bf2d6abaf2
Merge branch 'healthcheck-disabled-error' into 'develop'
...
TwitterAPI: Return proper error when healthcheck is disabled
See merge request pleroma/pleroma!3953
2023-11-14 09:41:26 +00:00
752bc168f6
Merge branch 'quotes-count' into 'develop'
...
Count and display post quotes
See merge request pleroma/pleroma!3956
2023-11-12 13:38:09 +00:00
9a063deacc
Count and display post quotes
2023-11-12 13:38:08 +00:00
5f19fbc5a9
Merge branch 'phoenix1.7' into 'develop'
...
Update to Phoenix 1.7
See merge request pleroma/pleroma!3900
2023-11-12 13:34:27 +00:00
5208bd8a95
Add changelog.
2023-11-12 15:00:51 +04:00
e23672d82f
Ensure benchee doesn't run unless we are executing benchmarks
2023-11-08 12:44:57 -05:00
0ab853cab8
Merge branch 'develop' into phoenix1.7
2023-11-08 09:18:08 -05:00
76c070fe86
ObjectValidators.BareUriTest: Replace calls of SafeText to BareUri
2023-11-08 02:17:50 +01:00
a0e08c6ec2
Merge branch 'develop' into phoenix1.7
2023-11-07 16:05:04 -05:00
bf426c53b4
Fix digest email processing, consolidate Oban queues
...
The email related jobs can all share a single Oban queue
2023-11-07 15:14:36 -05:00
aaf53d9d77
Bump package version for mergeback
2023-10-31 20:49:31 -04:00
ad45b06b3f
Merge branch 'stable' into 'release/2.6.0'
...
# Conflicts:
# .gitlab-ci.yml
# lib/pleroma/web/common_api/utils.ex
# lib/pleroma/web/xml.ex
# mix.exs
# test/pleroma/web/activity_pub/transmogrifier/emoji_react_handling_test.exs
# test/pleroma/web/common_api/utils_test.exs
# test/pleroma/web/mastodon_api/update_credentials_test.exs
# test/pleroma/web/xml_test.exs
2023-10-31 01:07:43 +00:00
a2a69709b5
Bump version to 2.6.0
2023-10-24 19:57:31 -04:00
b748efe66a
Fix mentioning punycode domains when using Markdown
2023-10-16 21:35:25 -04:00
3e7d2e29b3
Add changelog
2023-10-15 17:20:26 -04:00
2f6fc6a7ab
TwitterAPI: Return proper error when healthcheck is disabled
2023-09-24 23:32:17 +02:00
d244c9d298
Add changelog
2023-09-13 19:19:05 -04:00
535a5ecad0
CommonAPI: Prevent users from accessing media of other users
...
commit 1afde067b1
2023-09-03 11:19:13 +02:00
1afde067b1
CommonAPI: Prevent users from accessing media of other users
2023-09-03 10:41:37 +02:00
3c5ecca377
Skip changelog
2023-08-30 20:37:45 -04:00
1e685c8302
Merge branch 'csp-flash' into 'develop'
...
allow https: so that flash works across instances without need for media proxy
See merge request pleroma/pleroma!3879
2023-08-16 13:37:49 +00:00
b729a8b140
Merge branch 'fix-dockerfile-perms' into 'develop'
...
Fix config ownership in dockerfile to pass restriction test
See merge request pleroma/pleroma!3931
2023-08-10 00:42:29 +00:00
c298e0165c
Fix config ownership in dockerfile to pass restriction test
2023-08-08 19:07:48 +02:00
48b1e9bdc7
Completely disable xml entity resolution
2023-08-05 14:17:04 +02:00
17c336de66
Merge branch 'docs/gentoo-otp-intro' into 'develop'
...
gentoo_otp_en.md: Indicate which install method it covers
See merge request pleroma/pleroma!3928
2023-08-05 11:04:32 +00:00
4099ddb3dc
Mergeback release 2.5.4
2023-08-05 08:58:05 +02:00
b631180b38
Release 2.5.4
2023-08-05 08:27:42 +02:00
cc848b78dc
Document and test that XXE processing is disabled
...
https://vuln.be/post/xxe-in-erlang-and-elixir/
2023-08-05 08:23:04 +02:00
6d48b0f1a9
Document and test that XXE processing is disabled
...
https://vuln.be/post/xxe-in-erlang-and-elixir/
2023-08-05 08:14:27 +02:00
0e321698d2
gentoo_otp_en.md: Indicate which install method it covers
2023-08-04 17:11:20 +02:00
9f0ad901ed
changelog: Entry for config permissions restrictions
...
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3135
2023-08-04 09:50:28 +02:00
22df32b3f5
changelog: Entry for config permissions restrictions
...
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3135
2023-08-04 09:49:53 +02:00
2c79509453
Resolve information disclosure vulnerability through emoji pack archive download endpoint
...
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.
The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.
Reported by: graf@poast.org
2023-08-04 08:40:27 +02:00
18a0c923d0
Resolve information disclosure vulnerability through emoji pack archive download endpoint
...
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.
The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.
Reported by: graf@poast.org
2023-08-04 08:39:55 +02:00
819fccb7d1
Merge branch 'tusooa/3154-attachment-type-check' into 'develop'
...
Restrict attachments to only uploaded files only
Closes #3154
See merge request pleroma/pleroma!3923
2023-08-03 10:01:32 +00:00
11ce81d4af
add changelog entry
2023-07-28 18:49:05 +05:00
ea4225a646
Restrict attachments to only uploaded files only
2023-07-18 18:39:59 -04:00
93ad16cca0
Merge branch '2023-06-deps-update' into 'develop'
...
2023-06 deps update + de-override plug
See merge request pleroma/pleroma!3911
2023-07-17 20:37:47 +00:00
0d914e17be
Add changelog
2023-07-07 06:58:32 -04:00
7da6a82dbd
Merge branch 'deprecate-scrobbles' into 'develop'
...
Deprecate audio scrobbling
See merge request pleroma/pleroma!3919
2023-07-04 02:46:10 +00:00
0c3709173f
docs: Fix broken links
2023-07-04 04:23:48 +02:00
53f4d6f238
Merge branch 'fix/pipeline-triggers' into 'develop'
...
CI: Fix pipeline tokens & exit status
See merge request pleroma/pleroma!3918
2023-07-04 02:04:24 +00:00
3d79ceb23a
Deprecate audio scrobbling
2023-07-04 03:40:11 +02:00
8c3363a5e7
CI: Use CI_JOB_TOKEN for cross-repo pipeline triggers
2023-07-04 03:25:37 +02:00
6fbbf80800
Merge branch 'gentoo_otp' into 'develop'
...
Packaged installation guide for gentoo
See merge request pleroma/pleroma!3906
2023-07-03 21:04:23 +00:00
2b9cd25cf4
Merge branch 'tusooa/media-altdomain' into 'develop'
...
Add instructions to serve media on another domain
See merge request pleroma/pleroma!3892
2023-07-02 21:30:16 +00:00
0262916978
Merge branch 'testfix/system-config-use' into 'develop'
...
release_runtime_provider_test: Explicitely use non-existant config file
See merge request pleroma/pleroma!3910
2023-07-02 21:28:15 +00:00
a31a4c522f
Merge branch 'tusooa/3131-handle-report-from-deactivated-user' into 'develop'
...
Fix handling report from a deactivated user
Closes #3131
See merge request pleroma/pleroma!3915
2023-07-02 21:27:15 +00:00
379590d438
Merge branch 'tusooa/3142-featured-collection-shouldnt-break-user-fetch' into 'develop'
...
Fix user fetch completely broken if featured collection is not in a supported form
See merge request pleroma/pleroma!3914
2023-07-02 21:25:45 +00:00
6e4de2383f
Fix handling report from a deactivated user
2023-07-02 11:15:34 -04:00
Haelwenn