d23804f191
Use the Pleroma.Config alias
2020-07-09 10:53:51 -05:00
49c4e24953
Merge branch 'develop' into fix/csp-for-captcha
2020-07-09 09:08:59 -05:00
da4029391d
IO list, not concatenation
2020-07-06 11:28:08 -05:00
65843d92c4
Simplify the logic
2020-07-06 10:59:41 -05:00
158c26d7dd
StaticFE Plug: Use phoenix helper to get the requested format.
2020-07-06 12:11:10 +02:00
af612bd006
Ensure all CSP parameters for remote hosts have a scheme
2020-07-05 10:11:43 -05:00
e9a28078ad
Rename function and clarify that CSP is only strict with MediaProxy enabled
2020-07-03 17:18:22 -05:00
eaa59daa4c
Add Captcha endpoint to CSP headers when MediaProxy is enabled.
...
Our CSP rules are lax when MediaProxy enabled, but lenient otherwise.
This fixes broken captcha on instances not using MediaProxy.
2020-07-03 17:06:20 -05:00
a5bbfa21a1
StaticFE: Prioritize json in requests.
2020-06-26 16:27:39 +02:00
2731ea1334
Change references from "deleted_urls" to "banned_urls" as nothing is handled via media deletions anymore; all actions are manual operations by an admin to ban the url
2020-06-17 13:13:55 -05:00
2e8a236cef
fix invalidates media url's
2020-06-14 21:02:57 +03:00
7f7a1a4676
Check for media proxy base_url, not Upload base_url
2020-06-11 11:05:22 -05:00
99afc7f4e4
HTTP security plug: add media proxy base url host to csp
2020-06-10 20:09:16 +03:00
d23b3701d8
Merge branch 'bugfix/csp-unproxied' into 'develop'
...
http_security_plug.ex: Fix non-proxied media
See merge request pleroma/pleroma!2610
2020-05-29 21:23:49 +00:00
109af93227
Apply suggestion to lib/pleroma/plugs/http_security_plug.ex
2020-05-29 21:15:07 +00:00
d38f28870e
Add blob: to connect-src CSP
2020-05-29 11:08:17 -05:00
da1e31fae3
http_security_plug.ex: Fix non-proxied media
2020-05-29 17:20:09 +02:00
27180611df
HTTP Security plug: make starting csp string generation more readable
2020-05-29 12:32:48 +03:00
29ff6d414b
HTTP security plug: Harden img-src and media-src when MediaProxy is enabled
2020-05-27 21:41:19 +03:00
455a402c8a
HTTP Security plug: rewrite &csp_string/0
...
- Directives are now separated with ";" instead of " ;",
according to https://www.w3.org/TR/CSP2/#policy-parsing
the space is optional
- Use an IO list, which at the end gets converted to a binary as
opposed to ++ing a bunch of arrays with binaries together and joining
them to a string. I doubt it gives any significant real world advantage,
but the code is cleaner and now I can sleep at night.
- The static part of csp is pre-joined to a single binary at compile time.
Same reasoning as the last point.
2020-05-27 21:31:47 +03:00
bfdd90f6d7
AuthenticationPlug: Also update crypt passwords.
2020-05-17 11:40:25 +02:00
baef35bcc8
Authentication Plug: Update bcrypt password on login.
2020-05-17 10:31:01 +02:00
5b0f27d23d
Pbkdf2.verify_pass --> AuthenticationPlug.checkpw
2020-05-14 08:57:38 -05:00
9cbf17d59f
Handle bcrypt passwords for Mastodon migration
2020-05-13 10:53:56 -05:00
b46811a074
Upgrade Comeonin to v5
...
https://github.com/riverrun/comeonin/blob/master/UPGRADE_v5.md
2020-05-12 17:14:59 -05:00
3d0c567fbc
Pleroma.Web.TwitterAPI.TwoFactorAuthenticationController -> Pleroma.Web.PleromaAPI.TwoFactorAuthenticationController
2020-05-07 08:14:54 +00:00
07e7c80bc9
Merge branch 'plug-if-unless-func-options-refactoring' into 'develop'
...
Refactoring of :if_func / :unless_func plug options
See merge request pleroma/pleroma!2446
2020-05-06 09:14:05 +00:00
c6ddfa8f95
static-fe.css: Restore and move to /priv/static/static-fe
2020-05-02 08:28:42 +02:00
3453e54e6b
MappedSignatureToIdentityPlug: Fix.
2020-05-01 15:58:47 +02:00
2c4844237f
Refactoring of :if_func / :unless_func plug options (general availability). Added tests for Pleroma.Web.Plug.
2020-04-30 18:19:51 +03:00
908cf22a6c
Merge remote-tracking branch 'remotes/origin/develop' into automatic-authentication-and-instance-publicity-checks
...
# Conflicts:
# lib/pleroma/web/mastodon_api/controllers/account_controller.ex
2020-04-28 19:56:20 +03:00
1bd9749a8f
Let blob: pass CSP
2020-04-26 00:29:42 -05:00
2958a7d246
Fixed OAuth restrictions for :api routes. Made auth info dropped for :api routes if OAuth check was neither performed nor explicitly skipped.
2020-04-22 18:50:25 +03:00
f685cbd309
Automatic checks of authentication / instance publicity. Definition of missing OAuth scopes in AdminAPIController. Refactoring.
2020-04-21 16:29:19 +03:00
66f55106bd
[ #1682 ] Fixed Basic Auth permissions issue by disabling OAuth scopes checks when password is provided. Refactored plugs skipping functionality.
2020-04-17 21:21:10 +03:00
bde1189c34
[ #2349 ] Made :skip_plug/2 prevent plug from being executed even if explicitly called. Refactoring. Tests.
2020-04-15 21:19:16 +03:00
bedf92e064
Merge remote-tracking branch 'remotes/origin/develop' into authenticated-api-oauth-check-enforcement
2020-04-15 19:20:34 +03:00
b1c1d2e5e1
Merge branch 'fix/1659-rate-limiter' into 'develop'
...
remote_ip plug adds remote_ip_found flag
Closes #1659
See merge request pleroma/pleroma!2390
2020-04-15 15:26:55 +00:00
22bde21c4f
remote_ip plug adds remote_ip_found flag
2020-04-15 15:27:34 +03:00
6bc76df287
Uploads: Sandbox them in the CSP.
2020-04-15 12:05:22 +02:00
c4e7ed660c
fix logger message
2020-04-14 08:43:47 +03:00
fc81e5a49c
Enforcement of OAuth scopes check for authenticated API endpoints, :skip_plug plug to mark a plug explicitly skipped (disabled).
2020-04-06 10:20:44 +03:00
fa4ec17c84
Merge branch '1560-non-federating-instances-routes-restrictions' into 'develop'
...
[#1560 ] Restricted AP- & OStatus-related routes for non-federating instances
Closes #1560
See merge request pleroma/pleroma!2235
2020-03-15 19:15:20 +00:00
67a27825b1
Merge branch 'fix/rate-limiter-remoteip-behavior' into 'develop'
...
rate limiter: disable based on if remote ip was found, not on if the plug was enabled
Closes #1620
See merge request pleroma/pleroma!2296
2020-03-15 14:22:10 +00:00
ecb7809e92
Merge remote-tracking branch 'remotes/origin/develop' into 1560-non-federating-instances-routes-restrictions
...
# Conflicts:
# lib/pleroma/plugs/static_fe_plug.ex
2020-03-14 15:37:02 +03:00
d88c8a9614
Merge branch 'fix/cache-control-headers' into 'develop'
...
Fix Cache Control headers on media
See merge request pleroma/pleroma!2295
2020-03-14 11:19:42 +00:00
6a28c198af
uploaded media plug: do not inject compile-time params on every request
2020-03-13 22:12:33 +03:00
658f30c0b3
Merge branch 'static-accept-missing' into 'develop'
...
Fix static FE plug to handle missing Accept header.
See merge request pleroma/pleroma!2260
2020-03-13 18:46:54 +00:00
fc4496d4fa
rate limiter: disable based on if remote ip was found, not on if the plug was enabled
...
The current rate limiter disable logic won't trigger when the remote ip
is not forwarded, only when the remoteip plug is not enabled, which is
not the case on most instances since it's enabled by default. This
changes the behavior to warn and disable when the remote ip was not forwarded,
even if the RemoteIP plug is enabled.
Also closes #1620
2020-03-13 21:41:17 +03:00
3b1b183b42
Synchronize cache-control header for local media with the mediaproxy
2020-03-13 12:27:50 -05:00
Mark Felder