Conversation

Notices

1. Embed this notice
   Alex Gleason (alex@gleasonator.com)'s status on Sunday, 27-Nov-2022 07:20:11 JST Alex Gleason

   • Sexy Moon
   • anime graf mays ?️?

   @graf @Moon Does that post still exist or it was deleted? EDIT: nvm, I see it now

   • Embed this notice
     Alex Gleason (alex@gleasonator.com)'s status on Sunday, 27-Nov-2022 07:20:08 JST Alex Gleason

     in reply to

     • Zero :zt_think: :artix:
     • Sexy Moon
     • anime graf mays ?️?

     @zero @graf @Moon Also, it’s clear the Akkoma dev did not fully understand the code.

   • Embed this notice
     Alex Gleason (alex@gleasonator.com)'s status on Sunday, 27-Nov-2022 07:20:09 JST Alex Gleason

     in reply to

     • Zero :zt_think: :artix:
     • Sexy Moon
     • anime graf mays ?️?

     @zero @graf @Moon The fix I shared works without patching the code, including on old Pleroma versions and OTP releases.

     You’re free to allow markdown images, but I think it’s a pretty stupid idea which results in additional problems.

   • Embed this notice
     Alex Gleason (alex@gleasonator.com)'s status on Sunday, 27-Nov-2022 07:20:10 JST Alex Gleason

     in reply to

     • Sexy Moon
     • anime graf mays ?️?

     @graf @Moon Okay. The actual fix is this:

     config :pleroma, :markup, allow_inline_images: false

     There’s a scary comment above the line in Pleroma.

     config :pleroma, :markup, # XXX - unfortunately, inline images must be enabled by default right now, because # of custom emoji. Issue #275 discusses defanging that somehow. allow_inline_images: true,

     …but custom emojis do NOT rely on inline images. There’s no good reason for it to be on.

   • Embed this notice
     Zero :zt_think: :artix: (zero@strelizia.net)'s status on Sunday, 27-Nov-2022 07:20:10 JST Zero :zt_think: :artix:

     in reply to

     • Sexy Moon
     • anime graf mays ?️?
     @alex @graf @Moon no, this is the fix
     that is way overboard
     twl likes this.
   • Embed this notice
     anime graf mays ?️? (graf@poa.st)'s status on Sunday, 27-Nov-2022 07:20:11 JST anime graf mays ?️?

     in reply to

     • Sexy Moon
     @alex @Moon this is what's being done
     
     strelizia.net/objects/d1867573-666c-4760-84e8-521e03467d9f
   • Embed this notice
     Alex Gleason (alex@gleasonator.com)'s status on Sunday, 27-Nov-2022 07:29:59 JST Alex Gleason

     in reply to

     • Sexy Moon
     • anime graf mays ?️?

     @graf @Moon Here’s the MR: https://gitlab.com/soapbox-pub/rebased/-/merge_requests/218

   • Embed this notice
     Alex Gleason (alex@gleasonator.com)'s status on Sunday, 27-Nov-2022 15:26:16 JST Alex Gleason

     in reply to

     • Zero :zt_think: :artix:
     • Sexy Moon
     • anime graf mays ?️?
     • Coyote

     @Coyote @graf @Moon @zero divs are not allowed through. Send a link do that post?

   • Embed this notice
     Coyote (coyote@social.singing.dog)'s status on Sunday, 27-Nov-2022 15:26:18 JST Coyote

     in reply to

     • Zero :zt_think: :artix:
     • Sexy Moon
     • anime graf mays ?️?

     @alex @graf @Moon @zero Disabling inline images is likely not a complete fix for this by the way. At least with Pleroma, the main problem is that somehow a div isn’t getting scrubbed out, so just removing imgs isn’t going to stop someone from doing pic related.

   • Embed this notice
     Coyote (coyote@social.singing.dog)'s status on Sunday, 27-Nov-2022 15:38:40 JST Coyote

     in reply to

     • Zero :zt_think: :artix:
     • Sexy Moon
     • anime graf mays ?️?

     @alex @graf @Moon @zero The post from the image isn’t real (the front end won’t accept it, and I’m too lazy to specially craft it), but it’s based off of this one https://bae.st/notice/AQ0i0s5q5tL4xLzW40 that does have a div on its local instance and my own.

     Alex Gleason likes this.
   • Embed this notice
     Alex Gleason (alex@gleasonator.com)'s status on Sunday, 27-Nov-2022 15:39:35 JST Alex Gleason

     in reply to

     • Zero :zt_think: :artix:
     • Sexy Moon
     • anime graf mays ?️?
     • Coyote

     @Coyote @graf @Moon @zero Either scrubbers are disabled, or the div is inserted dynamically by Pleroma FE (most likely).