moon
/
spc-pleroma
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
15,791 Commits 2 Branches 0 Tags 208 MiB
Commit Graph

231 Commits

Author SHA1 Message Date
Mark Felder d9fe41a301 More deprecation fixes 2023-12-20 16:47:58 -05:00
Mark Felder 3c80c86437 Chase deprecations/warnings for Elixir 1.15 2023-12-20 20:17:25 +00:00
Mark Felder bf57fd82bb Clarify location of test.secret.exs file 2023-12-20 14:12:06 -05:00
Mark Felder f43f33e307 Return a 400 from a bad delivery attempt to the inbox 
This stops the backend from generating 500 errors from these events.
 2023-12-19 13:56:17 -05:00
Mark Felder e2066994b1 Fix Web Push notification delivery 
Finch does not automatically append header content-type: octet-stream for binary payloads.
 2023-12-19 10:56:55 -05:00
Lain Soykaf 77bb1bb6c8 Actually write changelog 2023-12-16 21:41:28 +04:00
Lain Soykaf a0f70cf7d0 Add changelog 2023-12-16 20:40:51 +04:00
tusooa f5559f3aff
Skip changelog for 2.6.1 mergeback 2023-12-15 19:45:23 -05:00
tusooa 453cb6a388
Merge remote-tracking branch 'upstream/stable' into mergeback/2.6.1 2023-12-15 19:43:07 -05:00
Yonle cb1b52d980 ap userview: add outbox field. 
Signed-off-by: Yonle <yonle@lecturify.net>
 2023-12-15 09:55:06 +04:00
tusooa ad6a6aa07b
Bump version to 2.6.1 2023-12-14 20:14:41 -05:00
Haelwenn (lanodan) Monnier b1ea63b4c6
changelog.d/system-cflags.fix: New entry 2023-12-14 20:13:25 -05:00
Haelwenn (lanodan) Monnier 35090f6eac
TwitterAPI: Return proper error when healthcheck is disabled 2023-12-14 20:11:01 -05:00
Haelwenn (lanodan) Monnier 1b22f13488
docs: Put a max version on erlang and elixir 
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3194
 2023-12-14 07:29:54 -05:00
Henry Jameson e635ee8b39
changelog 2023-12-14 07:28:52 -05:00
Lain Soykaf 40fa1099bf StatusViewTest: Fix tests. 2023-12-13 11:19:08 +04:00
lain 29d202e1df Merge branch 'add-opengraph-rich-media-proxy' into 'develop' 
Add media proxy to opengraph rich media cards

See merge request pleroma/pleroma!3997
 2023-12-13 06:23:16 +00:00
Alexander Tumin e7af2addd8 Add media proxy to opengraph rich media cards 2023-12-12 18:32:02 +03:00
Lain Soykaf 8da1fd329d Merge branch 'develop' of git.pleroma.social:pleroma/pleroma into no-async-clear-config 2023-12-12 12:29:22 +04:00
Lain Soykaf 7371e72e6c Dockerfile: Use platform libvips. 2023-12-12 11:36:34 +04:00
Lain Soykaf 18ab36d70c Merge branch 'develop' of git.pleroma.social:pleroma/pleroma into no-async-clear-config 2023-12-12 10:55:19 +04:00
lain 41c02b3d16 Merge branch 'authorize-interaction' into 'develop' 
Support /authorize-interaction route used by Mastodon

See merge request pleroma/pleroma!3957
 2023-12-11 09:31:18 +00:00
Lain Soykaf 7cf65cfeea Changelog 2023-12-11 12:48:53 +04:00
lain e7974afd37 Merge branch 'optimistic-inbox' into 'develop' 
Optimistic Inbox

See merge request pleroma/pleroma!3989
 2023-12-11 07:32:42 +00:00
Lain Soykaf 221f18dc33 Tests: Don't run tests that use clear_config asynchronously. 2023-12-10 16:27:23 +04:00
lain a7f82ff82e Merge branch 'scrubbers-html4-GtS' into 'develop' 
scrubbers/default: Add more formatting elements from HTML4 / GoToSocial

See merge request pleroma/pleroma!3979
 2023-12-10 12:18:22 +00:00
feld a67fc30d81 Merge branch 'kphrx-develop-patch-87655' into 'develop' 
Remove checking ImageMagick's commands for AnalyzeMetadata filter

See merge request pleroma/pleroma!3987
 2023-12-09 14:08:13 +00:00
Mark Felder 1b5964979f Optimistic Inbox 2023-12-08 18:13:43 -05:00
Mark Felder 003d3312fd Permit the index creation to run concurrently 2023-12-08 15:48:00 -05:00
kPherox 0818a9136d
add changelog 2023-12-07 20:33:23 +09:00
Lain Soykaf 6a191a91ab Merge branch 'develop' of git.pleroma.social:pleroma/pleroma into last_status_at 2023-12-07 11:18:39 +04:00
lain 2656199dc7 Merge branch 'more-test-fixes' into 'develop' 
More test fixes

See merge request pleroma/pleroma!3984
 2023-12-07 05:26:06 +00:00
Mark Felder 1ad0d94d6f Change set_reachable/1 to an upsert 2023-12-06 15:50:00 -05:00
Lain Soykaf 30084b7332 Add changelog. 2023-11-30 09:55:04 +04:00
HJ 6a6a631c81 Merge branch 'neetzsche/add_url_to_scrobbles' into 'develop' 
Add optional URL value for scrobbles

See merge request pleroma/pleroma!3977
 2023-11-29 15:59:19 +00:00
lain bc7fcc2dba Merge branch 'vips' into 'develop' 
Docs: Remove rust references

See merge request pleroma/pleroma!3983
 2023-11-29 15:43:09 +00:00
Lain Soykaf cd6adef471 Add changelog 2023-11-29 19:42:40 +04:00
lain 1955b3c557 Merge branch 'vips' into 'develop' 
Replace ImageMagick with Vips

See merge request pleroma/pleroma!3771
 2023-11-29 06:03:37 +00:00
lain 35774d44b2 Merge branch 'generate-unset-user-keys-migration' into 'develop' 
Fix GenerateUnsetUserKeys migration

See merge request pleroma/pleroma!3976
 2023-11-28 12:34:32 +00:00
Lain Soykaf 10525ac7f8 Docs: Remove rust references 2023-11-28 15:21:34 +04:00
Lain Soykaf da26964d2b Changelog: Adjust blurhash change 2023-11-28 12:39:22 +04:00
lain ef7bda61ad Merge branch 'promex' into 'develop' 
Switch to PromEx for prometheus metrics

See merge request pleroma/pleroma!3967
 2023-11-28 07:50:16 +00:00
lain 2b839197a9 Merge branch 'strip-fix' into 'develop' 
Strip fix

See merge request pleroma/pleroma!3981
 2023-11-27 15:30:13 +00:00
HJ 9c57f17af3 Merge branch 'frontends-docs' into 'develop' 
Front-ends management docs

See merge request pleroma/pleroma!3974
 2023-11-27 14:00:12 +00:00
NEETzsche 27df2c0ce6 Fix #strip_report_status_data 2023-11-27 17:56:43 +04:00
NEETzsche 510a7b64f1 Add optional URL value for scrobbles 2023-11-23 04:51:51 -07:00
HJ 4ebfc011fc Merge branch 'favicon' into 'develop' 
Make favicon configurable, embed favicon and manifest in server-generated meta

See merge request pleroma/pleroma!3963
 2023-11-19 08:52:37 +00:00
Henry Jameson 6513f54f73 changelog 2023-11-19 10:32:39 +02:00
feld 906b121a10 Merge branch 'develop' into 'vips' 
# Conflicts:
#   mix.exs
 2023-11-17 16:50:36 +00:00
Mark Felder 7988c62f6d Update changelogs 2023-11-17 11:21:46 -05:00
Haelwenn (lanodan) Monnier 06c58bce00 scrubbers/default: Add more formatting elements from HTML4 / GoToSocial 
Added: acronym, bdo, big, cite, dfn, ins, kbd, q, samp, s, tt, var, wbr
 2023-11-16 18:27:32 +01:00
Haelwenn (lanodan) Monnier 8ac7cc98c1 MastoAPI AccountView: Change last_status_at to be a date 
Changed in Mastodon 3.1.0 with: https://github.com/tootsuite/mastodon/pull/12966
 2023-11-16 15:52:01 +01:00
Haelwenn ca1b18ba2d Merge branch 'federation_status-access' into 'develop' 
router: Make /federation_status publicly available

See merge request pleroma/pleroma!3937
 2023-11-15 08:20:37 +00:00
Haelwenn 50c896169c Merge branch 'cflags' into 'develop' 
Make eblurhash and elixir-captcha use system CFLAGS

See merge request pleroma/pleroma!3943
 2023-11-15 08:19:29 +00:00
Henry Jameson a5aa8ea796 Add support for configuring a favicon and embed PWA manifest in server-generated-meta 2023-11-14 11:05:23 +01:00
Haelwenn (lanodan) Monnier 66f5ae0c5a router: Make /federation_status publicly available 2023-11-14 10:48:30 +01:00
Haelwenn (lanodan) Monnier 3831d31009 docs: Put a max version on erlang and elixir 
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3194
 2023-11-14 10:47:33 +01:00
Haelwenn (lanodan) Monnier 4472ab1fe9 changelog.d/system-cflags.fix: New entry 2023-11-14 10:45:00 +01:00
Haelwenn bf2d6abaf2 Merge branch 'healthcheck-disabled-error' into 'develop' 
TwitterAPI: Return proper error when healthcheck is disabled

See merge request pleroma/pleroma!3953
 2023-11-14 09:41:26 +00:00
Mark Felder ce42dac331 Change mediaproxy previews to use vips to generate thumbnails instead of ImageMagick 2023-11-13 15:41:39 -05:00
Mark Felder 1db10744f7 Use the "change" type 2023-11-13 15:35:00 -05:00
Mark Felder 66cb3294ed Switch to PromEx for prometheus metrics 
Recommending use of the separate HTTP server for exposing the metrics
and securing it externally on your firewall or reverse proxy. It will
listen on port 4021 by default.
 2023-11-13 15:34:59 -05:00
marcin mikołajczak fe776d8b33 Fix GenerateUnsetUserKeys migration 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-11-13 14:18:22 +01:00
lain 752bc168f6 Merge branch 'quotes-count' into 'develop' 
Count and display post quotes

See merge request pleroma/pleroma!3956
 2023-11-12 13:38:09 +00:00
marcin mikołajczak 9a063deacc Count and display post quotes 2023-11-12 13:38:08 +00:00
lain 5f19fbc5a9 Merge branch 'phoenix1.7' into 'develop' 
Update to Phoenix 1.7

See merge request pleroma/pleroma!3900
 2023-11-12 13:34:27 +00:00
Lain Soykaf 5208bd8a95 Add changelog. 2023-11-12 15:00:51 +04:00
Marcin Mikołajczak 1e9333a9aa Merge remote-tracking branch 'origin/develop' into instance-v2 2023-11-08 20:46:57 +01:00
Mark Felder e23672d82f Ensure benchee doesn't run unless we are executing benchmarks 2023-11-08 12:44:57 -05:00
Mark Felder 0ab853cab8 Merge branch 'develop' into phoenix1.7 2023-11-08 09:18:08 -05:00
Haelwenn (lanodan) Monnier 76c070fe86 ObjectValidators.BareUriTest: Replace calls of SafeText to BareUri 2023-11-08 02:17:50 +01:00
Mark Felder a0e08c6ec2 Merge branch 'develop' into phoenix1.7 2023-11-07 16:05:04 -05:00
Mark Felder bf426c53b4 Fix digest email processing, consolidate Oban queues 
The email related jobs can all share a single Oban queue
 2023-11-07 15:14:36 -05:00
marcin mikołajczak c62696c8e7 Support /authorize-interaction route used by Mastodon 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-11-02 13:47:23 +01:00
marcin mikołajczak 6b9a347353 update changelog 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-11-02 13:31:59 +01:00
tusooa aaf53d9d77
Bump package version for mergeback 2023-10-31 20:49:31 -04:00
tusooa ad45b06b3f Merge branch 'stable' into 'release/2.6.0' 
# Conflicts:
#   .gitlab-ci.yml
#   lib/pleroma/web/common_api/utils.ex
#   lib/pleroma/web/xml.ex
#   mix.exs
#   test/pleroma/web/activity_pub/transmogrifier/emoji_react_handling_test.exs
#   test/pleroma/web/common_api/utils_test.exs
#   test/pleroma/web/mastodon_api/update_credentials_test.exs
#   test/pleroma/web/xml_test.exs
 2023-10-31 01:07:43 +00:00
tusooa a2a69709b5
Bump version to 2.6.0 2023-10-24 19:57:31 -04:00
tusooa b748efe66a
Fix mentioning punycode domains when using Markdown 2023-10-16 21:35:25 -04:00
tusooa 3e7d2e29b3
Add changelog 2023-10-15 17:20:26 -04:00
Haelwenn (lanodan) Monnier 2f6fc6a7ab TwitterAPI: Return proper error when healthcheck is disabled 2023-09-24 23:32:17 +02:00
tusooa d244c9d298
Add changelog 2023-09-13 19:19:05 -04:00
Mint 535a5ecad0 CommonAPI: Prevent users from accessing media of other users 
commit 1afde067b1 upstream.
 2023-09-03 11:19:13 +02:00
Mint 1afde067b1 CommonAPI: Prevent users from accessing media of other users 2023-09-03 10:41:37 +02:00
tusooa 3c5ecca377
Skip changelog 2023-08-30 20:37:45 -04:00
Haelwenn 1e685c8302 Merge branch 'csp-flash' into 'develop' 
allow https: so that flash works across instances without need for media proxy

See merge request pleroma/pleroma!3879
 2023-08-16 13:37:49 +00:00
marcin mikołajczak 9effa24f30 Implement api/v2/instance route 
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
 2023-08-11 00:08:05 +02:00
tusooa b729a8b140 Merge branch 'fix-dockerfile-perms' into 'develop' 
Fix config ownership in dockerfile to pass restriction test

See merge request pleroma/pleroma!3931
 2023-08-10 00:42:29 +00:00
Cat pony Black c298e0165c Fix config ownership in dockerfile to pass restriction test 2023-08-08 19:07:48 +02:00
mae 48b1e9bdc7 Completely disable xml entity resolution 2023-08-05 14:17:04 +02:00
Haelwenn 17c336de66 Merge branch 'docs/gentoo-otp-intro' into 'develop' 
gentoo_otp_en.md: Indicate which install method it covers

See merge request pleroma/pleroma!3928
 2023-08-05 11:04:32 +00:00
Haelwenn (lanodan) Monnier 4099ddb3dc Mergeback release 2.5.4 2023-08-05 08:58:05 +02:00
Haelwenn (lanodan) Monnier b631180b38 Release 2.5.4 2023-08-05 08:27:42 +02:00
Mark Felder cc848b78dc Document and test that XXE processing is disabled 
https://vuln.be/post/xxe-in-erlang-and-elixir/
 2023-08-05 08:23:04 +02:00
Mark Felder 6d48b0f1a9 Document and test that XXE processing is disabled 
https://vuln.be/post/xxe-in-erlang-and-elixir/
 2023-08-05 08:14:27 +02:00
Haelwenn (lanodan) Monnier 0e321698d2 gentoo_otp_en.md: Indicate which install method it covers 2023-08-04 17:11:20 +02:00
Haelwenn (lanodan) Monnier 9f0ad901ed changelog: Entry for config permissions restrictions 
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3135
 2023-08-04 09:50:28 +02:00
Haelwenn (lanodan) Monnier 22df32b3f5 changelog: Entry for config permissions restrictions 
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3135
 2023-08-04 09:49:53 +02:00
Mark Felder 2c79509453 Resolve information disclosure vulnerability through emoji pack archive download endpoint 
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.

The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.

Reported by: graf@poast.org
 2023-08-04 08:40:27 +02:00
Mark Felder 18a0c923d0 Resolve information disclosure vulnerability through emoji pack archive download endpoint 
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.

The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.

Reported by: graf@poast.org
 2023-08-04 08:39:55 +02:00