Commit graph

198 commits

Author SHA1 Message Date
Alex Gleason
1bd9749a8f
Let blob: pass CSP 2020-04-26 00:29:42 -05:00
Ivan Tashkinov
66f55106bd [] Fixed Basic Auth permissions issue by disabling OAuth scopes checks when password is provided. Refactored plugs skipping functionality. 2020-04-17 21:21:10 +03:00
Ivan Tashkinov
bde1189c34 [] Made :skip_plug/2 prevent plug from being executed even if explicitly called. Refactoring. Tests. 2020-04-15 21:19:16 +03:00
Ivan Tashkinov
bedf92e064 Merge remote-tracking branch 'remotes/origin/develop' into authenticated-api-oauth-check-enforcement 2020-04-15 19:20:34 +03:00
Haelwenn
b1c1d2e5e1 Merge branch 'fix/1659-rate-limiter' into 'develop'
remote_ip plug adds remote_ip_found flag

Closes 

See merge request 
2020-04-15 15:26:55 +00:00
Alexander Strizhakov
22bde21c4f
remote_ip plug adds remote_ip_found flag 2020-04-15 15:27:34 +03:00
lain
6bc76df287 Uploads: Sandbox them in the CSP. 2020-04-15 12:05:22 +02:00
Maksim Pechnikov
c4e7ed660c fix logger message 2020-04-14 08:43:47 +03:00
Ivan Tashkinov
fc81e5a49c Enforcement of OAuth scopes check for authenticated API endpoints, :skip_plug plug to mark a plug explicitly skipped (disabled). 2020-04-06 10:20:44 +03:00
lain
fa4ec17c84 Merge branch '1560-non-federating-instances-routes-restrictions' into 'develop'
[] Restricted AP- & OStatus-related routes for non-federating instances

Closes 

See merge request 
2020-03-15 19:15:20 +00:00
Haelwenn
67a27825b1 Merge branch 'fix/rate-limiter-remoteip-behavior' into 'develop'
rate limiter: disable based on if remote ip was found, not on if the plug was enabled

Closes 

See merge request 
2020-03-15 14:22:10 +00:00
Ivan Tashkinov
ecb7809e92 Merge remote-tracking branch 'remotes/origin/develop' into 1560-non-federating-instances-routes-restrictions
# Conflicts:
#	lib/pleroma/plugs/static_fe_plug.ex
2020-03-14 15:37:02 +03:00
rinpatch
d88c8a9614 Merge branch 'fix/cache-control-headers' into 'develop'
Fix Cache Control headers on media

See merge request 
2020-03-14 11:19:42 +00:00
rinpatch
6a28c198af uploaded media plug: do not inject compile-time params on every request 2020-03-13 22:12:33 +03:00
rinpatch
658f30c0b3 Merge branch 'static-accept-missing' into 'develop'
Fix static FE plug to handle missing Accept header.

See merge request 
2020-03-13 18:46:54 +00:00
rinpatch
fc4496d4fa rate limiter: disable based on if remote ip was found, not on if the plug was enabled
The current rate limiter disable logic won't trigger when the remote ip
is not forwarded, only when the remoteip plug is not enabled, which is
not the case on most instances since it's enabled by default. This
changes the behavior to warn and disable  when the remote ip was not forwarded,
even if the RemoteIP plug is enabled.

Also closes 
2020-03-13 21:41:17 +03:00
Mark Felder
3b1b183b42 Synchronize cache-control header for local media with the mediaproxy 2020-03-13 12:27:50 -05:00
Mark Felder
413177c8f0 Set correct Cache-Control header for local media 2020-03-13 12:02:58 -05:00
Ivan Tashkinov
5fc92deef3 [] Ensured authentication or enabled federation for federation-related routes. New tests + tests refactoring. 2020-03-09 20:51:44 +03:00
Ivan Tashkinov
027714b519 Merge remote-tracking branch 'remotes/origin/develop' into 1560-non-federating-instances-routes-restrictions 2020-03-06 11:48:30 +03:00
Ivan Tashkinov
40765875d4 [] Misc. improvements in ActivityPubController federation state restrictions. 2020-03-05 21:19:21 +03:00
Mark Felder
05da5f5cca Update Copyrights 2020-03-03 16:44:49 -06:00
Ivan Tashkinov
b6fc98d9cd [] ActivityPubController federation state restrictions adjustments. Adjusted tests. 2020-03-03 22:22:02 +03:00
Ivan Tashkinov
99a6c660a9 Merge remote-tracking branch 'remotes/origin/develop' into 1560-non-federating-instances-routes-restrictions 2020-03-02 18:41:12 +03:00
Haelwenn (lanodan) Monnier
6da6540036
Bump copyright years of files changed after 2020-01-07
Done via the following command:
git diff fcd5dd259a --stat --name-only | xargs sed -i '/Pleroma Authors/c# Copyright © 2017-2020 Pleroma Authors <https:\/\/pleroma.social\/>'
2020-03-02 06:08:45 +01:00
Phil Hagelberg
523f73dccd Fix static FE plug to handle missing Accept header. 2020-02-29 18:53:49 -08:00
rinpatch
4d416343fa rate limiter: Fix a race condition
When multiple requests are processed by rate limiter plug at the same
time and the bucket is not yet initialized, both would try to initialize
the bucket resulting in an internal server error.
2020-03-01 01:13:07 +03:00
Ivan Tashkinov
c747260989 [] Tiny refactoring per merge request review. 2020-02-29 22:04:09 +03:00
Ivan Tashkinov
3759b146c4 Apply suggestion to lib/pleroma/plugs/rate_limiter/rate_limiter.ex 2020-02-28 13:33:42 +00:00
Ivan Tashkinov
6f2efb1c45 Runtime configurability of RateLimiter. Refactoring. Disabled default rate limits in tests. 2020-02-27 18:46:05 +03:00
Ivan Tashkinov
0cf1d4fcd0 [] Restricted AP- & OStatus-related routes for non-federating instances. 2020-02-22 19:48:41 +03:00
lain
3eddd9caa6 Merge branch 'require-signature' into 'develop'
Add an option to require fetches to be signed

Closes 

See merge request 
2020-02-20 12:13:21 +00:00
rinpatch
15ea75cd2a Actually fix upload limit on OTP releases
Closes 
2020-02-07 20:14:06 +03:00
rinpatch
c27d1d65bf Merge branch 'fix/disable-rate-limiter-for-socket-localhost' into 'develop'
Disable rate limiter for socket/localhost

Closes 

See merge request 
2020-01-30 19:24:04 +00:00
rinpatch
5b62acf6e9 Merge branch 'develop' into fix/disable-rate-limiter-for-socket-localhost 2020-01-30 22:16:55 +03:00
lain
774cba84f5 Merge branch 'reenable-rate-limit-and-remote-ip' into 'develop'
Re-enable rate limiter and enable remote ip

See merge request 
2020-01-30 18:47:44 +00:00
36becd5573 Update http_security_plug.ex 2020-01-30 14:07:41 +00:00
rinpatch
889965141a RemoteIp: only trust X-Forwarded-For
Our nginx config will happily pass `Forwarded`/`X-Real-IP` from the
client. Caddy, Apache and Varnish pass `X-Forwarded-For` as well anyway.
2020-01-30 00:06:58 +03:00
Egor Kislitsyn
e07e7888d7
Fix credo warning 2020-01-29 18:53:43 +04:00
Egor Kislitsyn
2bd4d6289b
Make the warning more scarier 2020-01-29 18:43:23 +04:00
Egor Kislitsyn
6302b40791
Warn if HTTPSecurityPlug is disabled 2020-01-28 19:14:09 +04:00
Maksim Pechnikov
108a39c876 updated error messages for authentication process 2020-01-17 15:01:37 +03:00
Ivan Tashkinov
39ce894a07 Merge remote-tracking branch 'remotes/origin/develop' into 1478-oauth-admin-scopes-tweaks
# Conflicts:
#	lib/pleroma/user.ex
2020-01-10 16:18:32 +03:00
Ivan Tashkinov
6c94b7498b [] OAuth admin tweaks: enforced OAuth admin scopes usage by default, migrated existing OAuth records. Adjusted tests. 2020-01-10 10:52:21 +03:00
Egor Kislitsyn
775212121c
Verify HTTP signatures only when request accepts "activity+json" type 2019-12-19 20:17:18 +07:00
Egor Kislitsyn
a12b6454bb
Add an option to require fetches to be signed 2019-12-16 22:24:03 +07:00
Ivan Tashkinov
7973cbdb9f OAuthScopesPlug: disallowed nil token (unless with :fallback option). WIP: controller tests modification: OAuth scopes usage. 2019-12-15 22:32:42 +03:00
Maxim Filippov
eb11c60289 Disable rate limiter for socket/localhost (unless RemoteIp is enabled) 2019-12-14 03:06:43 +03:00
Ivan Tashkinov
3920244be5 [] Fixed :admin option handling in OAuthScopesPlug, added tests. 2019-12-11 11:42:02 +03:00
Ivan Tashkinov
835ac2157c Merge remote-tracking branch 'remotes/upstream/develop' into 1427-oauth-admin-scopes
# Conflicts:
#	CHANGELOG.md
2019-12-10 08:55:14 +03:00