GNU social JP
  • FAQ
  • Login
GNU social JPは日本のGNU socialサーバーです。
Usage/ToS/admin/test/Pleroma FE

  • Public

    • Public
    • Network
    • Groups
    • Featured
    • Popular
    • People

Embed Notice

HTML Code

Corresponding Notice

  1. Embed this notice
     (mint@ryona.agency)'s status on Saturday, 27-May-2023 23:13:47 JST
    • Tadano
    • Some Purple Cat
    @Tadano @PurpCat It is, both the CSP header for /media/ and the rich media exploit.
    https://git.pleroma.social/pleroma/pleroma/-/commit/0d68804aa7efc4f3212e02218804755da93d03f0
    https://git.pleroma.social/pleroma/pleroma/-/commit/38bcf6b19e3d83cb6c4e6c82d237a26edcab167a
    Moving the media to subdomain might or might not be worth it depending on who you ask. You might also block access to js/html/svg uploads, that's what I did at least before more info dropped.
    In conversationSaturday, 27-May-2023 23:13:47 JST from ryona.agencypermalink

    Attachments

    1. Domain not in remote thumbnail source whitelist: git.pleroma.social
      Filter OEmbed HTML tags (0d68804a) · Commits · Pleroma / pleroma · GitLab
      Pleroma backend
    2. Domain not in remote thumbnail source whitelist: git.pleroma.social
      MediaProxyController: Apply CSP sandbox (38bcf6b1) · Commits · Pleroma / pleroma · GitLab
      Pleroma backend
  • Help
  • About
  • FAQ
  • TOS
  • Privacy
  • Source
  • Version
  • Contact

GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.

Creative Commons Attribution 3.0 All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.