aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* | | if we have not been provided a profile id set the profile id to the default ↵Mario Vavti2022-04-251-0/+4
| | | | | | | | | | | | profile - fixes #1671
* | | Merge branch 'dev' of https://framagit.org/hubzilla/core into devMario Vavti2022-04-231-3/+8
|\ \ \
| * | | check if addons have been removed from the filesystem and also remove them ↵Mario2022-04-221-3/+8
| | | | | | | | | | | | | | | | from the db if that is the case
* | | | fix regression with incoming poll answers from activitypubMario Vavti2022-04-231-1/+1
|/ / /
* | | move AP addressing to pubcrawlMario Vavti2022-04-071-122/+14
| | | | | | | | | (cherry picked from commit 1390e1db399c06cb76e191437eb5be24dd95a5c7)
* | | fixes in regard to hub re-installs: dismiss deleted hublocs, make sure we ↵Mario2022-04-013-11/+11
| | | | | | | | | | | | use the latest hubloc entry for addressing, in Queue::deliver() prefer primaries since their info is probably more accurate
* | | fix PHP errorMario2022-03-311-3/+6
| |/ |/|
* | update changelogMario Vavti2022-03-291-1/+1
| |
* | Merge branch 'fix-changelog' into 'dev'Mario2022-03-271-2/+3
|\ \ | | | | | | | | | | | | Update changelog with missing fix and cve See merge request hubzilla/core!2018
| * | Update changelog with missing fix and cveHarald Eilertsen2022-03-251-2/+3
|/ /
* | changelogMario2022-03-251-0/+38
| |
* | bump dev versionMario2022-03-231-1/+1
| |
* | stringsMario2022-03-232-860/+933
| |
* | make sure to set comments_closed to the created date if nocomment is setMario Vavti2022-03-231-1/+1
| |
* | streamline comment policy with downstreamMario2022-03-232-33/+5
| |
* | Merge branch 'security-fixes-lfi-xss-open-redirect' into 'dev'Mario2022-03-2315-50/+122
|\ \ | | | | | | | | | | | | Security fixes See merge request hubzilla/core!2017
| * | CVE-2022-27256: Open redirect via rpath query param.Harald Eilertsen2022-03-2010-27/+27
| | | | | | | | | | | | | | | | | | | | | | | | Don't follow urls to external sites when submitting forms from the settings modules. This mitigates an Open Redirect vulnerability where an attacker could trick a user to go to an attacker controlled destination. Fixes part of https://framagit.org/hubzilla/core/-/issues/1666
| * | Add function is_local_url() to check if url is local.Harald Eilertsen2022-03-202-0/+41
| | |
| * | CVE-2022-27258: XSS via rpath query param.Harald Eilertsen2022-03-2010-20/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Escape URLs provided by the rpath query param in settings modules. This prevents a possible Cross-Site scripting vulnerability, where an attacker could inject web scripts and html into the settings form via the rpath query parameter, and have a user execute the script by tricking them to clicking a link. Fixes part of https://framagit.org/hubzilla/core/-/issues/1666
| * | Add helper to escape URLs.Harald Eilertsen2022-03-202-0/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | The escaping makes the URL safe for display and for use in HTML element attributes (such as href="..." etc), but does not guarantee that the URL itself is valid after conversion. This should be good enough for mitigating XSS issues caused by injecting html or javascript into a URL. Also probably good enough for _most_ normal URLs, but there may be devils hidden in the details somewhere.
| * | CVE-2022-27257: LFI in Redbasic theme.Harald Eilertsen2022-03-201-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Limit valid chars in schema names, and discard attempts at loading schemas with invalid names. This prevents a local file inclusion vulnerability where an unauthenticated attacker can include arbitrary php files readable by the server process and potentially obtain remote code execution. Valid schema names may consist of ascii letters, numbers, hyphens and underscores. Should be good enough for most cases, I think. Fixes https://framagit.org/hubzilla/core/-/issues/1665
* | | Merge branch 'dev' of https://framagit.org/hubzilla/core into devMario2022-03-203-5/+1911
|\ \ \
| * \ \ Merge branch 'volse-redbasic-dark' into 'dev'Mario2022-03-203-5/+1911
| |\ \ \ | | |/ / | |/| | | | | | | | | | redbasic/dark: Use bootstrap-nightfall for dark schema. See merge request hubzilla/core!2016
| | * | redbasic/dark: Tune button colours a bit.Harald Eilertsen2022-03-131-5/+5
| | | | | | | | | | | | | | | | Makes buttons a bit less bright so they don't stick out quite as much.
| | * | redbasic/dark: Use schema colour for dropdown itemHarald Eilertsen2022-03-131-0/+4
| | | |
| | * | redbasic/dark: Use bootstrap-nightfall for dark schema.Harald Eilertsen2022-03-132-0/+1902
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a color only stylesheet, modifying the original Bootstrap colors to a dark variant. Insert this as base before the redbasic dark schema modifications, and any custom modifications to have a nicer base for the dark schema.
* | | | add the signing algo to zotinfo, and store it in import_xchan() if presentMario2022-03-202-0/+9
|/ / /
* | | Merge branch 'volse-fix-stylesheet-root-path' into 'dev'Mario2022-03-172-42/+7
|\ \ \ | | | | | | | | | | | | | | | | Use correct base url for stylesheets and js. See merge request hubzilla/core!2015
| * | | Trim trailing & from query_string.Harald Eilertsen2022-03-131-0/+5
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When trying to fetch an image file from the Cloud module, the default nginx config will add a trailing & if there's no args specified. Example: https://example.com/cloud/username/some_image.png This will be rewritten to: https://example.com/index.php?q=/cloud/username/some_image.png& This in turn will cause the Cloud module to try to redirect back to the original because it does not match the query_string (in which the ampersand has been converted to a question mark). And this will repeat until the browser get's tired of it.
| * | Remove now unused function script_path.Harald Eilertsen2022-03-031-38/+0
| | |
| * | Use correct base url for stylesheets and js.Harald Eilertsen2022-03-031-4/+2
| | | | | | | | | | | | | | | | | | Use z_root instead of script_path when formatting stylesheet and javascript links for the head section. script_path does not preserve information about the port if the site uses a nonstandard port.
* | | make sure an announce does not overwrite an item we already have and make ↵Mario2022-03-111-0/+7
| | | | | | | | | | | | sure it will be a toplevel post
* | | whitespaceMario2022-03-101-35/+35
| | |
* | | support for hs2019Mario2022-03-102-16/+61
| | |
* | | move attachments to the topMario2022-03-051-5/+5
| | |
* | | remove loggingMario2022-03-041-1/+1
| | |
* | | event fixesMario2022-03-042-6/+10
| | |
* | | bump versionMario2022-03-041-1/+1
| | |
* | | fix regressionMario2022-03-041-2/+2
| | |
* | | streamline event activity handlingMario2022-03-042-61/+208
| | |
* | | bump versionMario2022-03-041-1/+1
| | |
* | | port some ap quirks from the addonMario2022-03-041-15/+50
| | |
* | | more work on enhanced content filtersMario2022-03-032-3/+39
|/ /
* | fix duplicate ids in login form and move login/register buttons into the ↵Mario2022-03-036-47/+57
| | | | | | | | hamburger menu on small screens
* | collect the accept headers in an arrayMario2022-03-031-2/+6
| |
* | Merge branch 'dev' of https://framagit.org/hubzilla/core into devMario2022-03-021-2/+2
|\ \
| * | Merge branch 't0rum-master-patch-68993' into 'master'Mario2022-03-011-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | Typo in Setup.php prevents users from using Postgres See merge request hubzilla/core!2014 (cherry picked from commit 0e2e9321025f87fe9587f3d183adaea6185e4e20) d384f55d Typo in Setup.php prevents users from using Postgres
* | | composer updatesMario2022-03-0210-132/+145
| | |
* | | port some peertube tweeks from pubcrawl to lib/activityMario2022-03-021-20/+47
|/ /
* | fix feedutils regressionMario2022-03-011-4/+4
| |
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-16 15:57:17 +0000