summaryrefslogtreecommitdiff
path: root/changelog.d
AgeCommit message (Collapse)Author
2023-08-05Document and test that XXE processing is disabledMark Felder
https://vuln.be/post/xxe-in-erlang-and-elixir/
2023-08-05Document and test that XXE processing is disabledMark Felder
https://vuln.be/post/xxe-in-erlang-and-elixir/
2023-08-04gentoo_otp_en.md: Indicate which install method it coversHaelwenn (lanodan) Monnier
2023-08-04changelog: Entry for config permissions restrictionsHaelwenn (lanodan) Monnier
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3135
2023-08-04changelog: Entry for config permissions restrictionsHaelwenn (lanodan) Monnier
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3135
2023-08-04Resolve information disclosure vulnerability through emoji pack archive ↵Mark Felder
download endpoint The pack name has been sanitized so an attacker cannot upload a media file called pack.json with their own handcrafted list of emoji files as arbitrary files on the filesystem and then call the emoji pack archive download endpoint with a pack name crafted to the location of the media file they uploaded which tricks Pleroma into generating a zip file of the target files the attacker wants to download. The attack only works if the Pleroma instance does not have the AnonymizeFilename upload filter enabled, which is currently the default. Reported by: graf@poast.org
2023-08-04Resolve information disclosure vulnerability through emoji pack archive ↵Mark Felder
download endpoint The pack name has been sanitized so an attacker cannot upload a media file called pack.json with their own handcrafted list of emoji files as arbitrary files on the filesystem and then call the emoji pack archive download endpoint with a pack name crafted to the location of the media file they uploaded which tricks Pleroma into generating a zip file of the target files the attacker wants to download. The attack only works if the Pleroma instance does not have the AnonymizeFilename upload filter enabled, which is currently the default. Reported by: graf@poast.org
2023-08-03Merge branch 'tusooa/3154-attachment-type-check' into 'develop'Haelwenn
Restrict attachments to only uploaded files only Closes #3154 See merge request pleroma/pleroma!3923
2023-07-28add changelog entryfaried nawaz
2023-07-18Restrict attachments to only uploaded files onlytusooa
2023-07-17Merge branch '2023-06-deps-update' into 'develop'Haelwenn
2023-06 deps update + de-override plug See merge request pleroma/pleroma!3911
2023-07-07Add changelogtusooa
2023-07-04Merge branch 'deprecate-scrobbles' into 'develop'tusooa
Deprecate audio scrobbling See merge request pleroma/pleroma!3919
2023-07-04docs: Fix broken linksHaelwenn (lanodan) Monnier
2023-07-04Merge branch 'fix/pipeline-triggers' into 'develop'Haelwenn
CI: Fix pipeline tokens & exit status See merge request pleroma/pleroma!3918
2023-07-04Deprecate audio scrobblingHaelwenn (lanodan) Monnier
2023-07-04CI: Use CI_JOB_TOKEN for cross-repo pipeline triggersHaelwenn (lanodan) Monnier
2023-07-03Merge branch 'gentoo_otp' into 'develop'Haelwenn
Packaged installation guide for gentoo See merge request pleroma/pleroma!3906
2023-07-02Merge branch 'tusooa/media-altdomain' into 'develop'Haelwenn
Add instructions to serve media on another domain See merge request pleroma/pleroma!3892
2023-07-02Merge branch 'testfix/system-config-use' into 'develop'Haelwenn
release_runtime_provider_test: Explicitely use non-existant config file See merge request pleroma/pleroma!3910
2023-07-02Merge branch 'tusooa/3131-handle-report-from-deactivated-user' into 'develop'Haelwenn
Fix handling report from a deactivated user Closes #3131 See merge request pleroma/pleroma!3915
2023-07-02Merge branch 'tusooa/3142-featured-collection-shouldnt-break-user-fetch' ↵Haelwenn
into 'develop' Fix user fetch completely broken if featured collection is not in a supported form See merge request pleroma/pleroma!3914
2023-07-02Fix handling report from a deactivated usertusooa
2023-07-02Fix user fetch completely broken if featured collection is not in a ↵tusooa
supported form
2023-07-01Force the use of amd64 runners for jobs using ci-basetusooa
2023-07-01Merge branch 'bugfix/full-revert-media-host-validation' into 'develop'tusooa
Merge Revert "Merge branch 'validate-host' into 'develop'" Closes #3136 See merge request pleroma/pleroma!3909
2023-06-27Merge branch 'tusooa/3119-bio-update' into 'develop'Haelwenn
Show more informative errors when profile exceeds char limits Closes #3119 See merge request pleroma/pleroma!3886
2023-06-27mix: 2023-06 deps updateHaelwenn (lanodan) Monnier
this fixes compatibility with Erlang OTP 26 Related: https://git.pleroma.social/pleroma/pleroma/-/issues/2913
2023-06-27release_runtime_provider_test: Explicitely use non-existant config fileHaelwenn (lanodan) Monnier
2023-06-22Merge Revert "Merge branch 'validate-host' into 'develop'"Haelwenn (lanodan) Monnier
This reverts commit d998a114e26033e98e87778e5ca659aff91831bf, reversing changes made to da6b4003acad84b0f60ad8da6d08cfe13564b058.
2023-06-21Add changelog entrySean King
2023-06-13changelog.d/gentoo_otp.skip: Doc-only MRHaelwenn (lanodan) Monnier
2023-06-13Add no_new_privs to OpenRC service filesHaelwenn (lanodan) Monnier
2023-06-11Merge branch 'unused_indexes' into 'develop'lain
Remove unused indexes See merge request pleroma/pleroma!3874
2023-06-11Merge branch 'tusooa/3054-banned-delete' into 'develop'lain
Fix deleting banned users' statuses See merge request pleroma/pleroma!3889
2023-06-11Merge branch 'develop' of git.pleroma.social:pleroma/pleroma into ↵Lain Soykaf
pleroma-double_mentions
2023-06-11Update changelogLain Soykaf
2023-06-11Merge branch 'fix/metadata-tags' into 'develop'lain
static frontend: fix meta tags See merge request pleroma/pleroma!3885
2023-06-11Merge branch 'cleanup/ostatus-user-upgrade' into 'develop'lain
Cleanup OStatus-era user upgrades and ap_enabled indicator See merge request pleroma/pleroma!3880
2023-06-11Merge branch 'revert-mediaproxy-host-validation' into 'develop'feld
Revert MediaProxy Host header validation See merge request pleroma/pleroma!3902
2023-06-11Merge branch 'fep-fffd-url' into 'develop'lain
CommonFields: Use BareUri for :url Closes #3121 See merge request pleroma/pleroma!3884
2023-06-11Merge branch 'distro-docs-elixir-1.11' into 'develop'lain
installation/debian_based_*: Elixir 1.11 means Debian 12+ and Ubuntu 22.04+ See merge request pleroma/pleroma!3898
2023-06-07changelog.dMark Felder
2023-06-07Revert MediaProxy Host header validationMark Felder
Something is going wrong here even though the tests are correct.
2023-06-03Update to Phoenix 1.7Mark Felder
2023-06-02Merge branch 'develop' into 'phoenix1.7'feld
# Conflicts: # mix.exs
2023-06-02Add changelog.Lain Soykaf
2023-06-02mix: bump gettext to ~0.20Haelwenn (lanodan) Monnier
Includes https://github.com/elixir-gettext/gettext/pull/304 in 0.20.0+ Includes https://github.com/elixir-gettext/expo/issues/91 in 0.22+ via expo 0.2.0+
2023-05-31No user facing changesMark Felder
2023-05-31Use Phoenix.ConnTest.redirected_to/2Mark Felder
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-03 05:27:39 +0000