90676bdfe3
Merge branch 'fix/csp-mediaproxy-base-url' into 'develop'
...
HTTP security plug: add media proxy base url host to csp
See merge request pleroma/pleroma!2638
2020-06-12 20:43:59 +03:00
rinpatch
cd2df734dd
Merge branch 'bugfix/csp-unproxied' into 'develop'
...
http_security_plug.ex: Fix non-proxied media
See merge request pleroma/pleroma!2610
2020-06-12 20:43:36 +03:00
Haelwenn (lanodan) Monnier
e313aa0977
static-fe.css: Restore and move to /priv/static/static-fe
2020-06-12 20:42:43 +03:00
rinpatch
a51284b60a
Merge branch 'fix/mediaproxy-bypass-emoji' into 'develop'
...
Fix profile emojis bypassing mediaproxy and harden CSP
Closes #1810
See merge request pleroma/pleroma!2596
2020-06-08 00:58:30 +03:00
rinpatch
b6ca8cc539
Merge branch 'bugfix/1727-fix-signature-decoding' into 'develop'
...
Bugfix/1727 fix signature decoding
Closes #1727
See merge request pleroma/pleroma!2454
2020-05-01 22:10:42 +03:00
lain
a4afeed426
Uploads: Sandbox them in the CSP.
2020-05-01 01:37:26 +03:00
Ivan Tashkinov
862d4886c9
[ #1682 ] Fixed Basic Auth permissions issue by disabling OAuth scopes checks when password is provided. Refactored plugs skipping functionality.
2020-05-01 01:00:37 +03:00
rinpatch
da4923f2e5
Merge branch 'authenticated-api-oauth-check-enforcement' into 'develop'
...
Enforcement of OAuth scopes check for authenticated API endpoints
See merge request pleroma/pleroma!2349
2020-05-01 00:58:40 +03:00
Alex Gleason
6e0b046771
Let blob: pass CSP
2020-05-01 00:40:09 +03:00
rinpatch
c46d035f7b
rate limiter: disable based on if remote ip was found, not on if the plug was enabled
...
The current rate limiter disable logic won't trigger when the remote ip
is not forwarded, only when the remoteip plug is not enabled, which is
not the case on most instances since it's enabled by default. This
changes the behavior to warn and disable when the remote ip was not forwarded,
even if the RemoteIP plug is enabled.
Also closes #1620
2020-03-16 00:15:21 +03:00
rinpatch
0b823755a2
Merge branch 'fix/cache-control-headers' into 'develop'
...
Fix Cache Control headers on media
See merge request pleroma/pleroma!2295
2020-03-15 17:01:04 +03:00
Phil Hagelberg
bd80ff9a6c
Fix static FE plug to handle missing Accept header.
2020-03-15 17:00:06 +03:00
Mark Felder
05da5f5cca
Update Copyrights
2020-03-03 16:44:49 -06:00
Haelwenn (lanodan) Monnier
6da6540036
Bump copyright years of files changed after 2020-01-07
...
Done via the following command:
git diff fcd5dd259a
2020-03-02 06:08:45 +01:00
rinpatch
4d416343fa
rate limiter: Fix a race condition
...
When multiple requests are processed by rate limiter plug at the same
time and the bucket is not yet initialized, both would try to initialize
the bucket resulting in an internal server error.
2020-03-01 01:13:07 +03:00
Ivan Tashkinov
c747260989
[ #2250 ] Tiny refactoring per merge request review.
2020-02-29 22:04:09 +03:00
Ivan Tashkinov
3759b146c4
Apply suggestion to lib/pleroma/plugs/rate_limiter/rate_limiter.ex
2020-02-28 13:33:42 +00:00
Ivan Tashkinov
6f2efb1c45
Runtime configurability of RateLimiter. Refactoring. Disabled default rate limits in tests.
2020-02-27 18:46:05 +03:00
lain
3eddd9caa6
Merge branch 'require-signature' into 'develop'
...
Add an option to require fetches to be signed
Closes #1444
See merge request pleroma/pleroma!2071
2020-02-20 12:13:21 +00:00
rinpatch
15ea75cd2a
Actually fix upload limit on OTP releases
...
Closes #1109
2020-02-07 20:14:06 +03:00
rinpatch
c27d1d65bf
Merge branch 'fix/disable-rate-limiter-for-socket-localhost' into 'develop'
...
Disable rate limiter for socket/localhost
Closes #1380
See merge request pleroma/pleroma!2064
2020-01-30 19:24:04 +00:00
rinpatch
5b62acf6e9
Merge branch 'develop' into fix/disable-rate-limiter-for-socket-localhost
2020-01-30 22:16:55 +03:00
lain
774cba84f5
Merge branch 'reenable-rate-limit-and-remote-ip' into 'develop'
...
Re-enable rate limiter and enable remote ip
See merge request pleroma/pleroma!2164
2020-01-30 18:47:44 +00:00
36becd5573
Update http_security_plug.ex
2020-01-30 14:07:41 +00:00
rinpatch
889965141a
RemoteIp: only trust X-Forwarded-For
...
Our nginx config will happily pass `Forwarded`/`X-Real-IP` from the
client. Caddy, Apache and Varnish pass `X-Forwarded-For` as well anyway.
2020-01-30 00:06:58 +03:00
Egor Kislitsyn
e07e7888d7
Fix credo warning
2020-01-29 18:53:43 +04:00
Egor Kislitsyn
2bd4d6289b
Make the warning more scarier
2020-01-29 18:43:23 +04:00
Egor Kislitsyn
6302b40791
Warn if HTTPSecurityPlug is disabled
2020-01-28 19:14:09 +04:00
Maksim Pechnikov
108a39c876
updated error messages for authentication process
2020-01-17 15:01:37 +03:00
Ivan Tashkinov
39ce894a07
Merge remote-tracking branch 'remotes/origin/develop' into 1478-oauth-admin-scopes-tweaks
...
# Conflicts:
# lib/pleroma/user.ex
2020-01-10 16:18:32 +03:00
Ivan Tashkinov
6c94b7498b
[ #1478 ] OAuth admin tweaks: enforced OAuth admin scopes usage by default, migrated existing OAuth records. Adjusted tests.
2020-01-10 10:52:21 +03:00
Egor Kislitsyn
775212121c
Verify HTTP signatures only when request accepts "activity+json" type
2019-12-19 20:17:18 +07:00
Egor Kislitsyn
a12b6454bb
Add an option to require fetches to be signed
2019-12-16 22:24:03 +07:00
Ivan Tashkinov
7973cbdb9f
OAuthScopesPlug: disallowed nil token (unless with :fallback option). WIP: controller tests modification: OAuth scopes usage.
2019-12-15 22:32:42 +03:00
Maxim Filippov
eb11c60289
Disable rate limiter for socket/localhost (unless RemoteIp is enabled)
2019-12-14 03:06:43 +03:00
Ivan Tashkinov
3920244be5
[ #1427 ] Fixed :admin option handling in OAuthScopesPlug, added tests.
2019-12-11 11:42:02 +03:00
Ivan Tashkinov
835ac2157c
Merge remote-tracking branch 'remotes/upstream/develop' into 1427-oauth-admin-scopes
...
# Conflicts:
# CHANGELOG.md
2019-12-10 08:55:14 +03:00
rinpatch
3c45ed4f47
OTP: Fix runtime upload limit config being ignored
...
Closes #1109
2019-12-08 21:08:25 +03:00
Ivan Tashkinov
1770602747
[ #1427 ] Extra check that admin OAuth scope is used by admin. Adjusted tests.
2019-12-07 17:49:53 +03:00
Ivan Tashkinov
40e1817f70
[ #1427 ] Fixes / improvements of admin scopes support. Added tests.
2019-12-06 20:33:47 +03:00
Ivan Tashkinov
93a80ee915
[ #1427 ] Bugfix for enforce_oauth_admin_scope_usage. Admin API documentation entry.
2019-12-06 16:56:23 +03:00
Ivan Tashkinov
af42c00cff
[ #1427 ] Reworked admin scopes support.
...
Requalified users.is_admin flag as legacy accessor to admin actions in case token lacks admin scope(s).
2019-12-06 00:25:44 +03:00
Egor Kislitsyn
36686f5245
Support authentication via x-admin-token HTTP header
2019-11-19 15:58:20 +07:00
rinpatch
22554ac5ca
Merge branch 'bugfix/1395-email-activation' into 'develop'
...
Bugfix/1395 email activation
Closes #1395
See merge request pleroma/pleroma!1965
2019-11-15 14:11:48 +00:00
lain
f17e0f8e4f
OAuthPlug, Router: Handle deactivated users in the UserEnabledPlug
2019-11-15 14:13:21 +01:00
kaniini
2cc043591c
Merge branch 'feature/static-fe' into 'develop'
...
Static frontend
See merge request pleroma/pleroma!1917
2019-11-11 19:10:44 +00:00
Steven Fuchs
94627baa5c
New rate limiter
2019-11-11 12:13:06 +00:00
lain
f6056e9c9c
UserEnabledPlug: Don't authenticate unconfirmed users.
2019-11-11 12:43:46 +01:00
Phil Hagelberg
886a07ba57
Move static_fe config to its own section instead of in :instance.
2019-11-09 18:08:45 -08:00
Phil Hagelberg
8969c5522d
Make many of the improvements suggested in review.
2019-11-09 18:08:08 -08:00
