summaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2023-09-13CommonAPI: disallow quoting private posts through the APIAlex Gleason
2023-09-13Add InlineQuotePolicy to force quote URLs inlineAlex Gleason
2023-09-13ActivityDraft: mix format, defensive actor IDAlex Gleason
2023-09-13ActivityDraft: mention the OP of a quoted postAlex Gleason
2023-09-13Return quote_url through the API, don't render quotes more than 1 level deepAlex Gleason
2023-09-13InstanceView: add "quote_posting" featureAlex Gleason
2023-09-13mix formatAlex Gleason
2023-09-13ActivityDraft: allow quotingAlex Gleason
2023-09-13ActivityDraft: create quote postsAlex Gleason
2023-09-13StatusView: render the whole quoted statusAlex Gleason
2023-09-13StatusView: show quoted posts through the API, probablyAlex Gleason
2023-09-13Transmogrifier: fix quoteUrl here tooAlex Gleason
2023-09-13Transmogrifier: fetch quoted postAlex Gleason
2023-09-13ObjectValidators: improve quoteUrl compatibilityAlex Gleason
2023-09-13ObjectValidators: accept "quoteUrl" fieldAlex Gleason
2023-09-07Update InstanceView.featuresmarcin mikołajczak
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-09-03CommonAPI: Prevent users from accessing media of other usersMint
2023-08-30Make lint happytusooa
2023-08-16Merge branch 'csp-flash' into 'develop'Haelwenn
allow https: so that flash works across instances without need for media proxy See merge request pleroma/pleroma!3879
2023-08-16Apply lanodan's suggestion(s) to 1 file(s)Haelwenn
2023-08-11InstanceView: Add common_information functionmarcin mikołajczak
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-08-11Implement api/v2/instance routemarcin mikołajczak
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-08-05Completely disable xml entity resolutionmae
2023-08-04Prevent XML parser from loading external entitiesMae
2023-08-04instance gen: Reduce permissions of pleroma directories and config filesHaelwenn (lanodan) Monnier
2023-08-04Config: Restrict permissions of OTP config fileHaelwenn (lanodan) Monnier
2023-08-04Resolve information disclosure vulnerability through emoji pack archive ↵Mark Felder
download endpoint The pack name has been sanitized so an attacker cannot upload a media file called pack.json with their own handcrafted list of emoji files as arbitrary files on the filesystem and then call the emoji pack archive download endpoint with a pack name crafted to the location of the media file they uploaded which tricks Pleroma into generating a zip file of the target files the attacker wants to download. The attack only works if the Pleroma instance does not have the AnonymizeFilename upload filter enabled, which is currently the default. Reported by: graf@poast.org
2023-08-03Merge branch 'tusooa/3154-attachment-type-check' into 'develop'Haelwenn
Restrict attachments to only uploaded files only Closes #3154 See merge request pleroma/pleroma!3923
2023-07-28cleaner ecto query to handle restrict_unauthenticated for activitiesFaried Nawaz
This fix is for this case: config :pleroma, :restrict_unauthenticated, activities: %{local: true, remote: true}
2023-07-28status context: perform visibility check on activities around a statusfaried nawaz
issue #2927
2023-07-18Restrict attachments to only uploaded files onlytusooa
2023-07-17Merge branch '2023-06-deps-update' into 'develop'Haelwenn
2023-06 deps update + de-override plug See merge request pleroma/pleroma!3911
2023-07-07Make regex-to-string descriptor reusabletusooa
2023-07-07Fix edge casestusooa
2023-07-07Make EmojiPolicy aware of custom emoji reactionstusooa
2023-07-07Improve config examples for EmojiPolicytusooa
2023-07-07Move emoji_policy.ex to the right placetusooa
2023-07-07EmojiPolicy: Implement delisttusooa
2023-07-07EmojiPolicy: implement remove by shortcodetusooa
2023-07-07Add emoji policy to remove emojis matching certain urlstusooa
https://git.pleroma.social/pleroma/pleroma/-/issues/2775
2023-07-04Deprecate audio scrobblingHaelwenn (lanodan) Monnier
2023-07-02Merge branch 'tusooa/3131-handle-report-from-deactivated-user' into 'develop'Haelwenn
Fix handling report from a deactivated user Closes #3131 See merge request pleroma/pleroma!3915
2023-07-02Fix handling report from a deactivated usertusooa
2023-07-02Fix user fetch completely broken if featured collection is not in a ↵tusooa
supported form
2023-07-01Merge branch 'bugfix/full-revert-media-host-validation' into 'develop'tusooa
Merge Revert "Merge branch 'validate-host' into 'develop'" Closes #3136 See merge request pleroma/pleroma!3909
2023-06-27Merge branch 'instance-nodeinfo-metadata' into 'develop'developHaelwenn
instances: Store some metadata based on NodeInfo See merge request pleroma/pleroma!3853
2023-06-27Merge branch 'tusooa/3119-bio-update' into 'develop'Haelwenn
Show more informative errors when profile exceeds char limits Closes #3119 See merge request pleroma/pleroma!3886
2023-06-27Merge branch 'from/upstream-develop/tusooa/backup-status' into 'develop'Haelwenn
Detail backup states Closes #3024 See merge request pleroma/pleroma!3809
2023-06-27router: Fix usage of globsHaelwenn (lanodan) Monnier
warning: doing a prefix match with globs is deprecated, invalid segment "pleroma*path". You can either replace by a single segment match: /foo/bar-:var Or by mixing single segment match with globs: /foo/bar-:var/*rest
2023-06-27endpoint: Use custom Multipart module for dynamic configurationHaelwenn (lanodan) Monnier
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-05 10:33:45 +0000