Commit graph

15459 commits

Author SHA1 Message Date
Oneric 7ef93c0b6d Add set_content_type to Plug.StaticNoCT 2024-03-04 17:50:20 +01:00
Oneric dbb6091d01 Import copy of Plug.Static from Plug 1.15.3
The following commit will apply the needed patch
2024-03-04 17:50:20 +01:00
Oneric 5d467af6c5 Update notes on security exploit handling 2024-03-04 17:50:19 +01:00
FloatingGhost 889b57df82 2024.02 release 2024-02-24 13:54:21 +00:00
Weblate 34ffb92db4 Update translation files
Updated by "Squash Git commits" hook in Weblate.

Co-authored-by: Weblate <noreply@weblate.org>
Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-posix-errors/
Translation: Pleroma fe/Akkoma Backend (Posix Errors)
2024-02-24 13:42:59 +00:00
Weblate c6dceb1802 Translated using Weblate (Polish)
Currently translated at 100.0% (47 of 47 strings)

Co-authored-by: Weblate <noreply@weblate.org>
Co-authored-by: subtype <subtype@hollow.capital>
Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-posix-errors/pl/
Translation: Pleroma fe/Akkoma Backend (Posix Errors)
2024-02-24 13:42:59 +00:00
Weblate caaf2deb22 Translated using Weblate (Polish)
Currently translated at 18.1% (183 of 1006 strings)

Translated using Weblate (Polish)

Currently translated at 6.6% (67 of 1006 strings)

Co-authored-by: Weblate <noreply@weblate.org>
Co-authored-by: subtype <subtype@hollow.capital>
Translate-URL: http://translate.akkoma.dev/projects/akkoma/akkoma-backend-config-descriptions/pl/
Translation: Pleroma fe/Akkoma Backend (Config Descriptions)
2024-02-24 13:42:59 +00:00
floatingghost 7d61fb0906 Merge pull request 'Fix static-fe Twitter metadata / URL previews' (#700) from Oneric/akkoma:staticfe-metadata into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/700
2024-02-24 13:42:55 +00:00
floatingghost cdf73e0ac8 Merge pull request 'Better document database differences for Pleroma migrations' (#699) from Oneric/akkoma:doc_pleroma-migration-db into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/699
2024-02-24 04:33:43 +00:00
floatingghost 967e6b8ade Merge pull request 'Docs: Add description for mrf_reject_newly_created_account_notes' (#695) from YokaiRick/akkoma:doc_mrf_reject_acc_notes into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/695
2024-02-24 04:31:28 +00:00
Oneric bff2812a93 More prominently document db migrations in migrations from Pleroma
By now most instance will run a version past 2022-08 but the guide
only documented it for from source installs and Pleroma develop.
2024-02-23 23:54:14 +01:00
Oneric 7964272c98 Document how to avoid data loss on migration from Pleroma 2024-02-23 23:54:09 +01:00
Oneric c08f49d88e Add tests for static-fe metadata tags 2024-02-21 00:33:32 +00:00
FloatingGhost 3111181d3c mix format 2024-02-20 15:09:04 +00:00
floatingghost 2f9aad0e65 Merge pull request '[Security] StealEmojiPolicy: Sanitize shortcodes' (#701) from erincandescent/akkoma:stealemojipolicy-sanitize into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/701
2024-02-20 15:08:54 +00:00
Erin Shepherd b387f4a1c1 Don't steal emoji who's shortcodes have dots or colons in their name
Mastodon at the very least seems to prevent the creation of emoji with
dots in their name (and refuses to accept them in federation). It feels
like being cautious in what we accept is reasonable here.

Colons are the emoji separator and so obviously should be blocked.

Perhaps instead of filtering out things like this we should just
do a regex match on `[a-zA-Z0-9_-]`? But that's plausibly a decision
for another day

    Perhaps we should also have a centralised "is this a valid emoji shortcode?"
    function
2024-02-20 11:33:55 +01:00
Haelwenn (lanodan) Monnier 7d94476dd6 StealEmojiPolicy: Sanitize shortcodes
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3245
2024-02-20 11:19:00 +01:00
rick c25cfe9b7a fixed spelling 2024-02-19 23:25:20 +01:00
Oneric 41dd37d796 doc/cheatsheet: add missing MRFs
Or mentions of MRFs in the main list
whose options were already documented.
2024-02-19 23:15:47 +01:00
Oneric 9830d54fa1 doc/cheatsheet: sort main MRF list alphabetically
It is too cumbersome to find a specific policy atm
or to check if all are docuemtned yet.
Trivial placeholder policies are excluded from this.
2024-02-19 23:15:30 +01:00
Oneric f254e4f530 doc/cheatsheet: add missing MRF config detail docs
And remove “on by default” text from individual entries.
They are now laready in the “on by default” section.
2024-02-19 23:14:44 +01:00
Oneric da4190c46e doc/cheatsheet: split out always active MRFs
It doesn’t make sense to add/remove them from the policies list
2024-02-19 23:14:24 +01:00
Oneric 7a2d68c3ab doc/cheatsheet: add link to ActivityExpiration config details 2024-02-19 23:14:07 +01:00
Oneric 8e7a89605d doc/cheatsheet: move MRF policies key to end of section
This makes it easier to spot the transparency options
2024-02-19 23:13:48 +01:00
Oneric 1640d19448 doc/cheatsheet: move :activitypub section ahead
Else it is too easy to mistake for another MRF policy.
2024-02-19 23:13:25 +01:00
Oneric 8f1776a8a7 Purge leftovers from FollowBot MRF
It was dropped in 9db4c2429f
2024-02-19 23:13:05 +01:00
Oneric 1ec6e193e6 doc: clarify RejectNewlyCreated uses local account discovery 2024-02-19 23:12:41 +01:00
Oneric 37e2a35b86 Fix Twitter metadata
This partly reverts 1d884fd914
while fixing both the issue it addressed and the issue it caused.

The above commit successfully fixed OpenGraph metadata tags
which until then always showed the user bio instead of post content
by handing the activities AP ID as url to the Metadata builder
_instead_ of passing the internal ID as activity_id.
However, in doing so the commit instead inflicted this very problem
onto Twitter metadata tags which ironically are used by akkoma-fe.

This is because while the OpenGraph builder wants an URL as url,
the Twitter builder needs the internal ID to build the URL to the
embedded player for videos and has no URL property.

Thanks to twpol for tracking down this root cause in #644.

Now, once identified the problem is simple, but this simplicity
invites multiple possible solutions to bikeshed about.

 1. Just pass both properties to the builder and let them pick

 2. Drop the url parameter from the OpenGraph builder and instead
     a) build static-fe URL of the post from the ID (like Twitter)
     b) use the passed-in object’s AP ID as an URL

Approach 2a has the disadvantage of hardcoding the expected URL outside
the router, which will be problematic should it ever change.
Approach 2b is conceptually similar to how the builder works atm.
However, the og:url is supposed to be a _permanent_ ID, by changing it
we might, afaiui, technically violate OpenGraph specs(?). (Though its
real-world consequence may very well be near non-existent.)

This leaves just approach 1, which this commit implements.
Albeit it too is not without nits to pick, as it leaves the metadata
builders with an inconsistent interface.

Additionally, this will resolve the subotpimal Discord previews for
content-less image posts reported in #664.
Discord already prefers OpenGraph metadata, so it’s mostly unaffected.
However, it appears when encountering an explicitly empty OpenGraph
description and a non-empty Twitter description, it replaces just the
empty field with its Twitter counterpart, resulting in the user’s bio
slipping into the preview.
Secondly, regardless of any OpenGraph tags, Discord uses twitter:card to
decide how prominently images should be, but due to the bug the card
type was stuck as "summary", forcing images to always remain small.

Root cause identified by: twpol

Fixes: https://akkoma.dev/AkkomaGang/akkoma/issues/644
Fixes: https://akkoma.dev/AkkomaGang/akkoma/issues/664
2024-02-19 21:09:43 +00:00
floatingghost 086d6100e1 Merge pull request 'Disable busy waits in the default OTP vm.args configuration.' (#693) from erincandescent/akkoma:otp-tune-vm-busywait into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/693
2024-02-19 14:01:14 +00:00
floatingghost 3e24210e9f Merge pull request 'Prune old Update activities' (#683) from Oneric/akkoma:db-prune-old-updates into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/683
2024-02-19 13:59:33 +00:00
floatingghost 551ae69541 Merge pull request 'Fix and provide sane defaults for SMTP' (#686) from Oneric/akkoma:smtp-defaults into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/686
2024-02-19 13:39:15 +00:00
YokaiRick 37f9626116 Merge pull request 'Docs: reword description for mrf_reject_newly_created_account_notes for more clarity' (#1) from stefan230/akkoma:doc_mrf_reject_acc_notes_patch into doc_mrf_reject_acc_notes
Reviewed-on: https://akkoma.dev/YokaiRick/akkoma/pulls/1
2024-02-17 22:19:32 +00:00
stefan230 b4c832471c docs/docs/configuration/cheatsheet.md aktualisiert
fixed up some grammer / wording. removed a setence and made wording more in line with what I could find in Admin-FE (especially wording of "rejecting" vs. dropping)
2024-02-17 22:09:47 +00:00
rick db49daa4a5 make it clearer what it affects 2024-02-17 22:57:56 +01:00
rick 718104117f fix link 2024-02-17 22:34:55 +01:00
rick 12e7d0a25c added doc for mrf_reject_newly_created_account_notes 2024-02-17 22:25:12 +01:00
Oneric 1a7839eaf2 Prune old Update activities
Once processed they serve no purpose anymore afaict.
Therefor, lets prune them like other transient activities
to not unnecessarily bloat the table.
2024-02-17 16:57:40 +01:00
Oneric 1ef8b967d2 test: fix typos affecting remove factory
Apparently nothing used this factory until now
2024-02-17 16:57:40 +01:00
Erin Shepherd 7a0e27a746 Disable busy waits in the default OTP vm.args configuration.
This vastly reduces idle CPU usage, which should generally be beneficial
for most small-to-medium sized instances.

Additionally update the documentation to specify how to override the vm.args
file for OTP installs
2024-02-17 13:21:56 +01:00
floatingghost 755c75d8a4 Merge pull request 'Clean up warnings (+fallback metrics)' (#685) from Oneric/akkoma:metrics into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/685
2024-02-17 11:41:10 +00:00
floatingghost 289f93f5a2 Merge pull request 'Return last_status_at as date, not datetime' (#681) from katafrakt/akkoma:fix-last-status-at into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/681
2024-02-17 11:37:19 +00:00
floatingghost 371b258c99 Merge pull request 'Fix SimplePolicy blocking account updates' (#692) from Oneric/akkoma:fix-background_removal into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/692
2024-02-17 10:34:16 +00:00
Oneric 3b0714c4fd Fix SimplePolicy blocking account updates
This fixes an oversight in e99e2407f3
which added background_removal as a possible SimplePolicy setting.
However, it did _not_ add a default value to the base config and
as it turns out instance_list doesn’t handle unset options well.

In effect this caused federating instances with SimplePolicy enabled
but background_removal not explicitly configured to always trip up for
outgoing account updates in check_background_removal (and incoming
updates from Sharkey).
For added ""fun"" this error was able to block account updates made
e.g. via /api/v1/accounts/update_credentials.

Tests were unaffected since they explicitly override
all relevant config options.

Set a default to avoid all this
(note to self: don’t forget next time, baka!)
2024-02-17 03:10:05 +01:00
floatingghost 34c213f02f Merge pull request 'Federate user profile background' (#682) from Oneric/akkoma:background-federation into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/682
2024-02-16 21:00:10 +00:00
Oneric e99e2407f3 Add background_removal to SimplePolicy MRF 2024-02-16 16:36:45 +01:00
Oneric 7622aa27ca Federate user profile background
Currently our own frontend doesn’t show backgrounds of other users, this
property is already publicly readable via REST API and likely was always
intended to be shown and federated.

Recently Sharkey added support for profile backgrounds and
immediately made them federate and be displayed to others.
We use the same AP field as Sharkey here which should make
it interoperable both ways out-of-the-box.

Ref.: 4e64397635
2024-02-16 16:35:51 +01:00
FloatingGhost 0ed815b8a1 Merge branch 'followback' into develop 2024-02-16 13:27:40 +00:00
floatingghost c5dcd07e08 Merge pull request 'Fix OpenAPI spec for preferred_frontend endpoint' (#680) from katafrakt/akkoma:fix-openapi-spec-for-preferred-frontend into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/680
2024-02-16 12:21:00 +00:00
floatingghost 874ee73a87 Merge pull request 'Document Akkoma API' (#678) from Oneric/akkoma:doc-akkomapi into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/678
2024-02-16 12:20:11 +00:00
floatingghost a905223837 Merge pull request 'Check permissions on configuration file, not symlink' (#687) from erincandescent/akkoma:config-stat-symlink into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/687
2024-02-16 12:19:08 +00:00