314360e5e3
Add test to cover edit streaming
2023-10-15 17:20:25 -04:00
26f5caebae
Add test to cover notifications streaming
2023-10-15 17:20:25 -04:00
4cf109d3c4
Add test to cover rendering update with user
2023-10-15 17:20:25 -04:00
050227f118
Add test to cover error: bad_topic
2023-10-15 17:20:25 -04:00
949c4f01c6
Fix NotificationTest
2023-10-15 17:20:25 -04:00
9572be1e5f
Add tests for list streams
2023-10-15 17:20:25 -04:00
a348c2e4dd
Use pleroma: instead of pleroma. for ws events
2023-10-15 17:20:25 -04:00
7d005e8c93
Return stream attribute in server-sent events
2023-10-15 17:20:23 -04:00
21395aa509
Allow authenticating via client-sent events
2023-10-15 17:19:49 -04:00
273cda63ad
Allow subscribing to streams
2023-10-15 17:19:49 -04:00
2b5636bf12
Allow unified streaming endpoint
2023-10-15 17:19:40 -04:00
08608afca5
Fix quote_visible attribute
2023-09-13 19:20:33 -04:00
a8b2f9205d
Expose quote_id parameter on the api
2023-09-13 19:20:32 -04:00
875b46d97d
Do not mention original poster when quoting
2023-09-13 19:20:32 -04:00
8596f92654
Fix TransmogrifierTest
2023-09-13 19:20:32 -04:00
e349e92a44
Add mrf to force link tag of quoting posts
2023-09-13 19:20:30 -04:00
479a6f11db
Keep incoming Link tag
2023-09-13 19:19:44 -04:00
e9cd004ba1
Parse object link as quoteUrl
2023-09-13 19:19:42 -04:00
163e563733
Allow more flexibility in InlineQuotePolicy
2023-09-13 19:19:05 -04:00
762794eed9
Fix CommonAPITest
2023-09-13 19:19:05 -04:00
9bcec87aba
Allow local quote and private self-quote
2023-09-13 19:19:05 -04:00
f9697e68c2
InlineQuotePolicy: skip objects which already have an .inline-quote span
2023-09-13 19:19:05 -04:00
79fca39faf
Actually, don't send _misskey_quote anymore
2023-09-13 19:19:05 -04:00
4075eecca0
InlineQuotePolicy: improve the way Markdown quotes are displayed by other software
2023-09-13 19:19:05 -04:00
817e308c0d
Handle Fedibird's new quoteUri field
2023-09-13 19:19:05 -04:00
3c8319fe9f
Transmogrifier: federate quotes with _misskey_quote field
2023-09-13 19:19:04 -04:00
cf8e425883
StatusView: return quote post inside a reblog
2023-09-13 19:19:04 -04:00
bee7e41959
InlineQuotePolicy: don't add line breaks to markdown posts
2023-09-13 19:19:04 -04:00
74e0a4555f
StatusView: add `quote_visible` param
2023-09-13 19:19:04 -04:00
6f11f11519
StatusView: fix quote visibility
2023-09-13 19:19:04 -04:00
59326247aa
CommonAPI: disallow quoting private posts through the API
2023-09-13 19:19:04 -04:00
57ef1d1211
Add InlineQuotePolicy to force quote URLs inline
2023-09-13 19:19:04 -04:00
1f19dd76f6
ActivityDraft: mix format, defensive actor ID
2023-09-13 19:19:04 -04:00
54a9897938
ActivityDraft: mention the OP of a quoted post
2023-09-13 19:19:04 -04:00
80ab2572a4
Return quote_url through the API, don't render quotes more than 1 level deep
2023-09-13 19:19:04 -04:00
f4ccdfd503
Fix typos
2023-09-13 19:19:03 -04:00
cbd1760efa
TransmogrifierTest: prepare an outgoing quote post
2023-09-13 19:19:03 -04:00
3a8b5d90df
StatusControllerTest: test creating a quote post
2023-09-13 19:19:03 -04:00
c20e90e898
BuilderTest: build quote post
2023-09-13 19:19:03 -04:00
d4fea8b559
ActivityDraft: allow quoting
2023-09-13 19:19:03 -04:00
0d9c443e51
StatusView: render the whole quoted status
2023-09-13 19:19:03 -04:00
b022d6635d
Transmogrifier: fetch quoted post
2023-09-13 19:19:03 -04:00
795736af16
ObjectValidators: improve quoteUrl compatibility
2023-09-13 19:19:03 -04:00
1afde067b1
CommonAPI: Prevent users from accessing media of other users
2023-09-03 10:41:37 +02:00
48b1e9bdc7
Completely disable xml entity resolution
2023-08-05 14:17:04 +02:00
307692cee8
Add unit test for external entity loading
2023-08-05 08:14:27 +02:00
65ef8f19c5
release_runtime_provider_test: chmod config for hardened permissions
...
Git doesn't manages file permissions precisely enough for us.
2023-08-04 09:50:28 +02:00
2c79509453
Resolve information disclosure vulnerability through emoji pack archive download endpoint
...
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.
The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.
Reported by: graf@poast.org
2023-08-04 08:40:27 +02:00
819fccb7d1
Merge branch 'tusooa/3154-attachment-type-check' into 'develop'
...
Restrict attachments to only uploaded files only
Closes #3154
See merge request pleroma/pleroma!3923
2023-08-03 10:01:32 +00:00
dc4de79d43
status context: perform visibility check on activities around a status
...
issue #2927
2023-07-28 18:45:59 +05:00
tusooa