fedi/akkoma
1
0
Fork 0
mirror of https://akkoma.dev/AkkomaGang/akkoma.git synced 2024-11-10 02:05:12 +00:00
Code Issues Packages Projects Releases Wiki Activity
akkoma/lib/pleroma
History
Oneric a4fa2ec9af StealEmoji: make final paths infeasible to predict 
Certain attacks rely on predictable paths for their payloads.
If we weren’t so overly lax in our (id, URL) check, the current
counterfeit activity exploit would be one of those.
It seems plausible for future attacks to hinge on
or being made easier by predictable paths too.

In general, letting remote actors place arbitrary data at
a path within our domain of their choosing (sans prefix)
just doesn’t seem like a good idea.

Using fully random filenames would have worked as well, but this
is less friendly for admins checking emoji dirs.
The generated suffix should still be more than enough;
an attacker needs on average 140 trillion attempts to
correctly guess the final path.
2024-03-18 22:33:10 -01:00
..
activity Prune old Update activities 2024-02-17 16:57:40 +01:00
akkoma Add MRFs for direct message manipulation 2023-05-22 23:53:44 +01:00
captcha Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
collections Add URL and code to :not_found errors 2022-12-09 20:13:31 +00:00
config Config: Check the permissions of the linked file instead of the symlink↵ 2024-02-14 18:30:27 +01:00
conversation Add API endpoint to remove a conversation 2021-02-15 21:48:13 +04:00
docs backend-i18n (#121) 2022-07-27 21:56:59 +00:00
ecto_type recipients fixes/hardening for CreateGenericValidator 2021-04-05 19:19:11 +02:00
emails Provide sane defaults for SMTP 2024-02-12 22:45:57 +01:00
emoji Convert StealEmoji to pack.json 2024-03-18 22:33:10 -01:00
helpers giant massive dep upgrade and dialyxir-found error emporium (#371) 2022-12-14 12:38:48 +00:00
http Support elixir1.15 2023-08-03 17:44:09 +01:00
instances Add timeline visibility options 2023-03-17 15:33:28 +00:00
mfa Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
migration_helper purge chat and shout endpoints 2022-07-21 11:29:28 +01:00
migrators Support elixir1.15 2023-08-03 17:44:09 +01:00
object Tag Mock-tests as "mocked" and run them seperately 2023-08-04 12:50:50 +01:00
password Pbkdf2: Use it everywhere. 2021-01-14 15:06:16 +01:00
reverse_proxy giant massive dep upgrade and dialyxir-found error emporium (#371) 2022-12-14 12:38:48 +00:00
search giant massive dep upgrade and dialyxir-found error emporium (#371) 2022-12-14 12:38:48 +00:00
tests Fix compile cycle in Pleroma.Tests.AuthTestController 2021-06-09 13:30:19 -05:00
upload Support elixir1.15 2023-08-03 17:44:09 +01:00
uploaders Use finch everywhere (#33) 2022-07-04 16:30:38 +00:00
user Support elixir1.15 2023-08-03 17:44:09 +01:00
web StealEmoji: make final paths infeasible to predict 2024-03-18 22:33:10 -01:00
workers Prune old Update activities 2024-02-17 16:57:40 +01:00
activity.ex Support elixir1.15 2023-08-03 17:44:09 +01:00
announcement.ex giant massive dep upgrade and dialyxir-found error emporium (#371) 2022-12-14 12:38:48 +00:00
announcement_read_relationship.ex Merge branch 'from/upstream-develop/tusooa/server-announcements' into 'develop' (#85) 2022-07-18 13:08:36 +00:00
application.ex Ensure we can't crash out on unusual logger backend settings 2023-08-06 15:12:57 +01:00
application_requirements.ex Support elixir1.15 2023-08-03 17:44:09 +01:00
bookmark.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
caching.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
captcha.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
clippy.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
config.ex Merge remote-tracking branch 'remotes/origin/develop' into feature/object-hashtags-rework 2021-02-23 13:58:35 +03:00
config_db.ex Do not crash on invalid atom in configDB 2022-12-21 00:16:39 +00:00
constants.ex fix the /embed endpoint 2023-05-31 23:42:08 +00:00
conversation.ex Add API endpoint to remove a conversation 2021-02-15 21:48:13 +04:00
counter_cache.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
data_migration.ex [#3213] HashtagsTableMigrator state management refactoring & improvements (proper stats serialization etc.). 2021-02-16 23:14:15 +03:00
delivery.ex Merge remote-tracking branch 'remotes/origin/develop' into feature/object-hashtags-rework 2021-01-13 22:11:16 +03:00
ecto_enums.ex v2 Suggestions: dismiss a suggestion 2021-11-26 20:19:29 -06:00
emoji-test.txt emoji-test: update to latest 15.0 draft 2022-09-11 19:55:45 +01:00
emoji.ex Remove _misskey_reaction matching (#500) 2023-03-10 18:46:49 +00:00
filter.ex support for expires_in/expires_at in filters 2021-01-26 08:27:45 +03:00
following_relationship.ex paginate follow requests (#460) 2023-02-04 20:51:17 +00:00
formatter.ex Interpret \n as newline for MFM 2023-02-18 19:56:11 +01:00
frontend.ex Ensure Gun is Gone 2022-12-11 19:26:21 +00:00
hashtag.ex Remerge of hashtag following (#341) 2022-12-05 12:58:48 +00:00
healthcheck.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
html.ex Break out activity-specific HTML functions into Pleroma.Activity.HTML 2021-05-29 12:29:11 -05:00
http.ex Allow Pleroma.HTTP to connect to raw-HTTP without freaking mint out 2023-08-04 23:51:15 +01:00
instances.ex Add Signed Fetch Statistics (#312) 2022-11-26 19:22:56 +00:00
iso639.ex Add language support on /api/v1/statuses 2023-01-10 10:29:17 +00:00
job_queue_monitor.ex Use fully qualified function capture for telementry event 2024-02-12 01:59:18 +01:00
jwt.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
keys.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
list.ex ListController: Fix being unable to add / remove users. 2021-01-18 16:28:36 +01:00
logging.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
maintenance.ex Support elixir1.15 2023-08-03 17:44:09 +01:00
maps.ex utils: Fix maybe_splice_recipient when "object" isn’t a map 2021-04-05 19:19:12 +02:00
marker.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
mfa.ex Pbkdf2: Use it everywhere. 2021-01-14 15:06:16 +01:00
moderation_log.ex giant massive dep upgrade and dialyxir-found error emporium (#371) 2022-12-14 12:38:48 +00:00
notification.ex Require related object for notifications to filter on content 2023-06-14 19:41:48 +00:00
object.ex giant massive dep upgrade and dialyxir-found error emporium (#371) 2022-12-14 12:38:48 +00:00
object_tombstone.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
otp_version.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
pagination.ex Add /api/v1/followed_tags 2022-12-31 18:09:34 +00:00
password.ex update references to pleroma in docs 2022-12-30 03:43:35 +00:00
password_reset_token.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
prometheus_exporter.ex Use a genserver to periodically fetch metrics 2023-01-01 18:32:14 +00:00
registration.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
release_tasks.ex giant massive dep upgrade and dialyxir-found error emporium (#371) 2022-12-14 12:38:48 +00:00
repo.ex Remove instrumentors (#98) 2022-07-21 11:32:17 +00:00
report_note.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
reverse_proxy.ex Sanitise Content-Type of media proxy URLs 2024-03-18 22:33:10 -01:00
scheduled_activity.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
search.ex Don't try removing deleted users and such from index as posts 2022-06-29 20:49:45 +01:00
signature.ex Fix invalid Date HTTP header when signing fetch requests 2023-08-07 12:43:42 +00:00
stats.ex update stats every 5 minutes 2022-12-16 17:22:56 +00:00
thread_mute.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
upload.ex Always insert Dedupe upload filter 2024-03-18 22:33:10 -01:00
user.ex Federate user profile background 2024-02-16 16:35:51 +01:00
user_invite_token.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
user_note.ex Make UserNote comment default to the empty string. 2023-04-27 05:22:12 +00:00
user_relationship.ex fix flaky test_user_relationship_test.exs:81 2022-10-23 13:31:01 +02:00
utils.ex extend custom runtime system (#108) 2022-07-24 16:42:43 +00:00
web.ex Migrate to phoenix 1.7 (#626) 2023-08-15 10:22:18 +00:00
xml_builder.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00