Beefox/akkoma
1
0
Fork 0
forked from AkkomaGang/akkoma
Code Issues Pull requests Projects Releases Packages Wiki Activity
8763 commits 19 branches 57 tags 305 MiB
Commit graph

182 commits

Author SHA1 Message Date
rinpatch
a51284b60a Merge branch 'fix/mediaproxy-bypass-emoji' into 'develop' 
Fix profile emojis bypassing mediaproxy and harden CSP

Closes #1810

See merge request pleroma/pleroma!2596
 2020-06-08 00:58:30 +03:00
rinpatch
b6ca8cc539 Merge branch 'bugfix/1727-fix-signature-decoding' into 'develop' 
Bugfix/1727 fix signature decoding

Closes #1727

See merge request pleroma/pleroma!2454
 2020-05-01 22:10:42 +03:00
lain
a4afeed426 Uploads: Sandbox them in the CSP. 2020-05-01 01:37:26 +03:00
Ivan Tashkinov
862d4886c9 [#1682] Fixed Basic Auth permissions issue by disabling OAuth scopes checks when password is provided. Refactored plugs skipping functionality. 2020-05-01 01:00:37 +03:00
rinpatch
da4923f2e5 Merge branch 'authenticated-api-oauth-check-enforcement' into 'develop' 
Enforcement of OAuth scopes check for authenticated API endpoints

See merge request pleroma/pleroma!2349
 2020-05-01 00:58:40 +03:00
Alex Gleason
6e0b046771 Let blob: pass CSP 2020-05-01 00:40:09 +03:00
rinpatch
c46d035f7b rate limiter: disable based on if remote ip was found, not on if the plug was enabled 
The current rate limiter disable logic won't trigger when the remote ip
is not forwarded, only when the remoteip plug is not enabled, which is
not the case on most instances since it's enabled by default. This
changes the behavior to warn and disable  when the remote ip was not forwarded,
even if the RemoteIP plug is enabled.

Also closes #1620
 2020-03-16 00:15:21 +03:00
rinpatch
0b823755a2 Merge branch 'fix/cache-control-headers' into 'develop' 
Fix Cache Control headers on media

See merge request pleroma/pleroma!2295
 2020-03-15 17:01:04 +03:00
Phil Hagelberg
bd80ff9a6c Fix static FE plug to handle missing Accept header. 2020-03-15 17:00:06 +03:00
Mark Felder
05da5f5cca Update Copyrights 2020-03-03 16:44:49 -06:00
Haelwenn (lanodan) Monnier
6da6540036
Bump copyright years of files changed after 2020-01-07 
Done via the following command:
git diff fcd5dd259a --stat --name-only | xargs sed -i '/Pleroma Authors/c# Copyright © 2017-2020 Pleroma Authors <https:\/\/pleroma.social\/>'
 2020-03-02 06:08:45 +01:00
rinpatch
4d416343fa rate limiter: Fix a race condition 
When multiple requests are processed by rate limiter plug at the same
time and the bucket is not yet initialized, both would try to initialize
the bucket resulting in an internal server error.
 2020-03-01 01:13:07 +03:00
Ivan Tashkinov
c747260989 [#2250] Tiny refactoring per merge request review. 2020-02-29 22:04:09 +03:00
Ivan Tashkinov
3759b146c4 Apply suggestion to lib/pleroma/plugs/rate_limiter/rate_limiter.ex 2020-02-28 13:33:42 +00:00
Ivan Tashkinov
6f2efb1c45 Runtime configurability of RateLimiter. Refactoring. Disabled default rate limits in tests. 2020-02-27 18:46:05 +03:00
lain
3eddd9caa6 Merge branch 'require-signature' into 'develop' 
Add an option to require fetches to be signed

Closes #1444

See merge request pleroma/pleroma!2071
 2020-02-20 12:13:21 +00:00
rinpatch
15ea75cd2a Actually fix upload limit on OTP releases 
Closes #1109
 2020-02-07 20:14:06 +03:00
rinpatch
c27d1d65bf Merge branch 'fix/disable-rate-limiter-for-socket-localhost' into 'develop' 
Disable rate limiter for socket/localhost

Closes #1380

See merge request pleroma/pleroma!2064
 2020-01-30 19:24:04 +00:00
rinpatch
5b62acf6e9 Merge branch 'develop' into fix/disable-rate-limiter-for-socket-localhost 2020-01-30 22:16:55 +03:00
lain
774cba84f5 Merge branch 'reenable-rate-limit-and-remote-ip' into 'develop' 
Re-enable rate limiter and enable remote ip

See merge request pleroma/pleroma!2164
 2020-01-30 18:47:44 +00:00
feld
36becd5573 Update http_security_plug.ex 2020-01-30 14:07:41 +00:00
rinpatch
889965141a RemoteIp: only trust X-Forwarded-For 
Our nginx config will happily pass `Forwarded`/`X-Real-IP` from the
client. Caddy, Apache and Varnish pass `X-Forwarded-For` as well anyway.
 2020-01-30 00:06:58 +03:00
Egor Kislitsyn
e07e7888d7
Fix credo warning 2020-01-29 18:53:43 +04:00
Egor Kislitsyn
2bd4d6289b
Make the warning more scarier 2020-01-29 18:43:23 +04:00
Egor Kislitsyn
6302b40791
Warn if HTTPSecurityPlug is disabled 2020-01-28 19:14:09 +04:00
Maksim Pechnikov
108a39c876 updated error messages for authentication process 2020-01-17 15:01:37 +03:00
Ivan Tashkinov
39ce894a07 Merge remote-tracking branch 'remotes/origin/develop' into 1478-oauth-admin-scopes-tweaks 
# Conflicts:
#	lib/pleroma/user.ex
 2020-01-10 16:18:32 +03:00
Ivan Tashkinov
6c94b7498b [#1478] OAuth admin tweaks: enforced OAuth admin scopes usage by default, migrated existing OAuth records. Adjusted tests. 2020-01-10 10:52:21 +03:00
Egor Kislitsyn
775212121c
Verify HTTP signatures only when request accepts "activity+json" type 2019-12-19 20:17:18 +07:00
Egor Kislitsyn
a12b6454bb
Add an option to require fetches to be signed 2019-12-16 22:24:03 +07:00
Ivan Tashkinov
7973cbdb9f OAuthScopesPlug: disallowed nil token (unless with :fallback option). WIP: controller tests modification: OAuth scopes usage. 2019-12-15 22:32:42 +03:00
Maxim Filippov
eb11c60289 Disable rate limiter for socket/localhost (unless RemoteIp is enabled) 2019-12-14 03:06:43 +03:00
Ivan Tashkinov
3920244be5 [#1427] Fixed :admin option handling in OAuthScopesPlug, added tests. 2019-12-11 11:42:02 +03:00
Ivan Tashkinov
835ac2157c Merge remote-tracking branch 'remotes/upstream/develop' into 1427-oauth-admin-scopes 
# Conflicts:
#	CHANGELOG.md
 2019-12-10 08:55:14 +03:00
rinpatch
3c45ed4f47 OTP: Fix runtime upload limit config being ignored 
Closes #1109
 2019-12-08 21:08:25 +03:00
Ivan Tashkinov
1770602747 [#1427] Extra check that admin OAuth scope is used by admin. Adjusted tests. 2019-12-07 17:49:53 +03:00
Ivan Tashkinov
40e1817f70 [#1427] Fixes / improvements of admin scopes support. Added tests. 2019-12-06 20:33:47 +03:00
Ivan Tashkinov
93a80ee915 [#1427] Bugfix for enforce_oauth_admin_scope_usage. Admin API documentation entry. 2019-12-06 16:56:23 +03:00
Ivan Tashkinov
af42c00cff [#1427] Reworked admin scopes support. 
Requalified users.is_admin flag as legacy accessor to admin actions in case token lacks admin scope(s).
 2019-12-06 00:25:44 +03:00
Egor Kislitsyn
36686f5245
Support authentication via x-admin-token HTTP header 2019-11-19 15:58:20 +07:00
rinpatch
22554ac5ca Merge branch 'bugfix/1395-email-activation' into 'develop' 
Bugfix/1395 email activation

Closes #1395

See merge request pleroma/pleroma!1965
 2019-11-15 14:11:48 +00:00
lain
f17e0f8e4f OAuthPlug, Router: Handle deactivated users in the UserEnabledPlug 2019-11-15 14:13:21 +01:00
kaniini
2cc043591c Merge branch 'feature/static-fe' into 'develop' 
Static frontend

See merge request pleroma/pleroma!1917
 2019-11-11 19:10:44 +00:00
Steven Fuchs
94627baa5c New rate limiter 2019-11-11 12:13:06 +00:00
lain
f6056e9c9c UserEnabledPlug: Don't authenticate unconfirmed users. 2019-11-11 12:43:46 +01:00
Phil Hagelberg
886a07ba57 Move static_fe config to its own section instead of in :instance. 2019-11-09 18:08:45 -08:00
Phil Hagelberg
8969c5522d Make many of the improvements suggested in review. 2019-11-09 18:08:08 -08:00
Phil Hagelberg
e8bee35578 Static FE plug should only respond to text/html requests. 2019-11-09 18:08:08 -08:00
Phil Hagelberg
dc3b87d153 Move static FE routing into its own plug. 
Previously it was piggybacking on FallbackRedirectController for users
and OStatusController for notices; now it's all in one place.
 2019-11-09 18:08:08 -08:00
rinpatch
365657320c Fix TrailingFormatPlug not being active for /api/oauth_tokens 2019-11-06 17:22:23 +03:00