Commit graph

114 commits

Author SHA1 Message Date
a388d2503e revert uploaded-media
Some checks are pending
ci/woodpecker/tag/woodpecker Pipeline is pending
ci/woodpecker/push/woodpecker Pipeline was successful
2023-05-26 12:06:41 +01:00
7fb9960ccd Add CSP to mediaproxy links
Some checks are pending
ci/woodpecker/push/woodpecker Pipeline is pending
ci/woodpecker/tag/woodpecker Pipeline is pending
2023-05-26 11:46:18 +01:00
522221f7fb Mix format 2023-04-14 17:56:34 +01:00
f12d3cce39 ensure only pickable frontends can be returned 2023-04-14 17:42:40 +01:00
a079ec3a3c in dev, allow dev FE 2023-04-14 16:36:40 +01:00
1b2c24a19e fix tests 2023-04-14 15:20:55 +01:00
de64c6c54a add selection UI 2023-03-28 12:44:52 +01:00
643b8c5f15 ensure we send the right files for preferred fe 2023-03-12 23:59:10 +00:00
70803d7966 Remove mix.env reference 2023-03-11 18:24:44 +00:00
8a4437d2be Allow expires_at in filter requests
Some checks are pending
ci/woodpecker/push/woodpecker Pipeline is pending
Fixes #492
2023-03-09 19:13:14 +00:00
336d06b2a8 Significantly tighten HTTP CSP
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
2023-01-02 15:21:19 +00:00
9be6caf125 argon2 password hashing (#406)
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
Co-authored-by: FloatingGhost <hannah@coffee-and-dreams.uk>
Reviewed-on: #406
2022-12-30 02:46:58 +00:00
Atsuko Karagi
4a78c431cf Simplified HTTP signature processing
Some checks are pending
ci/woodpecker/push/woodpecker Pipeline is pending
2022-12-19 20:41:48 +00:00
9a320ba814 make 2fa UI less awful
Some checks failed
ci/woodpecker/push/woodpecker Pipeline is pending
ci/woodpecker/pr/woodpecker Pipeline failed
2022-12-16 11:50:25 +00:00
d1a0d93bf7 document prometheus 2022-12-16 10:24:36 +00:00
c2054f82ab allow users with admin:metrics to read app metrics
Some checks are pending
ci/woodpecker/push/woodpecker Pipeline is pending
2022-12-16 03:32:51 +00:00
e2320f870e Add prometheus metrics to router
Some checks are pending
ci/woodpecker/push/woodpecker Pipeline is pending
2022-12-15 02:02:07 +00:00
07a48b9293 giant massive dep upgrade and dialyxir-found error emporium (#371)
Some checks are pending
ci/woodpecker/push/woodpecker Pipeline is pending
Co-authored-by: FloatingGhost <hannah@coffee-and-dreams.uk>
Reviewed-on: #371
2022-12-14 12:38:48 +00:00
1afba64464 Redirect to standard FE if logged in
Some checks are pending
ci/woodpecker/push/woodpecker Pipeline is pending
2022-12-07 13:35:00 +00:00
a90c45b7e9 Add Signed Fetch Statistics (#312)
Some checks are pending
ci/woodpecker/push/woodpecker Pipeline is pending
Close #304.

Notes:
 - This patch was made on top of Pleroma develop, so I created a separate cachex worker for request signature actions, instead of Akkoma's instance cache. If that is a merge blocker, I can attempt to move logic around for that.
 - Regarding the `has_request_signatures: true -> false` state transition: I think that is a higher level thing (resetting instance state on new instance actor key) which is separate from the changes relevant to this one.

Co-authored-by: Luna <git@l4.pm>
Reviewed-on: #312
Co-authored-by: @luna@f.l4.pm <akkoma@l4.pm>
Co-committed-by: @luna@f.l4.pm <akkoma@l4.pm>
2022-11-26 19:22:56 +00:00
@r3g_5z@plem.sapphic.site
0e4c201f8d HTTP header improvements (#294)
Some checks are pending
ci/woodpecker/push/woodpecker Pipeline is pending
- Drop Expect-CT

Expect-CT has been redundant since 2018 when Certificate Transparency became mandated and required for all CAs and browsers. This header is only implemented in Chrome and is now deprecated. HTTP header analysers do not check this anymore as this is enforced by default. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expect-CT

- Raise HSTS to 2 years and explicitly preload

The longer age for HSTS, the better. Header analysers prefer 2 years over 1 year now as free TLS is very common using Let's Encrypt.
For HSTS to be fully effective, you need to submit your root domain (domain.tld) to https://hstspreload.org. However, a requirement for this is the "preload" directive in Strict-Transport-Security. If you do not have "preload", it will reject your domain.

- Drop X-Download-Options

This is an IE8-era header when Adobe products used to use the IE engine for making outbound web requests to embed webpages in things like Adobe Acrobat (PDFs). Modern apps are using Microsoft Edge WebView2 or Chromium Embedded Framework. No modern browser checks or header analyser check for this.

- Set base-uri to 'none'

This is to specify the domain for relative links (`<base>` HTML tag). pleroma-fe does not use this and it's an incredibly niche tag.

I use all of these myself on my instance by rewriting the headers with zero problems. No breakage observed.

I have not compiled my Elixr changes, but I don't see why they'd break.

Co-authored-by: r3g_5z <june@terezi.dev>
Reviewed-on: #294
Co-authored-by: @r3g_5z@plem.sapphic.site <june@terezi.dev>
Co-committed-by: @r3g_5z@plem.sapphic.site <june@terezi.dev>
2022-11-20 21:20:06 +00:00
r3g_5z
f90552f62e
Drop XSS auditor
All checks were successful
ci/woodpecker/pr/woodpecker Pipeline was successful
It's deprecated, removed in some, by all modern browsers and is known
to create XSS vulnerabilities in itself.

Signed-off-by: r3g_5z <june@terezi.dev>
2022-11-19 20:40:20 -05:00
89dbc7177b Chores for 2022.11
Some checks are pending
ci/woodpecker/push/woodpecker Pipeline is pending
ci/woodpecker/pr/woodpecker Pipeline is pending
2022-11-11 16:12:04 +00:00
ac0c00cdee Add media sources to connect-src if media proxy is enabled
Some checks failed
ci/woodpecker/push/woodpecker Pipeline failed
2022-11-10 17:26:51 +00:00
bab1ab5b6c strip \r and \r from content-disposition filenames 2022-11-10 11:54:12 +00:00
4d0a51221a
Fix typo in CSP Report-To header name
Some checks failed
ci/woodpecker/pr/woodpecker Pipeline failed
The header name was Report-To, not Reply-To.

In any case, that's now being changed to the Reporting-Endpoints HTTP
Response Header.
https://w3c.github.io/reporting/#header
https://github.com/w3c/reporting/issues/177

CanIUse says the Report-To header is still supported by current Chrome
and friends.
https://caniuse.com/mdn-http_headers_report-to

It doesn't have any data for the Reporting-Endpoints HTTP header, but
this article says Chrome 96 supports it.
https://web.dev/reporting-api/

(Even though that's come out one year ago, that's not compatible with
Network Error Logging which's still using the Report-To version of the
API)

Signed-off-by: Thomas Citharel <tcit@tcit.fr>
2022-11-04 15:02:13 +01:00
03662501c3 Check that the signature matches the creator
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
ci/woodpecker/pr/woodpecker Pipeline was successful
2022-10-14 11:48:32 +01:00
1acd38fe7f OAuthPlug: use user cache instead of joining
As this plug is called on every request, this should reduce load on the
database by not requiring to select on the users table every single
time, and to instead use the by-ID user cache whenever possible.
2022-09-11 19:55:55 +01:00
772c209914 GTS: cherry-picks and collection usage (#186)
Some checks are pending
ci/woodpecker/push/woodpecker Pipeline is pending
https://git.pleroma.social/pleroma/pleroma/-/merge_requests/3725?commit_id=61254111e59f02118cad15de49d1e0704c07030e

what is this, a yoink of a yoink? good times

Co-authored-by: Hélène <pleroma-dev@helene.moe>
Co-authored-by: FloatingGhost <hannah@coffee-and-dreams.uk>
Reviewed-on: #186
2022-08-27 18:05:48 +00:00
8d7b63a766 Revert "Fix oauth2 (for real) (#179)"
Some checks are pending
ci/woodpecker/push/woodpecker Pipeline is pending
This reverts commit aa681d7e15.
2022-08-21 17:52:02 +01:00
aa681d7e15 Fix oauth2 (for real) (#179)
Some checks are pending
ci/woodpecker/push/woodpecker Pipeline is pending
Reviewed-on: #179
2022-08-21 16:24:37 +00:00
b0130bfa7b Revert "oauth2 fixes (#177)"
Some checks are pending
ci/woodpecker/push/woodpecker Pipeline is pending
This reverts commit 429e2ac832.
2022-08-21 16:22:15 +01:00
429e2ac832 oauth2 fixes (#177)
Some checks are pending
ci/woodpecker/push/woodpecker Pipeline is pending
Reviewed-on: #177
2022-08-21 14:46:52 +00:00
55179d4214 set soapbox-fe v2 by default
Some checks are pending
ci/woodpecker/push/woodpecker Pipeline is pending
fixes #157
2022-08-11 10:25:03 +01:00
ec162b496b /notice signing checks on redirect (#150)
Some checks are pending
ci/woodpecker/push/woodpecker Pipeline is pending
Reviewed-on: #150
2022-08-05 19:31:32 +00:00
d598c7a834 remove anonymous function from plug
All checks were successful
ci/woodpecker/push/release Pipeline was successful
ci/woodpecker/push/lint Pipeline was successful
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/release Pipeline was successful
ci/woodpecker/push/test Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
2022-07-14 11:17:14 +01:00
37ae047e16 Add swaggerUI options (#66)
Some checks failed
ci/woodpecker/push/lint Pipeline was successful
ci/woodpecker/push/release Pipeline failed
ci/woodpecker/push/test Pipeline was successful
Reviewed-on: #66
2022-07-13 15:09:35 +00:00
364b6969eb Use finch everywhere (#33)
Some checks failed
ci/woodpecker/push/lint Pipeline failed
ci/woodpecker/push/test unknown status
ci/woodpecker/push/release Pipeline was successful
Reviewed-on: #33
2022-07-04 16:30:38 +00:00
Tusooa Zhu
3fd87b6a75 Skip cache when /objects or /activities is authenticated
Ref: fix-local-public
2022-06-29 20:47:27 +01:00
Tusooa Zhu
932e5df19e Allow to skip cache in Cache plug
Ref: fix-local-public
2022-06-29 20:47:26 +01:00
Tusooa Zhu
07bd35227a Support multiple locales from userLanguage cookie 2022-06-29 20:47:10 +01:00
Tusooa Zhu
fa95bc8725 Support multiple locales formally
elixir gettext current does not fully support fallback to another language [0].
But it might in the future. We adapt it so that all languages in Accept-Language
headers are received by Pleroma.Web.Gettext. User.languages is now a comma-separated
list.

[0]: https://github.com/elixir-gettext/gettext/issues/303
2022-06-29 20:47:10 +01:00
Tusooa Zhu
ef73f61b07 Fallback to a variant if the language in general is not supported
For an example, here, zh is not supported, but zh_Hans and zh_Hant
are. If the user asks for zh, we should choose a variant for them
instead of fallbacking to default.

Some browsers (e.g. Firefox) does not allow users to customize
their language codes. For example, there is no zh-Hans, but only
zh, zh-CN, zh-TW, zh-HK, etc. This provides a workaround for
those users suffering from bad design decisions.
2022-06-29 20:47:10 +01:00
Tusooa Zhu
72bdb0640f Allow user to register with custom language 2022-06-29 20:46:51 +01:00
Tusooa Zhu
7726148472 Send emails i18n'd using backend-stored user language 2022-06-29 20:45:19 +01:00
Tusooa Zhu
8f08c902a5 Make lint happy 2022-06-29 20:44:16 +01:00
Tusooa Zhu
775f997c40 Prefer userLanguage cookie over Accept-Language header in detecting locale
https://git.pleroma.social/pleroma/pleroma-meta/-/issues/60
2022-06-29 20:43:41 +01:00
502382da45 cherry-pick security from upstream
Some checks failed
ci/woodpecker/push/release Pipeline was successful
ci/woodpecker/push/lint Pipeline failed
ci/woodpecker/push/test unknown status
2022-06-22 16:25:05 +01:00
Alex Gleason
138f5a4517
EnsureStaffPrivilegedPlug: don't let non-moderators through 2021-12-27 17:18:26 -06:00
f02715c4b2 Fix lint errors 2021-12-27 03:42:03 +03:00