by creating a status with reused attachment ID
## 2.5.4
## Security
- Fix XML External Entity (XXE) loading vulnerability allowing to fetch arbitrary files from the server's filesystem
## 2.5.3
@ -61,7 +118,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
- Fix `block_from_stranger` setting
- Fix rel="me"
- Docker images will now run properly
- Fix inproper content being cached in report content
- Fix improper content being cached in report content
- Notification filter on object content will not operate on the ones that inherently have no content
- ZWNJ and double dots in links are parsed properly for Plain-text posts
- OTP releases will work on systems with a newer libcrypt
@ -727,7 +784,7 @@ switched to a new configuration mechanism, however it was not officially removed
- Rate limiter crashes when there is no explicitly specified ip in the config
- 500 errors when no `Accept` header is present if Static-FE is enabled
- Instance panel not being updated immediately due to wrong `Cache-Control` headers
- Statuses posted with BBCode/Markdown having unncessary newlines in Pleroma-FE
- Statuses posted with BBCode/Markdown having unnecessary newlines in Pleroma-FE
- OTP: Fix some settings not being migrated to in-database config properly
- No `Cache-Control` headers on attachment/media proxy requests
- Character limit enforcement being off by 1
@ -1047,10 +1104,10 @@ curl -Lo ./bin/pleroma_ctl 'https://git.pleroma.social/pleroma/pleroma/raw/devel
- Reverse Proxy limiting `max_body_length` was incorrectly defined and only checked `Content-Length` headers which may not be sufficient in some circumstances
### Added
- Expiring/ephemeral activites. All activities can have expires_at value set, which controls when they should be deleted automatically.
- Expiring/ephemeral activities. All activities can have expires_at value set, which controls when they should be deleted automatically.
- Mastodon API: in post_status, the expires_in parameter lets you set the number of seconds until an activity expires. It must be at least one hour.
- Mastodon API: all status JSON responses contain a `pleroma.expires_at` item which states when an activity will expire. The value is only shown to the user who created the activity. To everyone else it's empty.
- Configuration: `ActivityExpiration.enabled` controls whether expired activites will get deleted at the appropriate time. Enabled by default.
- Configuration: `ActivityExpiration.enabled` controls whether expired activities will get deleted at the appropriate time. Enabled by default.
- Conversations: Add Pleroma-specific conversation endpoints and status posting extensions. Run the `bump_all_conversations` task again to create the necessary data.
- MRF: Support for priming the mediaproxy cache (`Pleroma.Web.ActivityPub.MRF.MediaProxyWarmingPolicy`)
- MRF: Support for excluding specific domains from Transparency.

View File

@ -1,5 +1,5 @@
ARG ELIXIR_IMG=hexpm/elixir
ARG ELIXIR_VER=1.11.4
ARG ELIXIR_VER=1.12.3
ARG ERLANG_VER=24.2.1
ARG ALPINE_VER=3.17.0
@ -8,8 +8,9 @@ FROM ${ELIXIR_IMG}:${ELIXIR_VER}-erlang-${ERLANG_VER}-alpine-${ALPINE_VER} as bu
COPY . .
ENV MIX_ENV=prod
ENV VIX_COMPILATION_MODE=PLATFORM_PROVIDED_LIBVIPS
RUN apk add git gcc g++ musl-dev make cmake file-dev &&\
RUN apk add git gcc g++ musl-dev make cmake file-dev vips-dev &&\
echo "import Config" > config/prod.secret.exs &&\
mix local.hex --force &&\
mix local.rebar --force &&\
@ -37,7 +38,7 @@ ARG HOME=/opt/pleroma
ARG DATA=/var/lib/pleroma
RUN apk update &&\
apk add exiftool ffmpeg imagemagick libmagic ncurses postgresql-client &&\
apk add exiftool ffmpeg vips libmagic ncurses postgresql-client &&\
adduser --system --shell /bin/false --home ${HOME} pleroma &&\
mkdir -p ${DATA}/uploads &&\
mkdir -p ${DATA}/static &&\

View File

@ -3,8 +3,20 @@
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Mix.Tasks.Pleroma.Benchmark do
import Mix.Pleroma
@shortdoc "Benchmarks"
@moduledoc """
Benchmark tasks available:
adapters
render_timeline
search
tag
MIX_ENV=benchmark mix pleroma.benchmark adapters
"""
use Mix.Task
import Mix.Pleroma
def run(["search"]) do
start_pleroma()
@ -63,7 +75,7 @@ def run(["render_timeline", nickname | _] = args) do
Benchee.run(
%{
"Standart rendering" => fn activities ->
"Standard rendering" => fn activities ->
Pleroma.Web.MastodonAPI.StatusView.render("index.json", %{
activities: activities,
for: user,

View File

@ -1 +0,0 @@
MediaProxy responses now return a sandbox CSP header

View File

@ -1 +0,0 @@
Filter context activities using Visibility.visible_for_user?

View File

@ -1 +0,0 @@
Add OAuth scope descriptions

View File

@ -1 +0,0 @@
remove BBS/SSH feature, replaced by an external bridge.

View File

@ -1 +0,0 @@
UploadedMedia: Add missing disposition_type to Content-Disposition

View File

@ -1 +0,0 @@
Remove a few unused indexes.

View File

@ -1 +0,0 @@
fix not being able to fetch flash file from remote instance

View File

@ -1 +0,0 @@
Cleanup OStatus-era user upgrades and ap_enabled indicator

View File

@ -1 +0,0 @@
Allow lang attribute in status text

View File

@ -1 +0,0 @@
Fix abnormal behaviour when refetching a poll

View File

@ -1 +0,0 @@
Allow non-HTTP(s) URIs in "url" fields for compatibility with "FEP-fffd: Proxy Objects"

View File

@ -1 +0,0 @@
Fix opengraph and twitter card meta tags

View File

@ -1 +0,0 @@
ForceMentionsInContent: fix double mentions for Mastodon/Misskey posts

View File

@ -1 +0,0 @@
OEmbed HTML tags are now filtered

View File

@ -1 +0,0 @@
OnlyMedia Upload Filter

1
changelog.d/3900.change Normal file
View File

@ -0,0 +1 @@
Update to Phoenix 1.7

View File

@ -1 +0,0 @@
Preload: Make generated JSON html-safe. It already was html safe because it only consists of config data that is base64 encoded, but this will keep it safe it that ever changes.

1
changelog.d/3987.fix Normal file
View File

@ -0,0 +1 @@
Remove checking ImageMagick's commands for Pleroma.Upload.Filter.AnalyzeMetadata

View File

@ -0,0 +1 @@
Fix authentication check on account rendering when bio is defined

View File

@ -0,0 +1 @@
ap userview: add outbox field.

View File

@ -1 +0,0 @@
Fix XML External Entity (XXE) loading vulnerability allowing to fetch arbitary files from the server's filesystem

View File

@ -0,0 +1 @@
Fix #strip_report_status_data

View File

@ -1 +0,0 @@
Restrict attachments to only uploaded files only

View File

@ -0,0 +1 @@
Support /authorize-interaction route used by Mastodon

View File

@ -0,0 +1 @@
Invalid activities delivered to the inbox will be rejected with a 400 Bad Request

View File

@ -0,0 +1 @@
Replace eblurhash with rinpatch_blurhash. This also removes a dependency on ImageMagick.

View File

@ -0,0 +1 @@
ChatMessage: Tolerate attachment field set to an empty array

View File

@ -1 +0,0 @@
CommonAPI: Prevent users from accessing media of other users by creating a status with reused attachment ID

View File

@ -1 +0,0 @@
Fix error 404 when deleting status of a banned user

View File

@ -1 +0,0 @@
Deprecate Pleroma's audio scrobbling

View File

@ -0,0 +1 @@

View File

@ -0,0 +1 @@
Fix the processing of email digest jobs.

View File

@ -1 +0,0 @@
Disable XML entity resolution completely to fix a dos vulnerability

View File

@ -1 +0,0 @@
- Fix config ownership in dockerfile to pass restriction test

View File

@ -0,0 +1 @@
- Document maximum supported version of Erlang & Elixir

View File

@ -0,0 +1 @@
When downloading remote emojis packs, account for pagination

View File

@ -1 +0,0 @@
Emoji pack loader sanitizes pack names

View File

@ -1 +0,0 @@
Implement MRF policy to reject or delist according to emojis

View File

@ -0,0 +1 @@
Make remote emoji packs API use specifically the V1 URL. Akkoma does not understand it without V1, and it works either way with normal pleroma, so no reason to not do this

1
changelog.d/favicon.add Normal file
View File

@ -0,0 +1 @@
Add support for configuring favicon, embed favicon and PWA manifest in server-generated meta

View File

@ -1 +0,0 @@
Fix user fetch completely broken if featured collection is not in a supported form

View File

@ -0,0 +1 @@
- Make `/api/v1/pleroma/federation_status` publicly available

View File

@ -0,0 +1 @@
Removed support for multiple federator modules as we only support ActivityPub

View File

@ -0,0 +1 @@
Following HTTP Redirects when the HTTP Adapter is Finch

View File

@ -1 +0,0 @@
Correctly handle the situation when a poll has both "anyOf" and "oneOf" but one of them being empty

View File

@ -0,0 +1 @@
[docs] add frontends management documentation

View File

@ -0,0 +1 @@
Implement group actors

View File

@ -1 +0,0 @@
Fix handling report from a deactivated user

View File

@ -0,0 +1 @@
Remote object fetch failures will prevent the object fetch job from retrying if the object request returns 401, 403, 404, 410, or exceeds the maximum thread depth.

View File

@ -0,0 +1 @@
TwitterAPI: Return proper error when healthcheck is disabled

View File

@ -0,0 +1 @@
Implement /api/v2/instance route

View File

@ -0,0 +1 @@
- Change AccountView `last_status_at` from a datetime to a date (as done in Mastodon 3.1.0)

View File

@ -0,0 +1 @@
Use correct domain for fqn and InstanceView

View File

@ -0,0 +1 @@
Add meilisearch, make search engines pluggable

View File

@ -0,0 +1 @@

View File

@ -0,0 +1 @@
MRF: Log sensible error for subdomains_regex

View File

@ -0,0 +1 @@
MRF.StealEmojiPolicy: Properly add fallback extension to filenames missing one

View File

@ -0,0 +1 @@
Support objects with a null contentMap (firefish)

View File

@ -1 +0,0 @@
(hardening) Add no_new_privs=yes to OpenRC service files

View File

@ -0,0 +1 @@
Add media proxy to opengraph rich media cards

View File

@ -0,0 +1 @@
Optimistic Inbox reduces the processing overhead of incoming activities without instantly verifiable signatures.

1
changelog.d/otp26.add Normal file
View File

@ -0,0 +1 @@
Support for Erlang OTP 26

View File

@ -1 +0,0 @@
- Reduced permissions of config files and directories, distros requiring greater permissions like group-read need to pre-create the directories

View File

@ -1 +0,0 @@
Prevent using the .json format to bypass authorized fetch mode

View File

@ -0,0 +1 @@
- Prioritize mentioned recipients (i.e., those that are not just followers) when federating.

View File

@ -0,0 +1 @@
Change the prometheus library to PromEx.

View File

@ -0,0 +1 @@
Activity publishing failures will prevent the job from retrying if the publishing request returns a 403 or 410

View File

@ -0,0 +1 @@
Publisher errors will now emit logs indicating the inbox that was not available for delivery.

View File

@ -1 +0,0 @@
Fix mentioning punycode domains when using Markdown

View File

@ -0,0 +1 @@
MediaProxy Preview failures prevented when encountering certain video files

View File

@ -1 +0,0 @@
Implement quotes

View File

@ -0,0 +1 @@
Reduce the reachability timestamp update to a single upsert query

View File

@ -0,0 +1 @@
Adds the capability to add a URL to a scrobble (optional field)

View File

@ -0,0 +1 @@
- scrubbers/default: Add more formatting elements from HTML4 / GoToSocial (acronym, bdo, big, cite, dfn, ins, kbd, q, samp, s, tt, var, wbr)

Some files were not shown because too many files have changed in this diff Show More