050bc74437
Merge branch 'develop' into stable
ci/woodpecker/tag/lint Pipeline was successful
ci/woodpecker/tag/test Pipeline was successful
ci/woodpecker/tag/build-amd64 Pipeline failed
ci/woodpecker/tag/docs unknown status
ci/woodpecker/tag/build-arm64 Pipeline failed
ci/woodpecker/push/lint Pipeline was successful
ci/woodpecker/push/test Pipeline was successful
ci/woodpecker/push/build-arm64 Pipeline was successful
ci/woodpecker/push/build-amd64 Pipeline was successful
ci/woodpecker/push/docs Pipeline was successful
2024-05-22 19:42:46 +01:00
5e92f955ac
bump version
ci/woodpecker/push/lint Pipeline was successful
ci/woodpecker/push/test Pipeline was successful
ci/woodpecker/push/build-arm64 Pipeline was successful
ci/woodpecker/push/build-amd64 Pipeline was successful
ci/woodpecker/push/docs Pipeline was successful
2024-05-22 19:42:25 +01:00
b72127b45a
Merge remote-tracking branch 'oneric-sec/media-owner' into develop
2024-05-22 19:36:10 +01:00
9a91299f96
Don't try to handle non-media objects as media
...
Trying to display non-media as media crashed the renderer,
but when posting a status with a valid, non-media object id
the post was still created, but then crashed e.g. timeline rendering.
It also crashed C2S inbox reads, so this could not be used to leak
private posts.
2024-05-22 20:30:23 +02:00
fbd961c747
Drop activity_type override for uploads
...
Afaict this was never used, but keeping this (in theory) possible
hinders detecting which objects are actually media uploads and
which proper ActivityPub objects.
It was originally added as part of upload support itself in
02d3dc6869
without being used
and `git log -S:activity_type` and `git log -Sactivity_type:`
don't find any other commits using this.
2024-05-22 20:30:23 +02:00
0c2b33458d
Restrict media usage to owners
...
In Mastodon media can only be used by owners and only be associated with
a single post. We currently allow media to be associated with several
posts and until now did not limit their usage in posts to media owners.
However, media update and GET lookup was already limited to owners.
(In accordance with allowing media reuse, we also still allow GET
lookups of media already used in a post unlike Mastodon)
Allowing reuse isn’t problematic per se, but allowing use by non-owners
can be problematic if media ids of private-scoped posts can be guessed
since creating a new post with this media id will reveal the uploaded
file content and alt text.
Given media ids are currently just part of a sequentieal series shared
with some other objects, guessing media ids is with some persistence
indeed feasible.
E.g. sampline some public media ids from a real-world
instance with 112 total and 61 monthly-active users:
17.465.096 at t0
17.472.673 at t1 = t0 + 4h
17.473.248 at t2 = t1 + 20min
This gives about 30 new ids per minute of which most won't be
local media but remote and local posts, poll answers etc.
Assuming the default ratelimit of 15 post actions per 10s, scraping all
media for the 4h interval takes about 84 minutes and scraping the 20min
range mere 6.3 minutes. (Until the preceding commit, post updates were
not rate limited at all, allowing even faster scraping.)
If an attacker can infer (e.g. via reply to a follower-only post not
accessbile to the attacker) some sensitive information was uploaded
during a specific time interval and has some pointers regarding the
nature of the information, identifying the specific upload out of all
scraped media for this timerange is not impossible.
Thus restrict media usage to owners.
Checking ownership just in ActivitDraft would already be sufficient,
since when a scheduled status actually gets posted it goes through
ActivityDraft again, but would erroneously return a success status
when scheduling an illegal post.
Independently discovered and fixed by mint in Pleroma
1afde067b1
2024-05-22 20:30:18 +02:00
842cac2a50
ensure we mock_global
2024-05-22 19:30:03 +01:00
Lain Soykaf
3e1f5e5372
WebFingerControllerTest: Restore host after test.
2024-05-22 19:27:51 +01:00
marcin mikołajczak
3a21293970
Fix tests
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2024-05-22 19:27:31 +01:00
marcin mikołajczak
0d66237205
Fix validate_webfinger when running a different domain for Webfinger
...
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2024-05-22 19:20:02 +01:00
6ef6b2a289
Apply rate limits to status updates
2024-05-22 20:18:08 +02:00
94e9c8f48a
Purge unused media description update on post
...
In MastoAPI media descriptions are updated via the
media update API not upon post creation or post update.
This functionality was originally added about 6 years ago in
ba93396649
which was part of
https://git.pleroma.social/pleroma/pleroma/-/merge_requests/626 and
https://git.pleroma.social/pleroma/pleroma-fe/-/merge_requests/450 .
They introduced image descriptions to the front- and backend,
but predate adoption of Mastodon API.
For a while adding an `descriptions` array on post creation might have
continued to work as an undocumented Pleroma extension to Masto API, but
at latest when OpenAPI specs were added for those endpoints four years
ago in 7803a85d2c
, these codepaths ceased
to be used. The API specs don’t list a `descriptions` parameter and
any unknown parameters are stripped out.
The attachments_from_ids function is only called from
ScheduledActivity and ActivityDraft.create with the latter
only being called by CommonAPI.{post,update} whihc in turn
are only called from ScheduledActivity again, MastoAPI controller
and without any attachment or description parameter WelcomeMessage.
Therefore no codepath can contain a descriptions parameter.
2024-05-22 20:18:08 +02:00
873aa9da1c
activity_draft: mark new/2 as private
2024-05-22 20:18:08 +02:00
34a48cb87f
scheduled_activity: mark private functions as private
...
And remove unused due_activities/1
2024-05-22 20:18:08 +02:00
lain
50403351f4
add impostor test for webfinger
2024-05-22 19:17:34 +01:00
Alex Gleason
a953b1d927
Prevent spoofing webfinger
2024-05-22 19:08:37 +01:00
76ded10a70
Merge pull request 'Backoff on HTTP requests when 429 is recieved' ( #762 ) from backoff-http into develop
...
ci/woodpecker/push/build-amd64 Pipeline is pending
ci/woodpecker/push/build-arm64 Pipeline is pending
ci/woodpecker/push/docs Pipeline is pending
ci/woodpecker/push/lint Pipeline is pending
ci/woodpecker/push/test Pipeline is pending
Reviewed-on: #762
2024-05-11 04:38:47 +00:00
4457928e32
duct-tape fix for #438
...
ci/woodpecker/push/build-amd64 Pipeline is pending
ci/woodpecker/push/build-arm64 Pipeline is pending
ci/woodpecker/push/docs Pipeline is pending
ci/woodpecker/push/lint Pipeline is pending
ci/woodpecker/push/test Pipeline is pending
we really need to make this less manual
2024-05-11 05:30:18 +01:00
ee03149ba1
Merge pull request 'Fix Exiftool migration id' ( #763 ) from Oneric/akkoma:fix-migration-timeline-exifdesc into develop
...
ci/woodpecker/push/build-amd64 Pipeline is pending
ci/woodpecker/push/build-arm64 Pipeline is pending
ci/woodpecker/push/docs Pipeline is pending
ci/woodpecker/push/lint Pipeline is pending
ci/woodpecker/push/test Pipeline is pending
Reviewed-on: #763
2024-05-06 22:51:05 +00:00
ea6bc8a7c5
add a test for 503-rate-limiting
ci/woodpecker/push/build-amd64 Pipeline is pending
ci/woodpecker/push/build-arm64 Pipeline is pending
ci/woodpecker/push/docs Pipeline is pending
ci/woodpecker/push/lint Pipeline is pending
ci/woodpecker/push/test Pipeline is pending
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build-amd64 Pipeline was successful
ci/woodpecker/pr/build-arm64 Pipeline was successful
ci/woodpecker/pr/docs Pipeline was successful
2024-05-06 23:36:00 +01:00
bd74693db6
additionally support retry-after values
ci/woodpecker/push/build-amd64 Pipeline is pending
ci/woodpecker/push/build-arm64 Pipeline is pending
ci/woodpecker/push/docs Pipeline is pending
ci/woodpecker/push/lint Pipeline is pending
ci/woodpecker/push/test Pipeline is pending
ci/woodpecker/pr/build-amd64 Pipeline is pending
ci/woodpecker/pr/build-arm64 Pipeline is pending
ci/woodpecker/pr/docs Pipeline is pending
ci/woodpecker/pr/lint Pipeline is pending
ci/woodpecker/pr/test Pipeline is pending
2024-05-06 23:34:48 +01:00
5256678901
Fix Exiftool migration id
...
ci/woodpecker/pr/build-amd64 Pipeline is pending
ci/woodpecker/pr/build-arm64 Pipeline is pending
ci/woodpecker/pr/docs Pipeline is pending
ci/woodpecker/pr/lint Pipeline is pending
ci/woodpecker/pr/test Pipeline is pending
Applying works fine with a 20220220135625 version, but it won’t be
rolled back in the right order. Fortunately this action is idempotent
so we can just rename and reapply it with a new id.
To also not break large-scale rollbacks past 2022 for anyone
who already applied it with the old id, keep a stub migration.
2024-05-07 00:16:21 +02:00
fdeecc7b4c
Merge pull request 'Update clients list in docs' ( #761 ) from norm/akkoma:docs-clients-update into develop
...
ci/woodpecker/push/build-amd64 Pipeline is pending
ci/woodpecker/push/build-arm64 Pipeline is pending
ci/woodpecker/push/docs Pipeline is pending
ci/woodpecker/push/lint Pipeline is pending
ci/woodpecker/push/test Pipeline is pending
Reviewed-on: #761
2024-05-06 21:33:26 +00:00
51482c4fe8
Merge pull request 'Remove remaining Dokku files' ( #766 ) from norm/akkoma:remove-dokku into develop
...
ci/woodpecker/push/build-amd64 Pipeline is pending
ci/woodpecker/push/build-arm64 Pipeline is pending
ci/woodpecker/push/docs Pipeline is pending
ci/woodpecker/push/lint Pipeline is pending
ci/woodpecker/push/test Pipeline is pending
Reviewed-on: #766
2024-05-06 21:33:16 +00:00
8ae54b260a
Remove remaining Dokku files
ci/woodpecker/pr/build-amd64 Pipeline is pending
ci/woodpecker/pr/build-arm64 Pipeline is pending
ci/woodpecker/pr/docs Pipeline is pending
ci/woodpecker/pr/lint Pipeline is pending
ci/woodpecker/pr/test Pipeline is pending
2024-04-29 13:45:58 -04:00
c02e3432d9
Merge branch 'develop' into stable
ci/woodpecker/tag/build-amd64 Pipeline is pending
ci/woodpecker/tag/build-arm64 Pipeline is pending
ci/woodpecker/tag/docs Pipeline is pending
ci/woodpecker/tag/lint Pipeline is pending
ci/woodpecker/tag/test Pipeline is pending
ci/woodpecker/push/lint Pipeline was successful
ci/woodpecker/push/test Pipeline was successful
ci/woodpecker/push/build-arm64 Pipeline was successful
ci/woodpecker/push/build-amd64 Pipeline was successful
ci/woodpecker/push/docs Pipeline was successful
2024-04-27 15:11:04 +01:00
21a81e1111
version bump with translations
ci/woodpecker/push/build-amd64 Pipeline is pending
ci/woodpecker/push/build-arm64 Pipeline is pending
ci/woodpecker/push/docs Pipeline is pending
ci/woodpecker/push/lint Pipeline is pending
ci/woodpecker/push/test Pipeline is pending
2024-04-27 15:10:52 +01:00
3738ab67bd
Merge remote-tracking branch 'origin/translations' into develop
ci/woodpecker/push/build-amd64 Pipeline is pending
ci/woodpecker/push/build-arm64 Pipeline is pending
ci/woodpecker/push/docs Pipeline is pending
ci/woodpecker/push/lint Pipeline is pending
ci/woodpecker/push/test Pipeline is pending
2024-04-27 15:10:23 +01:00
f614bf2725
Merge branch 'develop' into stable
ci/woodpecker/push/build-amd64 Pipeline is pending
ci/woodpecker/push/build-arm64 Pipeline is pending
ci/woodpecker/push/docs Pipeline is pending
ci/woodpecker/push/lint Pipeline is pending
ci/woodpecker/push/test Pipeline is pending
ci/woodpecker/tag/lint Pipeline failed
ci/woodpecker/tag/test unknown status
ci/woodpecker/tag/build-arm64 unknown status
ci/woodpecker/tag/build-amd64 unknown status
ci/woodpecker/tag/docs unknown status
2024-04-27 15:08:35 +01:00
7038b60ab5
bump version
ci/woodpecker/push/build-amd64 Pipeline is pending
ci/woodpecker/push/build-arm64 Pipeline is pending
ci/woodpecker/push/docs Pipeline is pending
ci/woodpecker/push/lint Pipeline is pending
ci/woodpecker/push/test Pipeline is pending
2024-04-27 15:08:21 +01:00
549d580054
Add Enafore to clients list
ci/woodpecker/pr/build-amd64 Pipeline is pending
ci/woodpecker/pr/build-arm64 Pipeline is pending
ci/woodpecker/pr/docs Pipeline is pending
ci/woodpecker/pr/lint Pipeline is pending
ci/woodpecker/pr/test Pipeline is pending
2024-04-26 15:21:58 -04:00
010e8c7bb2
where were you when lint fail
ci/woodpecker/push/build-amd64 Pipeline is pending
ci/woodpecker/push/build-arm64 Pipeline is pending
ci/woodpecker/push/docs Pipeline is pending
ci/woodpecker/push/lint Pipeline is pending
ci/woodpecker/push/test Pipeline is pending
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build-arm64 unknown status
ci/woodpecker/pr/build-amd64 unknown status
ci/woodpecker/pr/docs unknown status
2024-04-26 19:28:01 +01:00
9671cdecdf
changelog entry
ci/woodpecker/push/build-amd64 Pipeline is pending
ci/woodpecker/push/build-arm64 Pipeline is pending
ci/woodpecker/push/docs Pipeline is pending
ci/woodpecker/push/lint Pipeline is pending
ci/woodpecker/push/test Pipeline is pending
ci/woodpecker/pr/lint Pipeline failed
ci/woodpecker/pr/test unknown status
ci/woodpecker/pr/build-arm64 unknown status
ci/woodpecker/pr/build-amd64 unknown status
ci/woodpecker/pr/docs unknown status
2024-04-26 19:10:17 +01:00
f531484063
Merge branch 'develop' into backoff-http
ci/woodpecker/push/build-amd64 Pipeline is pending
ci/woodpecker/push/build-arm64 Pipeline is pending
ci/woodpecker/push/docs Pipeline is pending
ci/woodpecker/push/lint Pipeline is pending
ci/woodpecker/push/test Pipeline is pending
ci/woodpecker/pr/build-amd64 Pipeline is pending
ci/woodpecker/pr/build-arm64 Pipeline is pending
ci/woodpecker/pr/docs Pipeline is pending
ci/woodpecker/pr/lint Pipeline is pending
ci/woodpecker/pr/test Pipeline is pending
2024-04-26 19:06:18 +01:00
ec7e9da734
Correct ttl syntax for new cachex
2024-04-26 19:05:12 +01:00
3c384c1b76
Add ratelimit backoff to HTTP get
2024-04-26 19:01:12 +01:00
2437a3e9ba
add test for backoff
2024-04-26 19:01:01 +01:00
ad7dcf38a8
Add HTTP backoff cache to respect 429s
2024-04-26 19:00:35 +01:00
Weblate
91d9d750c0
Update translation files
...
ci/woodpecker/push/build-amd64 Pipeline is pending
ci/woodpecker/push/build-arm64 Pipeline is pending
ci/woodpecker/push/docs Pipeline is pending
ci/woodpecker/push/lint Pipeline is pending
ci/woodpecker/push/test Pipeline is pending
Updated by "Squash Git commits" hook in Weblate.
Translation: Pleroma fe/Akkoma Backend (Static pages)
Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-static-pages/
2024-04-26 17:49:40 +00:00
Weblate
3c07aa506d
Translated using Weblate (Chinese (Traditional))
...
Currently translated at 100.0% (91 of 91 strings)
Co-authored-by: Toot <toothpicker@users.noreply.translate.akkoma.dev>
Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-static-pages/zh_Hant/
Translation: Pleroma fe/Akkoma Backend (Static pages)
2024-04-26 17:49:40 +00:00
Weblate
64050b0fb5
Update translation files
...
Updated by "Squash Git commits" hook in Weblate.
Co-authored-by: Weblate <noreply@weblate.org>
Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-errors/
Translation: Pleroma fe/Akkoma Backend (Errors)
2024-04-26 17:49:40 +00:00
Weblate
7babc11475
Update translation files
...
Updated by "Squash Git commits" hook in Weblate.
Co-authored-by: Weblate <noreply@weblate.org>
Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-errors/
Translation: Pleroma fe/Akkoma Backend (Errors)
2024-04-26 17:49:40 +00:00
828158ef49
Merge remote-tracking branch 'oneric/fedfix-public-ld' into develop
ci/woodpecker/push/build-amd64 Pipeline is pending
ci/woodpecker/push/build-arm64 Pipeline is pending
ci/woodpecker/push/docs Pipeline is pending
ci/woodpecker/push/lint Pipeline is pending
ci/woodpecker/push/test Pipeline is pending
2024-04-26 18:49:31 +01:00
c7276713e0
Merge remote-tracking branch 'oneric/changelog-3.13' into develop
ci/woodpecker/push/build-amd64 Pipeline is pending
ci/woodpecker/push/build-arm64 Pipeline is pending
ci/woodpecker/push/docs Pipeline is pending
ci/woodpecker/push/lint Pipeline is pending
ci/woodpecker/push/test Pipeline is pending
2024-04-26 18:43:39 +01:00
310c1b7e24
Merge pull request 'Change nginx cache size to 1 GiB' ( #759 ) from norm/akkoma:nginx-cache-size into develop
...
ci/woodpecker/push/build-amd64 Pipeline is pending
ci/woodpecker/push/build-arm64 Pipeline is pending
ci/woodpecker/push/docs Pipeline is pending
ci/woodpecker/push/lint Pipeline is pending
ci/woodpecker/push/test Pipeline is pending
Reviewed-on: #759
2024-04-26 17:40:23 +00:00
7da6f41718
Merge pull request 'Exiftool: Strip all non-essential metadata tags' ( #745 ) from Oneric/akkoma:exiftool-strip-all into develop
...
ci/woodpecker/push/build-amd64 Pipeline is pending
ci/woodpecker/push/build-arm64 Pipeline is pending
ci/woodpecker/push/docs Pipeline is pending
ci/woodpecker/push/lint Pipeline is pending
ci/woodpecker/push/test Pipeline is pending
Reviewed-on: #745
2024-04-26 17:38:47 +00:00
53c67993bb
Merge pull request 'Remove unused top level files' ( #760 ) from norm/akkoma:remove-unused-files into develop
...
ci/woodpecker/push/build-amd64 Pipeline is pending
ci/woodpecker/push/build-arm64 Pipeline is pending
ci/woodpecker/push/docs Pipeline is pending
ci/woodpecker/push/lint Pipeline is pending
ci/woodpecker/push/test Pipeline is pending
Reviewed-on: #760
2024-04-26 17:24:21 +00:00
5bc64c5753
changelog: add note about StripMetadata and ReadDescription order
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/test Pipeline failed
ci/woodpecker/pr/build-arm64 unknown status
ci/woodpecker/pr/build-amd64 unknown status
ci/woodpecker/pr/docs unknown status
2024-04-26 18:57:28 +02:00
5ee0fb18cb
exiftool: make stripped tags configurable
2024-04-26 18:57:24 +02:00
771a306dc1
Update clients list in docs
...
ci/woodpecker/pr/build-amd64 Pipeline is pending
ci/woodpecker/pr/build-arm64 Pipeline is pending
ci/woodpecker/pr/docs Pipeline is pending
ci/woodpecker/pr/lint Pipeline is pending
ci/woodpecker/pr/test Pipeline is pending
- Warn that the apps here are not officially supported
- Update Kaiteki's social profile
- Remove Fedi App
- Add Subway Tooter
2024-04-26 04:17:17 -04:00