limepotato/akkoma
1
0
Fork 0
Code Pull requests Activity
15466 commits 27 branches 107 tags 315 MiB
Commit graph

5699 commits

Author SHA1 Message Date
Oneric
0ec62acb9d Always insert Dedupe upload filter 
This actually was already intended before to eradict all future
path-traversal-style exploits and to fix issues with some
characters like akkoma#610 in 0b2ec0ccee. However, Dedupe and
AnonymizeFilename got mixed up. The latter only anonymises the name
in Content-Disposition headers GET parameters (with link_name),
_not_ the upload path.

Even without Dedupe, the upload path is prefixed by an UUID,
so it _should_ already be hard to guess for attackers. But now
we actually can be sure no path shenanigangs occur, uploads
reliably work and save some disk space.

While this makes the final path predictable, this prediction is
not exploitable. Insertion of a back-reference to the upload
itself requires pulling off a successfull preimage attack against
SHA-256, which is deemed infeasible for the foreseeable futures.

Dedupe was already included in the default list in config.exs
since 28cfb2c37a, but this will get overridde by whatever the
config generated by the "pleroma.instance gen" task chose.

Upload+delete tests running in parallel using Dedupe might be flaky, but
this was already true before and needs its own commit to fix eventually.
 2024-03-18 22:33:10 -01:00
Oneric
fef773ca35 Drop media base_url default and recommend different domain 
Same-domain setups enabled now at least two exploits,
so they ought to be discouraged and definitely not be the default.
 2024-03-18 22:33:10 -01:00
floatingghost
7d61fb0906 Merge pull request 'Fix static-fe Twitter metadata / URL previews' (#700) from Oneric/akkoma:staticfe-metadata into develop 
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/700
 2024-02-24 13:42:55 +00:00
Oneric
c08f49d88e Add tests for static-fe metadata tags 2024-02-21 00:33:32 +00:00
Haelwenn (lanodan) Monnier
7d94476dd6 StealEmojiPolicy: Sanitize shortcodes 
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3245
 2024-02-20 11:19:00 +01:00
Oneric
1a7839eaf2 Prune old Update activities 
Once processed they serve no purpose anymore afaict.
Therefor, lets prune them like other transient activities
to not unnecessarily bloat the table.
 2024-02-17 16:57:40 +01:00
Oneric
1ef8b967d2 test: fix typos affecting remove factory 
Apparently nothing used this factory until now
 2024-02-17 16:57:40 +01:00
floatingghost
289f93f5a2 Merge pull request 'Return last_status_at as date, not datetime' (#681) from katafrakt/akkoma:fix-last-status-at into develop 
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/681
 2024-02-17 11:37:19 +00:00
Oneric
e99e2407f3 Add background_removal to SimplePolicy MRF 2024-02-16 16:36:45 +01:00
Oneric
7622aa27ca Federate user profile background 
Currently our own frontend doesn’t show backgrounds of other users, this
property is already publicly readable via REST API and likely was always
intended to be shown and federated.

Recently Sharkey added support for profile backgrounds and
immediately made them federate and be displayed to others.
We use the same AP field as Sharkey here which should make
it interoperable both ways out-of-the-box.

Ref.: 4e64397635
 2024-02-16 16:35:51 +01:00
FloatingGhost
0ed815b8a1 Merge branch 'followback' into develop 2024-02-16 13:27:40 +00:00
floatingghost
c5dcd07e08 Merge pull request 'Fix OpenAPI spec for preferred_frontend endpoint' (#680) from katafrakt/akkoma:fix-openapi-spec-for-preferred-frontend into develop 
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/680
 2024-02-16 12:21:00 +00:00
Oneric
376f6b15ca Add ability to auto-approve followbacks 
Resolves: https://akkoma.dev/AkkomaGang/akkoma/issues/148
 2024-02-13 15:42:37 +01:00
Oneric
8cf183cb42 Drop Chat tables 
Chats were removed in 0f132b802d
 2024-02-11 05:15:08 +01:00
Paweł Świątkowski
df21b61829
Return last_status_at as date, not datetime 2024-02-05 21:42:15 +01:00
floatingghost
e97d08ee98 Merge pull request 'MRF transparency: don’t forget to obfuscate short domains' (#676) from Oneric/akkoma:mrf-obfuscation into develop 
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/676
 2024-02-05 08:43:43 +00:00
Paweł Świątkowski
d7d159c49f
Fix OpenAPI spec for preferred_frontend endpoint 
The spec was copied from another endpoint, including the operation id,
leading to scrubbing the valid parameters from the request and simply
not working.
 2024-02-03 14:27:45 +01:00
Oneric
e47c50666d Fix obfuscation of short domains 
Fixes https://akkoma.dev/AkkomaGang/akkoma/issues/645
 2024-02-02 14:50:13 +00:00
Aria
77000b8ffd update tests for oauth consumer 2023-12-17 21:48:19 +00:00
Lain Soykaf
c3098e9c56 UserViewTest: Add basice service actor test. 2023-12-15 16:31:51 +00:00
FloatingGhost
6cc523bd23 Correct email links to be absolute URLs 2023-11-02 11:49:03 +00:00
FloatingGhost
033b7b04e0 update captcha version 2023-10-20 13:30:29 +01:00
FloatingGhost
c8e08e9cc3 fix issue with API cascading domain blocks but not honouring them 2023-08-25 11:00:49 +01:00
FloatingGhost
063e3c0d34 Disallow nil hosts in should_federate 2023-08-15 23:12:04 +01:00
FloatingGhost
6cb40bee26 Migrate to phoenix 1.7 (#626) 
Closes #612

Co-authored-by: tusooa <tusooa@kazv.moe>
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/626
Co-authored-by: FloatingGhost <hannah@coffee-and-dreams.uk>
Co-committed-by: FloatingGhost <hannah@coffee-and-dreams.uk>
 2023-08-15 10:22:18 +00:00
Joshua Goins
c22ecac567 mastodon_api: Add /api/v1/preferences endpoint 
Implements the preferences endpoint in the Mastodon API, but returns
default values for most of the preferences right now. The only supported
preference we can access is default post visibility, and a relevant test
is added as well.
 2023-08-12 09:28:24 -04:00
FloatingGhost
c7aeeec232 fix yet another keyword equality check 2023-08-07 17:00:16 +01:00
FloatingGhost
0c21341156 Fix signature checking 2023-08-07 16:17:17 +01:00
FloatingGhost
7825798e32 Add XML matcher 2023-08-07 11:12:14 +01:00
FloatingGhost
650c0c0f62 Allow max_id to be at the end of the querystring 2023-08-06 16:44:25 +01:00
FloatingGhost
7956cfb091 Another keyword.equal? check 2023-08-06 16:36:18 +01:00
FloatingGhost
215b550317 Fix keyword ordering reliance 2023-08-06 16:27:15 +01:00
FloatingGhost
c193b4d507 Remove frankly awful config file test 2023-08-06 16:20:46 +01:00
FloatingGhost
866672b6a7 Add unordered list equality matcher 2023-08-06 15:58:11 +01:00
FloatingGhost
ef422a8385 Put matchers in matchers subpackage 2023-08-06 15:53:04 +01:00
FloatingGhost
9723264fe5 Add URI matchers 2023-08-06 15:51:21 +01:00
mae
d868348fac Completely disable xml entity resolution 2023-08-05 12:32:05 +00:00
FloatingGhost
b4399574ca Merge remote-tracking branch 'norm/config-permissions' into develop 2023-08-04 22:31:11 +01:00
FloatingGhost
9c7409808f Add unit test for external entity loading 2023-08-04 22:24:32 +01:00
Haelwenn (lanodan) Monnier
749e9f2229
release_runtime_provider_test: chmod config for hardened permissions 
Git doesn't manages file permissions precisely enough for us.

Original: 65ef8f19c5
 2023-08-04 14:14:04 -04:00
FloatingGhost
0b2ec0ccee Enable AnonymizeFilenames on all uploads 2023-08-04 15:37:15 +01:00
FloatingGhost
723bd123a0 Correct ordering for block/mutes 2023-08-04 15:18:07 +01:00
FloatingGhost
1dc8cc731c Merge branch 'elixir1.15' into develop 2023-08-04 15:16:14 +01:00
FloatingGhost
87cc5a2110 Fix uploads test being reliant on being run later 2023-08-04 12:59:33 +01:00
FloatingGhost
64e233ca20 Tag Mock-tests as "mocked" and run them seperately 2023-08-04 12:50:50 +01:00
FloatingGhost
fe8c166b8f Remove IO.inspects 2023-08-04 12:01:52 +01:00
Mark Felder
7e45343f81 Resolve information disclosure vulnerability through emoji pack archive download endpoint 2023-08-04 11:34:19 +01:00
FloatingGhost
f4fe4fcbcc More static stuff 2023-08-03 23:00:30 +01:00
FloatingGhost
02071ab9b4 bah 2023-08-03 18:40:13 +01:00
FloatingGhost
d5de05bbe4 scream 2023-08-03 18:10:27 +01:00