Merge branch 'stable' into stable-sync/2.1.1

2020-09-08 20:34:02 +03:00 · 2020-09-08 20:34:02 +03:00 · 5ef840ed9c
commit 5ef840ed9c
parent 0d2814ec8e 425324aae3
57 changed files with 13 additions and 12 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -14,29 +14,30 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).

 - **Breaking:** Removed `Pleroma.Workers.Cron.StatsWorker` setting from Oban `:crontab`.

-## unreleased-patch - ???
+## [2.1.1] - 2020-09-08
+
+### Security
+- Fix possible DoS in Mastodon API user search due to an error in match clauses, leading to an infinite recursion and subsequent OOM with certain inputs.
+- Fix metadata leak for accounts and statuses on private instances.
+- Fix possible DoS in Admin API search using an atom leak vulnerability. Authentication with admin rights was required to exploit.

 ### Changed

 - **Breaking:** The metadata providers RelMe and Feed are no longer configurable. RelMe should always be activated and Feed only provides a <link> header tag for the actual RSS/Atom feed when the instance is public.
-
-### Security
- Fix metadata leak for accounts and statuses on private instances
+- Improved error message when cmake is not available at build stage.

 ### Added
-
- Rich media failure tracking (along with `:failure_backoff` option)
- MRF policy to rewrite bot posts scope from public to unlisted
+- Rich media failure tracking (along with `:failure_backoff` option).

 ### Fixed
-
- Possible OOM errors with the default HTTP adapter
+- Default HTTP adapter not respecting pool setting, leading to possible OOM.
 - Fixed uploading webp images when the Exiftool Upload Filter is enabled by skipping them
 - Mastodon API: Search parameter `following` now correctly returns the followings rather than the followers
 - Mastodon API: Timelines hanging for (`number of posts with links * rich media timeout`) in the worst case.
  Reduced to just rich media timeout.
- Mastodon API: Cards being wrong for preview statuses due to cache key collision
- Password resets no longer processed for deactivated accounts
+- Mastodon API: Cards being wrong for preview statuses due to cache key collision.
+- Password resets no longer processed for deactivated accounts.
+- Favicon scraper raising exceptions on URLs longer than 255 characters.

 ## [2.1.0] - 2020-08-28

--- a/priv/static/index.html
+++ b/priv/static/index.html
@ -1 +1 @@
-<!DOCTYPE html><html lang=en><head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1,user-scalable=no"><title>Pleroma</title><!--server-generated-meta--><link rel=icon type=image/png href=/favicon.png><link href=/static/css/app.77b1644622e3bae24b6b.css rel=stylesheet><link href=/static/fontello.1598361006087.css rel=stylesheet></head><body class=hidden><noscript>To use Pleroma, please enable JavaScript.</noscript><div id=app></div><script type=text/javascript src=/static/js/vendors~app.bc5812c087f5dbcb914d.js></script><script type=text/javascript src=/static/js/app.154c25316542278028a6.js></script></body></html>
+<!DOCTYPE html><html lang=en><head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1,user-scalable=no"><title>Pleroma</title><!--server-generated-meta--><link rel=icon type=image/png href=/favicon.png><link href=/static/css/app.77b1644622e3bae24b6b.css rel=stylesheet><link href=/static/fontello.1599568314856.css rel=stylesheet></head><body class=hidden><noscript>To use Pleroma, please enable JavaScript.</noscript><div id=app></div><script type=text/javascript src=/static/js/vendors~app.90c4af83c1ae68f4cd95.js></script><script type=text/javascript src=/static/js/app.55d173dc5e39519aa518.js></script></body></html>
--- a/priv/static/static/font/fontello.1598361006087.woff2
+++ b/priv/static/static/font/fontello.1598361006087.woff2
--- a/priv/static/static/font/fontello.1599568314856.eot
+++ b/priv/static/static/font/fontello.1599568314856.eot
--- a/priv/static/static/font/fontello.1599568314856.svg
+++ b/priv/static/static/font/fontello.1599568314856.svg
--- a/priv/static/static/font/fontello.1599568314856.ttf
+++ b/priv/static/static/font/fontello.1599568314856.ttf
--- a/priv/static/static/font/fontello.1599568314856.woff
+++ b/priv/static/static/font/fontello.1599568314856.woff
--- a/priv/static/static/font/fontello.1599568314856.woff2
+++ b/priv/static/static/font/fontello.1599568314856.woff2
--- a/priv/static/static/fontello.1599568314856.css
+++ b/priv/static/static/fontello.1599568314856.css
--- a/priv/static/static/js/10.1c5cd5fbe554eca63dfe.js
+++ b/priv/static/static/js/10.1c5cd5fbe554eca63dfe.js
--- a/priv/static/static/js/10.46fbbdfaf0d4800f349b.js
+++ b/priv/static/static/js/10.46fbbdfaf0d4800f349b.js
--- a/priv/static/static/js/10.46fbbdfaf0d4800f349b.js.map
+++ b/priv/static/static/js/10.46fbbdfaf0d4800f349b.js.map
--- a/priv/static/static/js/12.6619e0b2f854637e76d4.js
+++ b/priv/static/static/js/12.6619e0b2f854637e76d4.js
--- a/priv/static/static/js/12.b3bf0bc313861d6ec36b.js
+++ b/priv/static/static/js/12.b3bf0bc313861d6ec36b.js
--- a/priv/static/static/js/12.b3bf0bc313861d6ec36b.js.map
+++ b/priv/static/static/js/12.b3bf0bc313861d6ec36b.js.map
--- a/priv/static/static/js/13.adb8a942514d735722c4.js
+++ b/priv/static/static/js/13.adb8a942514d735722c4.js
--- a/priv/static/static/js/13.adb8a942514d735722c4.js.map
+++ b/priv/static/static/js/13.adb8a942514d735722c4.js.map
--- a/priv/static/static/js/14.d015d9b2ea16407e389c.js
+++ b/priv/static/static/js/14.d015d9b2ea16407e389c.js
--- a/priv/static/static/js/14.d015d9b2ea16407e389c.js.map
+++ b/priv/static/static/js/14.d015d9b2ea16407e389c.js.map
--- a/priv/static/static/js/18.94946caca48930c224c7.js
+++ b/priv/static/static/js/18.94946caca48930c224c7.js
--- a/priv/static/static/js/18.94946caca48930c224c7.js.map
+++ b/priv/static/static/js/18.94946caca48930c224c7.js.map
--- a/priv/static/static/js/18.b29eedabe76445fe94b8.js.map
+++ b/priv/static/static/js/18.b29eedabe76445fe94b8.js.map
--- a/priv/static/static/js/19.233c81ac2c28d55e9f13.js
+++ b/priv/static/static/js/19.233c81ac2c28d55e9f13.js
--- a/priv/static/static/js/19.233c81ac2c28d55e9f13.js.map
+++ b/priv/static/static/js/19.233c81ac2c28d55e9f13.js.map
--- a/priv/static/static/js/19.ed1cd5db596618779f03.js.map
+++ b/priv/static/static/js/19.ed1cd5db596618779f03.js.map
--- a/priv/static/static/js/2.c92f4803ff24726cea58.js
+++ b/priv/static/static/js/2.c92f4803ff24726cea58.js
--- a/priv/static/static/js/2.c92f4803ff24726cea58.js.map
+++ b/priv/static/static/js/2.c92f4803ff24726cea58.js.map
--- a/priv/static/static/js/2.fb3f90b584362209a143.js.map
+++ b/priv/static/static/js/2.fb3f90b584362209a143.js.map
--- a/priv/static/static/js/20.6d311b830d8ac672729f.js.map
+++ b/priv/static/static/js/20.6d311b830d8ac672729f.js.map
--- a/priv/static/static/js/20.818c38d27369c3a4d677.js
+++ b/priv/static/static/js/20.818c38d27369c3a4d677.js
--- a/priv/static/static/js/20.818c38d27369c3a4d677.js.map
+++ b/priv/static/static/js/20.818c38d27369c3a4d677.js.map
--- a/priv/static/static/js/23.2c5f0fd2f2acd04592e8.js.map
+++ b/priv/static/static/js/23.2c5f0fd2f2acd04592e8.js.map
--- a/priv/static/static/js/23.a57a7845cc20fafd06d1.js
+++ b/priv/static/static/js/23.a57a7845cc20fafd06d1.js
--- a/priv/static/static/js/23.a57a7845cc20fafd06d1.js.map
+++ b/priv/static/static/js/23.a57a7845cc20fafd06d1.js.map
--- a/priv/static/static/js/25.365514e44606a895ab50.js.map
+++ b/priv/static/static/js/25.365514e44606a895ab50.js.map
--- a/priv/static/static/js/25.5a9efe20e3ae1352e6d2.js
+++ b/priv/static/static/js/25.5a9efe20e3ae1352e6d2.js
--- a/priv/static/static/js/25.5a9efe20e3ae1352e6d2.js.map
+++ b/priv/static/static/js/25.5a9efe20e3ae1352e6d2.js.map
--- a/priv/static/static/js/28.9eb3e783aeba24c84f0a.js.map
+++ b/priv/static/static/js/28.9eb3e783aeba24c84f0a.js.map
--- a/priv/static/static/js/28.e0f9f164e0bfd890dc61.js
+++ b/priv/static/static/js/28.e0f9f164e0bfd890dc61.js
--- a/priv/static/static/js/28.e0f9f164e0bfd890dc61.js.map
+++ b/priv/static/static/js/28.e0f9f164e0bfd890dc61.js.map
--- a/priv/static/static/js/3.7d21accf4e5bd07e3ebf.js
+++ b/priv/static/static/js/3.7d21accf4e5bd07e3ebf.js
--- a/priv/static/static/js/3.7d21accf4e5bd07e3ebf.js.map
+++ b/priv/static/static/js/3.7d21accf4e5bd07e3ebf.js.map
--- a/priv/static/static/js/30.a9377272337674f2dd05.js.map
+++ b/priv/static/static/js/30.a9377272337674f2dd05.js.map
--- a/priv/static/static/js/30.fce58be0b52ca3e32fa4.js
+++ b/priv/static/static/js/30.fce58be0b52ca3e32fa4.js
--- a/priv/static/static/js/30.fce58be0b52ca3e32fa4.js.map
+++ b/priv/static/static/js/30.fce58be0b52ca3e32fa4.js.map
--- a/priv/static/static/js/8.636322a87bb10a1754f8.js
+++ b/priv/static/static/js/8.636322a87bb10a1754f8.js
--- a/priv/static/static/js/8.636322a87bb10a1754f8.js.map
+++ b/priv/static/static/js/8.636322a87bb10a1754f8.js.map
--- a/priv/static/static/js/9.6010dbcce7b4d7c05a18.js
+++ b/priv/static/static/js/9.6010dbcce7b4d7c05a18.js
--- a/priv/static/static/js/9.6010dbcce7b4d7c05a18.js.map
+++ b/priv/static/static/js/9.6010dbcce7b4d7c05a18.js.map
--- a/priv/static/static/js/app.154c25316542278028a6.js
+++ b/priv/static/static/js/app.154c25316542278028a6.js
--- a/priv/static/static/js/app.154c25316542278028a6.js.map
+++ b/priv/static/static/js/app.154c25316542278028a6.js.map
--- a/priv/static/static/js/app.55d173dc5e39519aa518.js
+++ b/priv/static/static/js/app.55d173dc5e39519aa518.js
--- a/priv/static/static/js/app.55d173dc5e39519aa518.js.map
+++ b/priv/static/static/js/app.55d173dc5e39519aa518.js.map
--- a/priv/static/static/js/vendors~app.90c4af83c1ae68f4cd95.js
+++ b/priv/static/static/js/vendors~app.90c4af83c1ae68f4cd95.js
--- a/priv/static/static/js/vendors~app.90c4af83c1ae68f4cd95.js.map
+++ b/priv/static/static/js/vendors~app.90c4af83c1ae68f4cd95.js.map
--- a/priv/static/sw-pleroma.js
+++ b/priv/static/sw-pleroma.js
--- a/priv/static/sw-pleroma.js.map
+++ b/priv/static/sw-pleroma.js.map