diff options
| author | rinpatch <rinpatch@sdf.org> | 2020-02-29 23:08:14 +0000 |
|---|---|---|
| committer | rinpatch <rinpatch@sdf.org> | 2020-02-29 23:08:14 +0000 |
| commit | 438394d40447bdfb590ff206ad80907294da0e65 (patch) | |
| tree | eba301a4ae02e8306eb8849b8a1f0918f55921da /CHANGELOG.md | |
| parent | 19e559fe5130f66a967732a40ccea1ac39e85eb8 (diff) | |
| parent | b5465bf385800d52998bca472a19ea1b9db4c252 (diff) | |
| download | pleroma-438394d40447bdfb590ff206ad80907294da0e65.tar.gz pleroma-438394d40447bdfb590ff206ad80907294da0e65.zip | |
Merge branch 'fix/easy-timeline-dos' into 'develop'
Cap the number of requested statuses in timelines to 40 and rate limit them
See merge request pleroma/pleroma!2253
Diffstat (limited to 'CHANGELOG.md')
| -rw-r--r-- | CHANGELOG.md | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index 12f7e8fab..37df345ed 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,9 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). ## [Unreleased] +### Security +- Mastodon API: Fix being able to request enourmous amount of statuses in timelines leading to DoS. Now limited to 40 per request. + ### Removed - **Breaking**: Removed 1.0+ deprecated configurations `Pleroma.Upload, :strip_exif` and `:instance, :dedupe_media` - **Breaking**: OStatus protocol support @@ -56,6 +59,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). - Admin API: Render whole status in grouped reports - Mastodon API: User timelines will now respect blocks, unless you are getting the user timeline of somebody you blocked (which would be empty otherwise). - Mastodon API: Favoriting / Repeating a post multiple times will now return the identical response every time. Before, executing that action twice would return an error ("already favorited") on the second try. +- Mastodon API: Limit timeline requests to 3 per timeline per 500ms per user/ip by default. </details> ### Added |