6d48b0f1a9
Document and test that XXE processing is disabled
...
https://vuln.be/post/xxe-in-erlang-and-elixir/
2023-08-05 08:14:27 +02:00
9f0ad901ed
changelog: Entry for config permissions restrictions
...
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3135
2023-08-04 09:50:28 +02:00
2c79509453
Resolve information disclosure vulnerability through emoji pack archive download endpoint
...
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.
The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.
Reported by: graf@poast.org
2023-08-04 08:40:27 +02:00
819fccb7d1
Merge branch 'tusooa/3154-attachment-type-check' into 'develop'
...
Restrict attachments to only uploaded files only
Closes #3154
See merge request pleroma/pleroma!3923
2023-08-03 10:01:32 +00:00
11ce81d4af
add changelog entry
2023-07-28 18:49:05 +05:00
ea4225a646
Restrict attachments to only uploaded files only
2023-07-18 18:39:59 -04:00
93ad16cca0
Merge branch '2023-06-deps-update' into 'develop'
...
2023-06 deps update + de-override plug
See merge request pleroma/pleroma!3911
2023-07-17 20:37:47 +00:00
0d914e17be
Add changelog
2023-07-07 06:58:32 -04:00
7da6a82dbd
Merge branch 'deprecate-scrobbles' into 'develop'
...
Deprecate audio scrobbling
See merge request pleroma/pleroma!3919
2023-07-04 02:46:10 +00:00
0c3709173f
docs: Fix broken links
2023-07-04 04:23:48 +02:00
53f4d6f238
Merge branch 'fix/pipeline-triggers' into 'develop'
...
CI: Fix pipeline tokens & exit status
See merge request pleroma/pleroma!3918
2023-07-04 02:04:24 +00:00
3d79ceb23a
Deprecate audio scrobbling
2023-07-04 03:40:11 +02:00
8c3363a5e7
CI: Use CI_JOB_TOKEN for cross-repo pipeline triggers
2023-07-04 03:25:37 +02:00
6fbbf80800
Merge branch 'gentoo_otp' into 'develop'
...
Packaged installation guide for gentoo
See merge request pleroma/pleroma!3906
2023-07-03 21:04:23 +00:00
2b9cd25cf4
Merge branch 'tusooa/media-altdomain' into 'develop'
...
Add instructions to serve media on another domain
See merge request pleroma/pleroma!3892
2023-07-02 21:30:16 +00:00
0262916978
Merge branch 'testfix/system-config-use' into 'develop'
...
release_runtime_provider_test: Explicitely use non-existant config file
See merge request pleroma/pleroma!3910
2023-07-02 21:28:15 +00:00
a31a4c522f
Merge branch 'tusooa/3131-handle-report-from-deactivated-user' into 'develop'
...
Fix handling report from a deactivated user
Closes #3131
See merge request pleroma/pleroma!3915
2023-07-02 21:27:15 +00:00
379590d438
Merge branch 'tusooa/3142-featured-collection-shouldnt-break-user-fetch' into 'develop'
...
Fix user fetch completely broken if featured collection is not in a supported form
See merge request pleroma/pleroma!3914
2023-07-02 21:25:45 +00:00
6e4de2383f
Fix handling report from a deactivated user
2023-07-02 11:15:34 -04:00
a1621839cc
Fix user fetch completely broken if featured collection is not in a supported form
2023-07-02 11:03:09 -04:00
63b9f76782
Force the use of amd64 runners for jobs using ci-base
2023-07-01 23:25:04 -04:00
48e490cd58
Merge branch 'bugfix/full-revert-media-host-validation' into 'develop'
...
Merge Revert "Merge branch 'validate-host' into 'develop'"
Closes #3136
See merge request pleroma/pleroma!3909
2023-07-01 21:54:18 +00:00
ae0ca49451
Merge branch 'tusooa/3119-bio-update' into 'develop'
...
Show more informative errors when profile exceeds char limits
Closes #3119
See merge request pleroma/pleroma!3886
2023-06-27 18:49:43 +00:00
aa4c4ab2a0
mix: 2023-06 deps update
...
this fixes compatibility with Erlang OTP 26
Related: https://git.pleroma.social/pleroma/pleroma/-/issues/2913
2023-06-27 02:38:31 +02:00
8bc51288be
release_runtime_provider_test: Explicitely use non-existant config file
2023-06-27 00:20:29 +02:00
dd9f8150fc
Merge Revert "Merge branch 'validate-host' into 'develop'"
...
This reverts commit d998a114e2da6b4003ac
2023-06-22 21:28:25 +02:00
994bfc4c09
Add changelog entry
2023-06-21 23:13:16 -06:00
937fa36ec4
changelog.d/gentoo_otp.skip: Doc-only MR
2023-06-13 16:05:37 +02:00
a663b73634
Add no_new_privs to OpenRC service files
2023-06-13 12:47:02 +02:00
fdb5bec431
Merge branch 'unused_indexes' into 'develop'
...
Remove unused indexes
See merge request pleroma/pleroma!3874
2023-06-11 19:48:23 +00:00
4e6ea7cc91
Merge branch 'tusooa/3054-banned-delete' into 'develop'
...
Fix deleting banned users' statuses
See merge request pleroma/pleroma!3889
2023-06-11 13:17:12 +00:00
55dd8ef1c7
Merge branch 'develop' of git.pleroma.social:pleroma/pleroma into pleroma-double_mentions
2023-06-11 16:31:20 +04:00
10dfa107d5
Update changelog
2023-06-11 16:22:03 +04:00
16313af7eb
Merge branch 'fix/metadata-tags' into 'develop'
...
static frontend: fix meta tags
See merge request pleroma/pleroma!3885
2023-06-11 11:57:16 +00:00
1f4618d64b
Merge branch 'cleanup/ostatus-user-upgrade' into 'develop'
...
Cleanup OStatus-era user upgrades and ap_enabled indicator
See merge request pleroma/pleroma!3880
2023-06-11 11:13:57 +00:00
75900f21f0
Merge branch 'revert-mediaproxy-host-validation' into 'develop'
...
Revert MediaProxy Host header validation
See merge request pleroma/pleroma!3902
2023-06-11 11:10:51 +00:00
1db29f734f
Merge branch 'fep-fffd-url' into 'develop'
...
CommonFields: Use BareUri for :url
Closes #3121
See merge request pleroma/pleroma!3884
2023-06-11 11:02:39 +00:00
b762a7503c
Merge branch 'distro-docs-elixir-1.11' into 'develop'
...
installation/debian_based_*: Elixir 1.11 means Debian 12+ and Ubuntu 22.04+
See merge request pleroma/pleroma!3898
2023-06-11 10:42:22 +00:00
1ca1b4b32f
changelog.d
2023-06-07 09:25:57 -04:00
fadcd7f1a9
Revert MediaProxy Host header validation
...
Something is going wrong here even though the tests are correct.
2023-06-07 09:19:22 -04:00
40d40d67a3
Add changelog.
2023-06-02 17:09:58 +04:00
313e68c180
mix: bump gettext to ~0.20
...
Includes https://github.com/elixir-gettext/gettext/pull/304 in 0.20.0+
Includes https://github.com/elixir-gettext/expo/issues/91 in 0.22+ via expo 0.2.0+
2023-06-02 03:06:32 +02:00
46c799f528
Use Phoenix.ConnTest.redirected_to/2
2023-05-31 09:54:37 -04:00
737e45c102
installation/debian_based_jp: Elixir 1.11 means Debian 12+ and Ubuntu 22.04+
...
I checked for what each part of the debian&ubuntu sentences meant with the
help of Jisho.org, should be safe but it did make me notice that this guide
hasn't been updated in years
2023-05-31 08:32:58 +02:00
d998a114e2
Merge branch 'validate-host' into 'develop'
...
Validate Host header for MediaProxy and Uploads
See merge request pleroma/pleroma!3896
2023-05-31 00:50:01 +00:00
b3c3bd99c3
Switch from serving a 400 to a 302
2023-05-30 16:56:09 -04:00
9caa0b0be1
Add OnlyMedia Upload Filter to simplify restricting uploads to audio, image, and video types
2023-05-29 15:49:04 -04:00
84974efe4c
Host header validation is now required for MediaProxy and Uploads
2023-05-29 14:17:27 -04:00
a1af122499
changelog entry
2023-05-29 02:52:49 +05:00
869f0d24a6
Merge branch 'release/2.5.2' into mergeback/2.5.2
2023-05-26 23:47:50 +02:00
Mark Felder