limepotato/akkoma
1
0
Fork 0
Code Pull requests Activity
15113 commits 27 branches 107 tags 315 MiB
Commit graph

78 commits

Author SHA1 Message Date
Mark Felder
2c79509453 Resolve information disclosure vulnerability through emoji pack archive download endpoint 
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.

The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.

Reported by: graf@poast.org
 2023-08-04 08:40:27 +02:00
Haelwenn
819fccb7d1 Merge branch 'tusooa/3154-attachment-type-check' into 'develop' 
Restrict attachments to only uploaded files only

Closes #3154

See merge request pleroma/pleroma!3923
 2023-08-03 10:01:32 +00:00
faried nawaz
11ce81d4af add changelog entry 2023-07-28 18:49:05 +05:00
tusooa
ea4225a646
Restrict attachments to only uploaded files only 2023-07-18 18:39:59 -04:00
Haelwenn
93ad16cca0 Merge branch '2023-06-deps-update' into 'develop' 
2023-06 deps update + de-override plug

See merge request pleroma/pleroma!3911
 2023-07-17 20:37:47 +00:00
tusooa
0d914e17be
Add changelog 2023-07-07 06:58:32 -04:00
tusooa
7da6a82dbd Merge branch 'deprecate-scrobbles' into 'develop' 
Deprecate audio scrobbling

See merge request pleroma/pleroma!3919
 2023-07-04 02:46:10 +00:00
Haelwenn (lanodan) Monnier
0c3709173f docs: Fix broken links 2023-07-04 04:23:48 +02:00
Haelwenn
53f4d6f238 Merge branch 'fix/pipeline-triggers' into 'develop' 
CI: Fix pipeline tokens & exit status

See merge request pleroma/pleroma!3918
 2023-07-04 02:04:24 +00:00
Haelwenn (lanodan) Monnier
3d79ceb23a Deprecate audio scrobbling 2023-07-04 03:40:11 +02:00
Haelwenn (lanodan) Monnier
8c3363a5e7 CI: Use CI_JOB_TOKEN for cross-repo pipeline triggers 2023-07-04 03:25:37 +02:00
Haelwenn
6fbbf80800 Merge branch 'gentoo_otp' into 'develop' 
Packaged installation guide for gentoo

See merge request pleroma/pleroma!3906
 2023-07-03 21:04:23 +00:00
Haelwenn
2b9cd25cf4 Merge branch 'tusooa/media-altdomain' into 'develop' 
Add instructions to serve media on another domain

See merge request pleroma/pleroma!3892
 2023-07-02 21:30:16 +00:00
Haelwenn
0262916978 Merge branch 'testfix/system-config-use' into 'develop' 
release_runtime_provider_test: Explicitely use non-existant config file

See merge request pleroma/pleroma!3910
 2023-07-02 21:28:15 +00:00
Haelwenn
a31a4c522f Merge branch 'tusooa/3131-handle-report-from-deactivated-user' into 'develop' 
Fix handling report from a deactivated user

Closes #3131

See merge request pleroma/pleroma!3915
 2023-07-02 21:27:15 +00:00
Haelwenn
379590d438 Merge branch 'tusooa/3142-featured-collection-shouldnt-break-user-fetch' into 'develop' 
Fix user fetch completely broken if featured collection is not in a supported form

See merge request pleroma/pleroma!3914
 2023-07-02 21:25:45 +00:00
tusooa
6e4de2383f
Fix handling report from a deactivated user 2023-07-02 11:15:34 -04:00
tusooa
a1621839cc
Fix user fetch completely broken if featured collection is not in a supported form 2023-07-02 11:03:09 -04:00
tusooa
63b9f76782
Force the use of amd64 runners for jobs using ci-base 2023-07-01 23:25:04 -04:00
tusooa
48e490cd58 Merge branch 'bugfix/full-revert-media-host-validation' into 'develop' 
Merge Revert "Merge branch 'validate-host' into 'develop'"

Closes #3136

See merge request pleroma/pleroma!3909
 2023-07-01 21:54:18 +00:00
Haelwenn
ae0ca49451 Merge branch 'tusooa/3119-bio-update' into 'develop' 
Show more informative errors when profile exceeds char limits

Closes #3119

See merge request pleroma/pleroma!3886
 2023-06-27 18:49:43 +00:00
Haelwenn (lanodan) Monnier
aa4c4ab2a0 mix: 2023-06 deps update 
this fixes compatibility with Erlang OTP 26

Related: https://git.pleroma.social/pleroma/pleroma/-/issues/2913
 2023-06-27 02:38:31 +02:00
Haelwenn (lanodan) Monnier
8bc51288be release_runtime_provider_test: Explicitely use non-existant config file 2023-06-27 00:20:29 +02:00
Haelwenn (lanodan) Monnier
dd9f8150fc Merge Revert "Merge branch 'validate-host' into 'develop'" 
This reverts commit d998a114e2, reversing
changes made to da6b4003ac.
 2023-06-22 21:28:25 +02:00
Sean King
994bfc4c09
Add changelog entry 2023-06-21 23:13:16 -06:00
Haelwenn (lanodan) Monnier
937fa36ec4 changelog.d/gentoo_otp.skip: Doc-only MR 2023-06-13 16:05:37 +02:00
Haelwenn (lanodan) Monnier
a663b73634 Add no_new_privs to OpenRC service files 2023-06-13 12:47:02 +02:00
lain
fdb5bec431 Merge branch 'unused_indexes' into 'develop' 
Remove unused indexes

See merge request pleroma/pleroma!3874
 2023-06-11 19:48:23 +00:00
lain
4e6ea7cc91 Merge branch 'tusooa/3054-banned-delete' into 'develop' 
Fix deleting banned users' statuses

See merge request pleroma/pleroma!3889
 2023-06-11 13:17:12 +00:00
Lain Soykaf
55dd8ef1c7 Merge branch 'develop' of git.pleroma.social:pleroma/pleroma into pleroma-double_mentions 2023-06-11 16:31:20 +04:00
Lain Soykaf
10dfa107d5 Update changelog 2023-06-11 16:22:03 +04:00
lain
16313af7eb Merge branch 'fix/metadata-tags' into 'develop' 
static frontend: fix meta tags

See merge request pleroma/pleroma!3885
 2023-06-11 11:57:16 +00:00
lain
1f4618d64b Merge branch 'cleanup/ostatus-user-upgrade' into 'develop' 
Cleanup OStatus-era user upgrades and ap_enabled indicator

See merge request pleroma/pleroma!3880
 2023-06-11 11:13:57 +00:00
feld
75900f21f0 Merge branch 'revert-mediaproxy-host-validation' into 'develop' 
Revert MediaProxy Host header validation

See merge request pleroma/pleroma!3902
 2023-06-11 11:10:51 +00:00
lain
1db29f734f Merge branch 'fep-fffd-url' into 'develop' 
CommonFields: Use BareUri for :url

Closes #3121

See merge request pleroma/pleroma!3884
 2023-06-11 11:02:39 +00:00
lain
b762a7503c Merge branch 'distro-docs-elixir-1.11' into 'develop' 
installation/debian_based_*: Elixir 1.11 means Debian 12+ and Ubuntu 22.04+

See merge request pleroma/pleroma!3898
 2023-06-11 10:42:22 +00:00
Mark Felder
1ca1b4b32f changelog.d 2023-06-07 09:25:57 -04:00
Mark Felder
fadcd7f1a9 Revert MediaProxy Host header validation 
Something is going wrong here even though the tests are correct.
 2023-06-07 09:19:22 -04:00
Lain Soykaf
40d40d67a3 Add changelog. 2023-06-02 17:09:58 +04:00
Haelwenn (lanodan) Monnier
313e68c180 mix: bump gettext to ~0.20 
Includes https://github.com/elixir-gettext/gettext/pull/304 in 0.20.0+
Includes https://github.com/elixir-gettext/expo/issues/91 in 0.22+ via expo 0.2.0+
 2023-06-02 03:06:32 +02:00
Mark Felder
46c799f528 Use Phoenix.ConnTest.redirected_to/2 2023-05-31 09:54:37 -04:00
Haelwenn (lanodan) Monnier
737e45c102 installation/debian_based_jp: Elixir 1.11 means Debian 12+ and Ubuntu 22.04+ 
I checked for what each part of the debian&ubuntu sentences meant with the
help of Jisho.org, should be safe but it did make me notice that this guide
hasn't been updated in years
 2023-05-31 08:32:58 +02:00
Haelwenn
d998a114e2 Merge branch 'validate-host' into 'develop' 
Validate Host header for MediaProxy and Uploads

See merge request pleroma/pleroma!3896
 2023-05-31 00:50:01 +00:00
Mark Felder
b3c3bd99c3 Switch from serving a 400 to a 302 2023-05-30 16:56:09 -04:00
Mark Felder
9caa0b0be1 Add OnlyMedia Upload Filter to simplify restricting uploads to audio, image, and video types 2023-05-29 15:49:04 -04:00
Mark Felder
84974efe4c Host header validation is now required for MediaProxy and Uploads 2023-05-29 14:17:27 -04:00
faried nawaz
a1af122499
changelog entry 2023-05-29 02:52:49 +05:00
Haelwenn (lanodan) Monnier
869f0d24a6 Merge branch 'release/2.5.2' into mergeback/2.5.2 2023-05-26 23:47:50 +02:00
tusooa
408ea697aa
Add changelog 2023-05-26 17:28:41 -04:00
Mark Felder
4505bc1e58 Filter OEmbed HTML tags 2023-05-26 19:56:36 +02:00