Commit graph

93 commits

Author SHA1 Message Date
Oneric fbd961c747 Drop activity_type override for uploads
Afaict this was never used, but keeping this (in theory) possible
hinders detecting which objects are actually media uploads and
which proper ActivityPub objects.

It was originally added as part of upload support itself in
02d3dc6869 without being used
and `git log -S:activity_type` and `git log -Sactivity_type:`
don't find any other commits using this.
2024-05-22 20:30:23 +02:00
timorl b144218dce
Merge branch 'develop' into elseinspe 2024-04-14 20:31:33 +02:00
Oneric 9598137d32 Drop base_url special casing in test env
61621ebdbc already explicitly added
the uploader base url to config/test.exs and it reduces differences
from prod.
2024-04-07 00:20:12 +02:00
Oneric 0ec62acb9d Always insert Dedupe upload filter
This actually was already intended before to eradict all future
path-traversal-style exploits and to fix issues with some
characters like akkoma#610 in 0b2ec0ccee. However, Dedupe and
AnonymizeFilename got mixed up. The latter only anonymises the name
in Content-Disposition headers GET parameters (with link_name),
_not_ the upload path.

Even without Dedupe, the upload path is prefixed by an UUID,
so it _should_ already be hard to guess for attackers. But now
we actually can be sure no path shenanigangs occur, uploads
reliably work and save some disk space.

While this makes the final path predictable, this prediction is
not exploitable. Insertion of a back-reference to the upload
itself requires pulling off a successfull preimage attack against
SHA-256, which is deemed infeasible for the foreseeable futures.

Dedupe was already included in the default list in config.exs
since 28cfb2c37a, but this will get overridde by whatever the
config generated by the "pleroma.instance gen" task chose.

Upload+delete tests running in parallel using Dedupe might be flaky, but
this was already true before and needs its own commit to fix eventually.
2024-03-18 22:33:10 -01:00
Oneric fef773ca35 Drop media base_url default and recommend different domain
Same-domain setups enabled now at least two exploits,
so they ought to be discouraged and definitely not be the default.
2024-03-18 22:33:10 -01:00
FloatingGhost 0b2ec0ccee Enable AnonymizeFilenames on all uploads 2023-08-04 15:37:15 +01:00
ilja 6c396fcab4 Remove "default" image description
When no image description is filled in, Pleroma allowed fallbacks.
Those were (based on a setting) either the filename, or a fixed description.
Neither are good options for image descriptions imo, so here we remove this.

Note that there's two tests removed who supposedly tested something else.
But examining closer, they didn't seem to test what they claimed to test,
so I removed them rather than try to "fix" them.
2023-03-12 08:42:33 +01:00
floatingghost 07a48b9293 giant massive dep upgrade and dialyxir-found error emporium (#371)
Co-authored-by: FloatingGhost <hannah@coffee-and-dreams.uk>
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/371
2022-12-14 12:38:48 +00:00
Ilja 338612d72b Use EXIF data of image to prefill image description
During attachment upload Pleroma returns a "description" field.

* This MR allows Pleroma to read the EXIF data during upload and return the description to the FE using this field.
    * If a description is already present (e.g. because a previous module added it), it will use that
    * Otherwise it will read from the EXIF data. First it will check -ImageDescription, if that's empty, it will check -iptc:Caption-Abstract
    * If no description is found, it will simply return nil, which is the default value
* When people set up a new instance, they will be asked if they want to read metadata and this module will be activated if so

There was an Exiftool module, which has now been renamed to Exiftool.StripLocation
2022-10-23 14:46:16 +02:00
floatingghost 2641dcdd15 Post editing (#202)
Rebased from #103

Co-authored-by: Tusooa Zhu <tusooa@kazv.moe>
Co-authored-by: FloatingGhost <hannah@coffee-and-dreams.uk>
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/202
2022-09-06 19:24:02 +00:00
Alex Gleason f2134e605b
Merge remote-tracking branch 'pleroma/develop' into cycles-base-url 2021-05-31 16:49:46 -05:00
Alex Gleason 51a9f97e87
Deprecate Pleroma.Web.base_url/0
Use Pleroma.Web.Endpoint.url/0 directly instead. Reduces compiler cycles.
2021-05-31 16:48:03 -05:00
Alex Gleason 543e9402d6
Support blurhash 2021-05-14 09:07:16 -05:00
Alex Gleason ab9eabdf20
Add SetMeta filter to store uploaded image sizes 2021-05-12 15:07:31 -05:00
feld 2926713fe5 Merge branch 'deprecate-public_endpoint' into 'develop'
Deprecate Uploaders.S3, :public_endpoint

See merge request pleroma/pleroma!3251
2021-01-20 22:48:48 +00:00
Mark Felder f0ab60189e truncated_namespace should default to nil 2021-01-13 11:54:00 -06:00
Haelwenn (lanodan) Monnier c4439c630f
Bump Copyright to 2021
grep -rl '# Copyright © .* Pleroma' * | xargs sed -i 's;Copyright © .* Pleroma .*;Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>;'
2021-01-13 07:49:50 +01:00
Mark Felder c35e6fb516 Provide a non-nil fallback for Upload.base_url/0 for tests using TestUploaderSuccess as the uploader 2021-01-12 16:34:24 -06:00
Mark Felder 12528edc34 Fix another ad-hoc construction of the upload base_url 2021-01-12 16:32:52 -06:00
feld fa63f1b55b Apply 4 suggestion(s) to 2 file(s) 2021-01-10 01:34:54 +00:00
Mark Felder e8bf060e6e Move construction of S3 base URL with optional namespace and bucket to Upload.base_url/0
Now we should have a correct base URL for S3 hosted objects throughout the codebase.
2021-01-08 17:32:42 -06:00
Mark Felder 530fb5b29e Avoid duplicate Config calls 2021-01-08 17:32:42 -06:00
Mark Felder ad79983614 Fix URL generated for backup files, try to create a source of truth we can reuse throughout the codebase 2021-01-08 17:32:42 -06:00
Mark Felder 55562ca936 Merge branch 'develop' into feature/gen-magic 2020-09-10 16:05:22 -05:00
lain aabc26a573 Pleroma.Upload: Set default upload name / description based on config. 2020-08-18 13:21:30 +02:00
lain af7720237b Upload: Restrict description length 2020-07-06 11:08:13 +02:00
href f124f68205 Switch from gen_magic to majic, use Majic.Plug, remove Pleroma.MIME 2020-06-16 15:27:27 +02:00
lain cc0d462e91 Attachments: Have the mediaType on the root, too. 2020-05-21 15:08:56 +02:00
Egor Kislitsyn 6802dc28ba
Add OpenAPI spec for PleromaAPI.AccountController 2020-05-13 19:06:46 +04:00
Mark Felder 05da5f5cca Update Copyrights 2020-03-03 16:44:49 -06:00
Alexander Strizhakov 32d1e04817
ActivityPub actions & side-effects in transaction 2020-03-01 12:01:39 +03:00
Haelwenn (lanodan) Monnier 3c6fd0bb99
upload.ex: Remove deprecated configuration 2019-10-18 12:34:09 +02:00
feld 84fca14c3c Do not prepend /media/ when using base_url
This ensures admin has full control over the path where media resides.
2019-07-24 15:35:25 +00:00
Haelwenn (lanodan) Monnier 69a5074893
Remove H1 in @moduledoc 2019-05-06 04:53:12 +02:00
rinpatch e2fe796c63 Add some tests 2019-03-14 22:02:48 +03:00
rinpatch 5a73cae2be WIP: Stop mangling filenames 2019-03-12 09:10:19 +03:00
rinpatch 4263edc9c9 Properly escape reserved URI charachters in upload urls 2019-03-05 18:09:23 +03:00
Haelwenn (lanodan) Monnier 106f4e7a0f
Credo fixes: parameter consistency 2019-02-09 14:59:20 +01:00
Mark Felder 0c08bd4181 Update Mogrify docs and warning for deprecated syntax to encourage
users to enable both strip and auto-orient
2019-02-03 16:39:42 +00:00
lambda 646bb87816 Merge branch 'fix/elixir-1-8-type-annotation' into 'develop'
Fix Elixir 1.8 type annotation issue

Closes #523

See merge request pleroma/pleroma!668
2019-01-15 08:51:59 +00:00
Haelwenn (lanodan) Monnier 9fcdca1bdc
Upload: Fix uploading with a : in the filename 2019-01-15 07:57:48 +01:00
Haelwenn (lanodan) Monnier e3eb75bd23
Upload: Fix uploading with a ? in the filename 2019-01-15 07:40:39 +01:00
Maxim Filippov e8eff9fe03 Fix Elixir 1.8 type annotation issue 2019-01-15 02:58:48 +02:00
Shadowfacts 42b7584068
URI escape file upload URLs 2019-01-14 11:31:44 -05:00
William Pitcock 980b5288ed update copyright years to 2019 2018-12-31 15:41:47 +00:00
William Pitcock 2791ce9a1f add license boilerplate to pleroma core 2018-12-23 20:56:42 +00:00
Maksim Pechnikov e94c3442f4 updates 2018-12-10 13:27:37 +03:00
Maksim Pechnikov 074fa790ba fix compile warnings 2018-12-09 20:50:08 +03:00
href 65e7307d68
Upload: bring back base_url 2018-11-30 18:02:50 +01:00
href 5d92431350
Fix deprecation warnings 2018-11-30 18:02:50 +01:00