908cf22a6c
Merge remote-tracking branch 'remotes/origin/develop' into automatic-authentication-and-instance-publicity-checks
...
# Conflicts:
# lib/pleroma/web/mastodon_api/controllers/account_controller.ex
2020-04-28 19:56:20 +03:00
1bd9749a8f
Let blob: pass CSP
2020-04-26 00:29:42 -05:00
2958a7d246
Fixed OAuth restrictions for :api routes. Made auth info dropped for :api routes if OAuth check was neither performed nor explicitly skipped.
2020-04-22 18:50:25 +03:00
f685cbd309
Automatic checks of authentication / instance publicity. Definition of missing OAuth scopes in AdminAPIController. Refactoring.
2020-04-21 16:29:19 +03:00
66f55106bd
[ #1682 ] Fixed Basic Auth permissions issue by disabling OAuth scopes checks when password is provided. Refactored plugs skipping functionality.
2020-04-17 21:21:10 +03:00
bde1189c34
[ #2349 ] Made :skip_plug/2 prevent plug from being executed even if explicitly called. Refactoring. Tests.
2020-04-15 21:19:16 +03:00
bedf92e064
Merge remote-tracking branch 'remotes/origin/develop' into authenticated-api-oauth-check-enforcement
2020-04-15 19:20:34 +03:00
b1c1d2e5e1
Merge branch 'fix/1659-rate-limiter' into 'develop'
...
remote_ip plug adds remote_ip_found flag
Closes #1659
See merge request pleroma/pleroma!2390
2020-04-15 15:26:55 +00:00
22bde21c4f
remote_ip plug adds remote_ip_found flag
2020-04-15 15:27:34 +03:00
6bc76df287
Uploads: Sandbox them in the CSP.
2020-04-15 12:05:22 +02:00
c4e7ed660c
fix logger message
2020-04-14 08:43:47 +03:00
fc81e5a49c
Enforcement of OAuth scopes check for authenticated API endpoints, :skip_plug plug to mark a plug explicitly skipped (disabled).
2020-04-06 10:20:44 +03:00
fa4ec17c84
Merge branch '1560-non-federating-instances-routes-restrictions' into 'develop'
...
[#1560 ] Restricted AP- & OStatus-related routes for non-federating instances
Closes #1560
See merge request pleroma/pleroma!2235
2020-03-15 19:15:20 +00:00
67a27825b1
Merge branch 'fix/rate-limiter-remoteip-behavior' into 'develop'
...
rate limiter: disable based on if remote ip was found, not on if the plug was enabled
Closes #1620
See merge request pleroma/pleroma!2296
2020-03-15 14:22:10 +00:00
ecb7809e92
Merge remote-tracking branch 'remotes/origin/develop' into 1560-non-federating-instances-routes-restrictions
...
# Conflicts:
# lib/pleroma/plugs/static_fe_plug.ex
2020-03-14 15:37:02 +03:00
d88c8a9614
Merge branch 'fix/cache-control-headers' into 'develop'
...
Fix Cache Control headers on media
See merge request pleroma/pleroma!2295
2020-03-14 11:19:42 +00:00
6a28c198af
uploaded media plug: do not inject compile-time params on every request
2020-03-13 22:12:33 +03:00
658f30c0b3
Merge branch 'static-accept-missing' into 'develop'
...
Fix static FE plug to handle missing Accept header.
See merge request pleroma/pleroma!2260
2020-03-13 18:46:54 +00:00
fc4496d4fa
rate limiter: disable based on if remote ip was found, not on if the plug was enabled
...
The current rate limiter disable logic won't trigger when the remote ip
is not forwarded, only when the remoteip plug is not enabled, which is
not the case on most instances since it's enabled by default. This
changes the behavior to warn and disable when the remote ip was not forwarded,
even if the RemoteIP plug is enabled.
Also closes #1620
2020-03-13 21:41:17 +03:00
3b1b183b42
Synchronize cache-control header for local media with the mediaproxy
2020-03-13 12:27:50 -05:00
413177c8f0
Set correct Cache-Control header for local media
2020-03-13 12:02:58 -05:00
5fc92deef3
[ #1560 ] Ensured authentication or enabled federation for federation-related routes. New tests + tests refactoring.
2020-03-09 20:51:44 +03:00
027714b519
Merge remote-tracking branch 'remotes/origin/develop' into 1560-non-federating-instances-routes-restrictions
2020-03-06 11:48:30 +03:00
40765875d4
[ #1560 ] Misc. improvements in ActivityPubController federation state restrictions.
2020-03-05 21:19:21 +03:00
05da5f5cca
Update Copyrights
2020-03-03 16:44:49 -06:00
b6fc98d9cd
[ #1560 ] ActivityPubController federation state restrictions adjustments. Adjusted tests.
2020-03-03 22:22:02 +03:00
99a6c660a9
Merge remote-tracking branch 'remotes/origin/develop' into 1560-non-federating-instances-routes-restrictions
2020-03-02 18:41:12 +03:00
6da6540036
Bump copyright years of files changed after 2020-01-07
...
Done via the following command:
git diff fcd5dd259a
2020-03-02 06:08:45 +01:00
523f73dccd
Fix static FE plug to handle missing Accept header.
2020-02-29 18:53:49 -08:00
4d416343fa
rate limiter: Fix a race condition
...
When multiple requests are processed by rate limiter plug at the same
time and the bucket is not yet initialized, both would try to initialize
the bucket resulting in an internal server error.
2020-03-01 01:13:07 +03:00
c747260989
[ #2250 ] Tiny refactoring per merge request review.
2020-02-29 22:04:09 +03:00
3759b146c4
Apply suggestion to lib/pleroma/plugs/rate_limiter/rate_limiter.ex
2020-02-28 13:33:42 +00:00
6f2efb1c45
Runtime configurability of RateLimiter. Refactoring. Disabled default rate limits in tests.
2020-02-27 18:46:05 +03:00
0cf1d4fcd0
[ #1560 ] Restricted AP- & OStatus-related routes for non-federating instances.
2020-02-22 19:48:41 +03:00
3eddd9caa6
Merge branch 'require-signature' into 'develop'
...
Add an option to require fetches to be signed
Closes #1444
See merge request pleroma/pleroma!2071
2020-02-20 12:13:21 +00:00
15ea75cd2a
Actually fix upload limit on OTP releases
...
Closes #1109
2020-02-07 20:14:06 +03:00
c27d1d65bf
Merge branch 'fix/disable-rate-limiter-for-socket-localhost' into 'develop'
...
Disable rate limiter for socket/localhost
Closes #1380
See merge request pleroma/pleroma!2064
2020-01-30 19:24:04 +00:00
5b62acf6e9
Merge branch 'develop' into fix/disable-rate-limiter-for-socket-localhost
2020-01-30 22:16:55 +03:00
774cba84f5
Merge branch 'reenable-rate-limit-and-remote-ip' into 'develop'
...
Re-enable rate limiter and enable remote ip
See merge request pleroma/pleroma!2164
2020-01-30 18:47:44 +00:00
36becd5573
Update http_security_plug.ex
2020-01-30 14:07:41 +00:00
889965141a
RemoteIp: only trust X-Forwarded-For
...
Our nginx config will happily pass `Forwarded`/`X-Real-IP` from the
client. Caddy, Apache and Varnish pass `X-Forwarded-For` as well anyway.
2020-01-30 00:06:58 +03:00
e07e7888d7
Fix credo warning
2020-01-29 18:53:43 +04:00
2bd4d6289b
Make the warning more scarier
2020-01-29 18:43:23 +04:00
6302b40791
Warn if HTTPSecurityPlug is disabled
2020-01-28 19:14:09 +04:00
108a39c876
updated error messages for authentication process
2020-01-17 15:01:37 +03:00
39ce894a07
Merge remote-tracking branch 'remotes/origin/develop' into 1478-oauth-admin-scopes-tweaks
...
# Conflicts:
# lib/pleroma/user.ex
2020-01-10 16:18:32 +03:00
6c94b7498b
[ #1478 ] OAuth admin tweaks: enforced OAuth admin scopes usage by default, migrated existing OAuth records. Adjusted tests.
2020-01-10 10:52:21 +03:00
775212121c
Verify HTTP signatures only when request accepts "activity+json" type
2019-12-19 20:17:18 +07:00
a12b6454bb
Add an option to require fetches to be signed
2019-12-16 22:24:03 +07:00
7973cbdb9f
OAuthScopesPlug: disallowed nil token (unless with :fallback option). WIP: controller tests modification: OAuth scopes usage.
2019-12-15 22:32:42 +03:00
Ivan Tashkinov
Alex Gleason
Haelwenn
Alexander Strizhakov
lain
Maksim Pechnikov
rinpatch
Mark Felder
Haelwenn (lanodan) Monnier
Phil Hagelberg
Ivan Tashkinov
feld
Egor Kislitsyn