Commit graph

198 commits

Author SHA1 Message Date
Alex Gleason 1bd9749a8f
Let blob: pass CSP 2020-04-26 00:29:42 -05:00
Ivan Tashkinov 66f55106bd [#1682] Fixed Basic Auth permissions issue by disabling OAuth scopes checks when password is provided. Refactored plugs skipping functionality. 2020-04-17 21:21:10 +03:00
Ivan Tashkinov bde1189c34 [#2349] Made :skip_plug/2 prevent plug from being executed even if explicitly called. Refactoring. Tests. 2020-04-15 21:19:16 +03:00
Ivan Tashkinov bedf92e064 Merge remote-tracking branch 'remotes/origin/develop' into authenticated-api-oauth-check-enforcement 2020-04-15 19:20:34 +03:00
Haelwenn b1c1d2e5e1 Merge branch 'fix/1659-rate-limiter' into 'develop'
remote_ip plug adds remote_ip_found flag

Closes #1659

See merge request pleroma/pleroma!2390
2020-04-15 15:26:55 +00:00
Alexander Strizhakov 22bde21c4f
remote_ip plug adds remote_ip_found flag 2020-04-15 15:27:34 +03:00
lain 6bc76df287 Uploads: Sandbox them in the CSP. 2020-04-15 12:05:22 +02:00
Maksim Pechnikov c4e7ed660c fix logger message 2020-04-14 08:43:47 +03:00
Ivan Tashkinov fc81e5a49c Enforcement of OAuth scopes check for authenticated API endpoints, :skip_plug plug to mark a plug explicitly skipped (disabled). 2020-04-06 10:20:44 +03:00
lain fa4ec17c84 Merge branch '1560-non-federating-instances-routes-restrictions' into 'develop'
[#1560] Restricted AP- & OStatus-related routes for non-federating instances

Closes #1560

See merge request pleroma/pleroma!2235
2020-03-15 19:15:20 +00:00
Haelwenn 67a27825b1 Merge branch 'fix/rate-limiter-remoteip-behavior' into 'develop'
rate limiter: disable based on if remote ip was found, not on if the plug was enabled

Closes #1620

See merge request pleroma/pleroma!2296
2020-03-15 14:22:10 +00:00
Ivan Tashkinov ecb7809e92 Merge remote-tracking branch 'remotes/origin/develop' into 1560-non-federating-instances-routes-restrictions
# Conflicts:
#	lib/pleroma/plugs/static_fe_plug.ex
2020-03-14 15:37:02 +03:00
rinpatch d88c8a9614 Merge branch 'fix/cache-control-headers' into 'develop'
Fix Cache Control headers on media

See merge request pleroma/pleroma!2295
2020-03-14 11:19:42 +00:00
rinpatch 6a28c198af uploaded media plug: do not inject compile-time params on every request 2020-03-13 22:12:33 +03:00
rinpatch 658f30c0b3 Merge branch 'static-accept-missing' into 'develop'
Fix static FE plug to handle missing Accept header.

See merge request pleroma/pleroma!2260
2020-03-13 18:46:54 +00:00
rinpatch fc4496d4fa rate limiter: disable based on if remote ip was found, not on if the plug was enabled
The current rate limiter disable logic won't trigger when the remote ip
is not forwarded, only when the remoteip plug is not enabled, which is
not the case on most instances since it's enabled by default. This
changes the behavior to warn and disable  when the remote ip was not forwarded,
even if the RemoteIP plug is enabled.

Also closes #1620
2020-03-13 21:41:17 +03:00
Mark Felder 3b1b183b42 Synchronize cache-control header for local media with the mediaproxy 2020-03-13 12:27:50 -05:00
Mark Felder 413177c8f0 Set correct Cache-Control header for local media 2020-03-13 12:02:58 -05:00
Ivan Tashkinov 5fc92deef3 [#1560] Ensured authentication or enabled federation for federation-related routes. New tests + tests refactoring. 2020-03-09 20:51:44 +03:00
Ivan Tashkinov 027714b519 Merge remote-tracking branch 'remotes/origin/develop' into 1560-non-federating-instances-routes-restrictions 2020-03-06 11:48:30 +03:00
Ivan Tashkinov 40765875d4 [#1560] Misc. improvements in ActivityPubController federation state restrictions. 2020-03-05 21:19:21 +03:00
Mark Felder 05da5f5cca Update Copyrights 2020-03-03 16:44:49 -06:00
Ivan Tashkinov b6fc98d9cd [#1560] ActivityPubController federation state restrictions adjustments. Adjusted tests. 2020-03-03 22:22:02 +03:00
Ivan Tashkinov 99a6c660a9 Merge remote-tracking branch 'remotes/origin/develop' into 1560-non-federating-instances-routes-restrictions 2020-03-02 18:41:12 +03:00
Haelwenn (lanodan) Monnier 6da6540036
Bump copyright years of files changed after 2020-01-07
Done via the following command:
git diff fcd5dd259a --stat --name-only | xargs sed -i '/Pleroma Authors/c# Copyright © 2017-2020 Pleroma Authors <https:\/\/pleroma.social\/>'
2020-03-02 06:08:45 +01:00
Phil Hagelberg 523f73dccd Fix static FE plug to handle missing Accept header. 2020-02-29 18:53:49 -08:00
rinpatch 4d416343fa rate limiter: Fix a race condition
When multiple requests are processed by rate limiter plug at the same
time and the bucket is not yet initialized, both would try to initialize
the bucket resulting in an internal server error.
2020-03-01 01:13:07 +03:00
Ivan Tashkinov c747260989 [#2250] Tiny refactoring per merge request review. 2020-02-29 22:04:09 +03:00
Ivan Tashkinov 3759b146c4 Apply suggestion to lib/pleroma/plugs/rate_limiter/rate_limiter.ex 2020-02-28 13:33:42 +00:00
Ivan Tashkinov 6f2efb1c45 Runtime configurability of RateLimiter. Refactoring. Disabled default rate limits in tests. 2020-02-27 18:46:05 +03:00
Ivan Tashkinov 0cf1d4fcd0 [#1560] Restricted AP- & OStatus-related routes for non-federating instances. 2020-02-22 19:48:41 +03:00
lain 3eddd9caa6 Merge branch 'require-signature' into 'develop'
Add an option to require fetches to be signed

Closes #1444

See merge request pleroma/pleroma!2071
2020-02-20 12:13:21 +00:00
rinpatch 15ea75cd2a Actually fix upload limit on OTP releases
Closes #1109
2020-02-07 20:14:06 +03:00
rinpatch c27d1d65bf Merge branch 'fix/disable-rate-limiter-for-socket-localhost' into 'develop'
Disable rate limiter for socket/localhost

Closes #1380

See merge request pleroma/pleroma!2064
2020-01-30 19:24:04 +00:00
rinpatch 5b62acf6e9 Merge branch 'develop' into fix/disable-rate-limiter-for-socket-localhost 2020-01-30 22:16:55 +03:00
lain 774cba84f5 Merge branch 'reenable-rate-limit-and-remote-ip' into 'develop'
Re-enable rate limiter and enable remote ip

See merge request pleroma/pleroma!2164
2020-01-30 18:47:44 +00:00
feld 36becd5573 Update http_security_plug.ex 2020-01-30 14:07:41 +00:00
rinpatch 889965141a RemoteIp: only trust X-Forwarded-For
Our nginx config will happily pass `Forwarded`/`X-Real-IP` from the
client. Caddy, Apache and Varnish pass `X-Forwarded-For` as well anyway.
2020-01-30 00:06:58 +03:00
Egor Kislitsyn e07e7888d7
Fix credo warning 2020-01-29 18:53:43 +04:00
Egor Kislitsyn 2bd4d6289b
Make the warning more scarier 2020-01-29 18:43:23 +04:00
Egor Kislitsyn 6302b40791
Warn if HTTPSecurityPlug is disabled 2020-01-28 19:14:09 +04:00
Maksim Pechnikov 108a39c876 updated error messages for authentication process 2020-01-17 15:01:37 +03:00
Ivan Tashkinov 39ce894a07 Merge remote-tracking branch 'remotes/origin/develop' into 1478-oauth-admin-scopes-tweaks
# Conflicts:
#	lib/pleroma/user.ex
2020-01-10 16:18:32 +03:00
Ivan Tashkinov 6c94b7498b [#1478] OAuth admin tweaks: enforced OAuth admin scopes usage by default, migrated existing OAuth records. Adjusted tests. 2020-01-10 10:52:21 +03:00
Egor Kislitsyn 775212121c
Verify HTTP signatures only when request accepts "activity+json" type 2019-12-19 20:17:18 +07:00
Egor Kislitsyn a12b6454bb
Add an option to require fetches to be signed 2019-12-16 22:24:03 +07:00
Ivan Tashkinov 7973cbdb9f OAuthScopesPlug: disallowed nil token (unless with :fallback option). WIP: controller tests modification: OAuth scopes usage. 2019-12-15 22:32:42 +03:00
Maxim Filippov eb11c60289 Disable rate limiter for socket/localhost (unless RemoteIp is enabled) 2019-12-14 03:06:43 +03:00
Ivan Tashkinov 3920244be5 [#1427] Fixed :admin option handling in OAuthScopesPlug, added tests. 2019-12-11 11:42:02 +03:00
Ivan Tashkinov 835ac2157c Merge remote-tracking branch 'remotes/upstream/develop' into 1427-oauth-admin-scopes
# Conflicts:
#	CHANGELOG.md
2019-12-10 08:55:14 +03:00