diff options
| author | Haelwenn <contact+git.pleroma.social@hacktivis.me> | 2024-02-20 10:52:46 +0000 |
|---|---|---|
| committer | Haelwenn <contact+git.pleroma.social@hacktivis.me> | 2024-02-20 10:52:46 +0000 |
| commit | f0468697cd74f4ec062f9c6feda53cfbe9e4500c (patch) | |
| tree | 8c19daa6ac627ab8797eb90e96b028f2e182232b /lib | |
| parent | 0b9bc4a0d0e44a873bc59e8994f1996499ed0c4b (diff) | |
| parent | e149ee6e225667ca964e30a08179ca84b8537aaf (diff) | |
| download | pleroma-f0468697cd74f4ec062f9c6feda53cfbe9e4500c.tar.gz pleroma-f0468697cd74f4ec062f9c6feda53cfbe9e4500c.zip | |
Merge branch 'mergeback/2.6.2' into 'develop'
Mergeback: Security Release 2.6.2
Closes #3245
See merge request pleroma/pleroma!4075
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/pleroma/web/activity_pub/mrf/steal_emoji_policy.ex | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/lib/pleroma/web/activity_pub/mrf/steal_emoji_policy.ex b/lib/pleroma/web/activity_pub/mrf/steal_emoji_policy.ex index 237dfefa5..fa6b595ea 100644 --- a/lib/pleroma/web/activity_pub/mrf/steal_emoji_policy.ex +++ b/lib/pleroma/web/activity_pub/mrf/steal_emoji_policy.ex @@ -36,6 +36,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.StealEmojiPolicy do extension = if extension == "", do: ".png", else: extension + shortcode = Path.basename(shortcode) file_path = Path.join(emoji_dir_path, shortcode <> extension) case File.write(file_path, response.body) do @@ -78,6 +79,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.StealEmojiPolicy do new_emojis = foreign_emojis |> Enum.reject(fn {shortcode, _url} -> shortcode in installed_emoji end) + |> Enum.reject(fn {shortcode, _url} -> String.contains?(shortcode, ["/", "\\"]) end) |> Enum.filter(fn {shortcode, _url} -> reject_emoji? = [:mrf_steal_emoji, :rejected_shortcodes] |