Commit graph

207 commits

Author SHA1 Message Date
Alex Gleason
b46811a074
Upgrade Comeonin to v5
https://github.com/riverrun/comeonin/blob/master/UPGRADE_v5.md
2020-05-12 17:14:59 -05:00
Maksim
3d0c567fbc Pleroma.Web.TwitterAPI.TwoFactorAuthenticationController -> Pleroma.Web.PleromaAPI.TwoFactorAuthenticationController 2020-05-07 08:14:54 +00:00
lain
07e7c80bc9 Merge branch 'plug-if-unless-func-options-refactoring' into 'develop'
Refactoring of :if_func / :unless_func plug options

See merge request pleroma/pleroma!2446
2020-05-06 09:14:05 +00:00
Haelwenn (lanodan) Monnier
c6ddfa8f95
static-fe.css: Restore and move to /priv/static/static-fe 2020-05-02 08:28:42 +02:00
lain
3453e54e6b MappedSignatureToIdentityPlug: Fix. 2020-05-01 15:58:47 +02:00
Ivan Tashkinov
2c4844237f Refactoring of :if_func / :unless_func plug options (general availability). Added tests for Pleroma.Web.Plug. 2020-04-30 18:19:51 +03:00
Ivan Tashkinov
908cf22a6c Merge remote-tracking branch 'remotes/origin/develop' into automatic-authentication-and-instance-publicity-checks
# Conflicts:
#	lib/pleroma/web/mastodon_api/controllers/account_controller.ex
2020-04-28 19:56:20 +03:00
Alex Gleason
1bd9749a8f
Let blob: pass CSP 2020-04-26 00:29:42 -05:00
Ivan Tashkinov
2958a7d246 Fixed OAuth restrictions for :api routes. Made auth info dropped for :api routes if OAuth check was neither performed nor explicitly skipped. 2020-04-22 18:50:25 +03:00
Ivan Tashkinov
f685cbd309 Automatic checks of authentication / instance publicity. Definition of missing OAuth scopes in AdminAPIController. Refactoring. 2020-04-21 16:29:19 +03:00
Ivan Tashkinov
66f55106bd [#1682] Fixed Basic Auth permissions issue by disabling OAuth scopes checks when password is provided. Refactored plugs skipping functionality. 2020-04-17 21:21:10 +03:00
Ivan Tashkinov
bde1189c34 [#2349] Made :skip_plug/2 prevent plug from being executed even if explicitly called. Refactoring. Tests. 2020-04-15 21:19:16 +03:00
Ivan Tashkinov
bedf92e064 Merge remote-tracking branch 'remotes/origin/develop' into authenticated-api-oauth-check-enforcement 2020-04-15 19:20:34 +03:00
Haelwenn
b1c1d2e5e1 Merge branch 'fix/1659-rate-limiter' into 'develop'
remote_ip plug adds remote_ip_found flag

Closes #1659

See merge request pleroma/pleroma!2390
2020-04-15 15:26:55 +00:00
Alexander Strizhakov
22bde21c4f
remote_ip plug adds remote_ip_found flag 2020-04-15 15:27:34 +03:00
lain
6bc76df287 Uploads: Sandbox them in the CSP. 2020-04-15 12:05:22 +02:00
Maksim Pechnikov
c4e7ed660c fix logger message 2020-04-14 08:43:47 +03:00
Ivan Tashkinov
fc81e5a49c Enforcement of OAuth scopes check for authenticated API endpoints, :skip_plug plug to mark a plug explicitly skipped (disabled). 2020-04-06 10:20:44 +03:00
lain
fa4ec17c84 Merge branch '1560-non-federating-instances-routes-restrictions' into 'develop'
[#1560] Restricted AP- & OStatus-related routes for non-federating instances

Closes #1560

See merge request pleroma/pleroma!2235
2020-03-15 19:15:20 +00:00
Haelwenn
67a27825b1 Merge branch 'fix/rate-limiter-remoteip-behavior' into 'develop'
rate limiter: disable based on if remote ip was found, not on if the plug was enabled

Closes #1620

See merge request pleroma/pleroma!2296
2020-03-15 14:22:10 +00:00
Ivan Tashkinov
ecb7809e92 Merge remote-tracking branch 'remotes/origin/develop' into 1560-non-federating-instances-routes-restrictions
# Conflicts:
#	lib/pleroma/plugs/static_fe_plug.ex
2020-03-14 15:37:02 +03:00
rinpatch
d88c8a9614 Merge branch 'fix/cache-control-headers' into 'develop'
Fix Cache Control headers on media

See merge request pleroma/pleroma!2295
2020-03-14 11:19:42 +00:00
rinpatch
6a28c198af uploaded media plug: do not inject compile-time params on every request 2020-03-13 22:12:33 +03:00
rinpatch
658f30c0b3 Merge branch 'static-accept-missing' into 'develop'
Fix static FE plug to handle missing Accept header.

See merge request pleroma/pleroma!2260
2020-03-13 18:46:54 +00:00
rinpatch
fc4496d4fa rate limiter: disable based on if remote ip was found, not on if the plug was enabled
The current rate limiter disable logic won't trigger when the remote ip
is not forwarded, only when the remoteip plug is not enabled, which is
not the case on most instances since it's enabled by default. This
changes the behavior to warn and disable  when the remote ip was not forwarded,
even if the RemoteIP plug is enabled.

Also closes #1620
2020-03-13 21:41:17 +03:00
Mark Felder
3b1b183b42 Synchronize cache-control header for local media with the mediaproxy 2020-03-13 12:27:50 -05:00
Mark Felder
413177c8f0 Set correct Cache-Control header for local media 2020-03-13 12:02:58 -05:00
Ivan Tashkinov
5fc92deef3 [#1560] Ensured authentication or enabled federation for federation-related routes. New tests + tests refactoring. 2020-03-09 20:51:44 +03:00
Ivan Tashkinov
027714b519 Merge remote-tracking branch 'remotes/origin/develop' into 1560-non-federating-instances-routes-restrictions 2020-03-06 11:48:30 +03:00
Ivan Tashkinov
40765875d4 [#1560] Misc. improvements in ActivityPubController federation state restrictions. 2020-03-05 21:19:21 +03:00
Mark Felder
05da5f5cca Update Copyrights 2020-03-03 16:44:49 -06:00
Ivan Tashkinov
b6fc98d9cd [#1560] ActivityPubController federation state restrictions adjustments. Adjusted tests. 2020-03-03 22:22:02 +03:00
Ivan Tashkinov
99a6c660a9 Merge remote-tracking branch 'remotes/origin/develop' into 1560-non-federating-instances-routes-restrictions 2020-03-02 18:41:12 +03:00
Haelwenn (lanodan) Monnier
6da6540036
Bump copyright years of files changed after 2020-01-07
Done via the following command:
git diff fcd5dd259a --stat --name-only | xargs sed -i '/Pleroma Authors/c# Copyright © 2017-2020 Pleroma Authors <https:\/\/pleroma.social\/>'
2020-03-02 06:08:45 +01:00
Phil Hagelberg
523f73dccd Fix static FE plug to handle missing Accept header. 2020-02-29 18:53:49 -08:00
rinpatch
4d416343fa rate limiter: Fix a race condition
When multiple requests are processed by rate limiter plug at the same
time and the bucket is not yet initialized, both would try to initialize
the bucket resulting in an internal server error.
2020-03-01 01:13:07 +03:00
Ivan Tashkinov
c747260989 [#2250] Tiny refactoring per merge request review. 2020-02-29 22:04:09 +03:00
Ivan Tashkinov
3759b146c4 Apply suggestion to lib/pleroma/plugs/rate_limiter/rate_limiter.ex 2020-02-28 13:33:42 +00:00
Ivan Tashkinov
6f2efb1c45 Runtime configurability of RateLimiter. Refactoring. Disabled default rate limits in tests. 2020-02-27 18:46:05 +03:00
Ivan Tashkinov
0cf1d4fcd0 [#1560] Restricted AP- & OStatus-related routes for non-federating instances. 2020-02-22 19:48:41 +03:00
lain
3eddd9caa6 Merge branch 'require-signature' into 'develop'
Add an option to require fetches to be signed

Closes #1444

See merge request pleroma/pleroma!2071
2020-02-20 12:13:21 +00:00
rinpatch
15ea75cd2a Actually fix upload limit on OTP releases
Closes #1109
2020-02-07 20:14:06 +03:00
rinpatch
c27d1d65bf Merge branch 'fix/disable-rate-limiter-for-socket-localhost' into 'develop'
Disable rate limiter for socket/localhost

Closes #1380

See merge request pleroma/pleroma!2064
2020-01-30 19:24:04 +00:00
rinpatch
5b62acf6e9 Merge branch 'develop' into fix/disable-rate-limiter-for-socket-localhost 2020-01-30 22:16:55 +03:00
lain
774cba84f5 Merge branch 'reenable-rate-limit-and-remote-ip' into 'develop'
Re-enable rate limiter and enable remote ip

See merge request pleroma/pleroma!2164
2020-01-30 18:47:44 +00:00
feld
36becd5573 Update http_security_plug.ex 2020-01-30 14:07:41 +00:00
rinpatch
889965141a RemoteIp: only trust X-Forwarded-For
Our nginx config will happily pass `Forwarded`/`X-Real-IP` from the
client. Caddy, Apache and Varnish pass `X-Forwarded-For` as well anyway.
2020-01-30 00:06:58 +03:00
Egor Kislitsyn
e07e7888d7
Fix credo warning 2020-01-29 18:53:43 +04:00
Egor Kislitsyn
2bd4d6289b
Make the warning more scarier 2020-01-29 18:43:23 +04:00
Egor Kislitsyn
6302b40791
Warn if HTTPSecurityPlug is disabled 2020-01-28 19:14:09 +04:00