nrd.li/akkoma
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
10471 commits 2 branches 0 tags 272 MiB
Commit graph

224 commits

Author SHA1 Message Date
Mark Felder e9a28078ad Rename function and clarify that CSP is only strict with MediaProxy enabled 2020-07-03 17:18:22 -05:00
Mark Felder eaa59daa4c Add Captcha endpoint to CSP headers when MediaProxy is enabled. 
Our CSP rules are lax when MediaProxy enabled, but lenient otherwise.

This fixes broken captcha on instances not using MediaProxy.
 2020-07-03 17:06:20 -05:00
Mark Felder 2731ea1334 Change references from "deleted_urls" to "banned_urls" as nothing is handled via media deletions anymore; all actions are manual operations by an admin to ban the url 2020-06-17 13:13:55 -05:00
Maksim Pechnikov 2e8a236cef fix invalidates media url's 2020-06-14 21:02:57 +03:00
Mark Felder 7f7a1a4676 Check for media proxy base_url, not Upload base_url 2020-06-11 11:05:22 -05:00
rinpatch 99afc7f4e4 HTTP security plug: add media proxy base url host to csp 2020-06-10 20:09:16 +03:00
rinpatch d23b3701d8 Merge branch 'bugfix/csp-unproxied' into 'develop' 
http_security_plug.ex: Fix non-proxied media

See merge request pleroma/pleroma!2610
 2020-05-29 21:23:49 +00:00
rinpatch 109af93227 Apply suggestion to lib/pleroma/plugs/http_security_plug.ex 2020-05-29 21:15:07 +00:00
Alex Gleason d38f28870e
Add blob: to connect-src CSP 2020-05-29 11:08:17 -05:00
Haelwenn (lanodan) Monnier da1e31fae3
http_security_plug.ex: Fix non-proxied media 2020-05-29 17:20:09 +02:00
rinpatch 27180611df HTTP Security plug: make starting csp string generation more readable 2020-05-29 12:32:48 +03:00
rinpatch 29ff6d414b HTTP security plug: Harden img-src and media-src when MediaProxy is enabled 2020-05-27 21:41:19 +03:00
rinpatch 455a402c8a HTTP Security plug: rewrite &csp_string/0 
- Directives are now separated with ";" instead of " ;",
according to https://www.w3.org/TR/CSP2/#policy-parsing
the space is optional
- Use an IO list, which at the end gets converted to a binary as
opposed to ++ing a bunch of arrays with binaries together and joining
them to a string. I doubt it gives any significant real world advantage,
but the code is cleaner and now I can sleep at night.
- The static part of csp is pre-joined to a single binary at compile time.
Same reasoning as the last point.
 2020-05-27 21:31:47 +03:00
lain bfdd90f6d7 AuthenticationPlug: Also update crypt passwords. 2020-05-17 11:40:25 +02:00
lain baef35bcc8 Authentication Plug: Update bcrypt password on login. 2020-05-17 10:31:01 +02:00
Alex Gleason 5b0f27d23d
Pbkdf2.verify_pass --> AuthenticationPlug.checkpw 2020-05-14 08:57:38 -05:00
Alex Gleason 9cbf17d59f
Handle bcrypt passwords for Mastodon migration 2020-05-13 10:53:56 -05:00
Alex Gleason b46811a074
Upgrade Comeonin to v5 
https://github.com/riverrun/comeonin/blob/master/UPGRADE_v5.md
 2020-05-12 17:14:59 -05:00
Maksim 3d0c567fbc Pleroma.Web.TwitterAPI.TwoFactorAuthenticationController -> Pleroma.Web.PleromaAPI.TwoFactorAuthenticationController 2020-05-07 08:14:54 +00:00
lain 07e7c80bc9 Merge branch 'plug-if-unless-func-options-refactoring' into 'develop' 
Refactoring of :if_func / :unless_func plug options

See merge request pleroma/pleroma!2446
 2020-05-06 09:14:05 +00:00
Haelwenn (lanodan) Monnier c6ddfa8f95
static-fe.css: Restore and move to /priv/static/static-fe 2020-05-02 08:28:42 +02:00
lain 3453e54e6b MappedSignatureToIdentityPlug: Fix. 2020-05-01 15:58:47 +02:00
Ivan Tashkinov 2c4844237f Refactoring of :if_func / :unless_func plug options (general availability). Added tests for Pleroma.Web.Plug. 2020-04-30 18:19:51 +03:00
Ivan Tashkinov 908cf22a6c Merge remote-tracking branch 'remotes/origin/develop' into automatic-authentication-and-instance-publicity-checks 
# Conflicts:
#	lib/pleroma/web/mastodon_api/controllers/account_controller.ex
 2020-04-28 19:56:20 +03:00
Alex Gleason 1bd9749a8f
Let blob: pass CSP 2020-04-26 00:29:42 -05:00
Ivan Tashkinov 2958a7d246 Fixed OAuth restrictions for :api routes. Made auth info dropped for :api routes if OAuth check was neither performed nor explicitly skipped. 2020-04-22 18:50:25 +03:00
Ivan Tashkinov f685cbd309 Automatic checks of authentication / instance publicity. Definition of missing OAuth scopes in AdminAPIController. Refactoring. 2020-04-21 16:29:19 +03:00
Ivan Tashkinov 66f55106bd [#1682] Fixed Basic Auth permissions issue by disabling OAuth scopes checks when password is provided. Refactored plugs skipping functionality. 2020-04-17 21:21:10 +03:00
Ivan Tashkinov bde1189c34 [#2349] Made :skip_plug/2 prevent plug from being executed even if explicitly called. Refactoring. Tests. 2020-04-15 21:19:16 +03:00
Ivan Tashkinov bedf92e064 Merge remote-tracking branch 'remotes/origin/develop' into authenticated-api-oauth-check-enforcement 2020-04-15 19:20:34 +03:00
Haelwenn b1c1d2e5e1 Merge branch 'fix/1659-rate-limiter' into 'develop' 
remote_ip plug adds remote_ip_found flag

Closes #1659

See merge request pleroma/pleroma!2390
 2020-04-15 15:26:55 +00:00
Alexander Strizhakov 22bde21c4f
remote_ip plug adds remote_ip_found flag 2020-04-15 15:27:34 +03:00
lain 6bc76df287 Uploads: Sandbox them in the CSP. 2020-04-15 12:05:22 +02:00
Maksim Pechnikov c4e7ed660c fix logger message 2020-04-14 08:43:47 +03:00
Ivan Tashkinov fc81e5a49c Enforcement of OAuth scopes check for authenticated API endpoints, :skip_plug plug to mark a plug explicitly skipped (disabled). 2020-04-06 10:20:44 +03:00
lain fa4ec17c84 Merge branch '1560-non-federating-instances-routes-restrictions' into 'develop' 
[#1560] Restricted AP- & OStatus-related routes for non-federating instances

Closes #1560

See merge request pleroma/pleroma!2235
 2020-03-15 19:15:20 +00:00
Haelwenn 67a27825b1 Merge branch 'fix/rate-limiter-remoteip-behavior' into 'develop' 
rate limiter: disable based on if remote ip was found, not on if the plug was enabled

Closes #1620

See merge request pleroma/pleroma!2296
 2020-03-15 14:22:10 +00:00
Ivan Tashkinov ecb7809e92 Merge remote-tracking branch 'remotes/origin/develop' into 1560-non-federating-instances-routes-restrictions 
# Conflicts:
#	lib/pleroma/plugs/static_fe_plug.ex
 2020-03-14 15:37:02 +03:00
rinpatch d88c8a9614 Merge branch 'fix/cache-control-headers' into 'develop' 
Fix Cache Control headers on media

See merge request pleroma/pleroma!2295
 2020-03-14 11:19:42 +00:00
rinpatch 6a28c198af uploaded media plug: do not inject compile-time params on every request 2020-03-13 22:12:33 +03:00
rinpatch 658f30c0b3 Merge branch 'static-accept-missing' into 'develop' 
Fix static FE plug to handle missing Accept header.

See merge request pleroma/pleroma!2260
 2020-03-13 18:46:54 +00:00
rinpatch fc4496d4fa rate limiter: disable based on if remote ip was found, not on if the plug was enabled 
The current rate limiter disable logic won't trigger when the remote ip
is not forwarded, only when the remoteip plug is not enabled, which is
not the case on most instances since it's enabled by default. This
changes the behavior to warn and disable  when the remote ip was not forwarded,
even if the RemoteIP plug is enabled.

Also closes #1620
 2020-03-13 21:41:17 +03:00
Mark Felder 3b1b183b42 Synchronize cache-control header for local media with the mediaproxy 2020-03-13 12:27:50 -05:00
Mark Felder 413177c8f0 Set correct Cache-Control header for local media 2020-03-13 12:02:58 -05:00
Ivan Tashkinov 5fc92deef3 [#1560] Ensured authentication or enabled federation for federation-related routes. New tests + tests refactoring. 2020-03-09 20:51:44 +03:00
Ivan Tashkinov 027714b519 Merge remote-tracking branch 'remotes/origin/develop' into 1560-non-federating-instances-routes-restrictions 2020-03-06 11:48:30 +03:00
Ivan Tashkinov 40765875d4 [#1560] Misc. improvements in ActivityPubController federation state restrictions. 2020-03-05 21:19:21 +03:00
Mark Felder 05da5f5cca Update Copyrights 2020-03-03 16:44:49 -06:00
Ivan Tashkinov b6fc98d9cd [#1560] ActivityPubController federation state restrictions adjustments. Adjusted tests. 2020-03-03 22:22:02 +03:00
Ivan Tashkinov 99a6c660a9 Merge remote-tracking branch 'remotes/origin/develop' into 1560-non-federating-instances-routes-restrictions 2020-03-02 18:41:12 +03:00