diff options
| author | rinpatch <rinpatch@sdf.org> | 2020-09-08 17:21:12 +0000 |
|---|---|---|
| committer | rinpatch <rinpatch@sdf.org> | 2020-09-08 17:21:12 +0000 |
| commit | 425324aae3d4534bc045466a1cc15653ddfa27d2 (patch) | |
| tree | 2d785eb4396e2dc79bb6b0bed5d766b393479dd5 /CHANGELOG.md | |
| parent | 73dd5bdb7dcdf804bdbabcf632671d4de5042ebc (diff) | |
| parent | 073f5490ece616fd9602382c1be1347457cbbe79 (diff) | |
| download | pleroma-2.1.1.tar.gz | |
Merge branch 'release/2.1.1' into 'stable'v2.1.1
2.1.1 release
See merge request pleroma/secteam/pleroma!13
Diffstat (limited to 'CHANGELOG.md')
| -rw-r--r-- | CHANGELOG.md | 25 |
1 files changed, 25 insertions, 0 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index 0850deed7..92635f6d0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,31 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). +## [2.1.1] - 2020-09-08 + +### Security +- Fix possible DoS in Mastodon API user search due to an error in match clauses, leading to an infinite recursion and subsequent OOM with certain inputs. +- Fix metadata leak for accounts and statuses on private instances. +- Fix possible DoS in Admin API search using an atom leak vulnerability. Authentication with admin rights was required to exploit. + +### Changed + +- **Breaking:** The metadata providers RelMe and Feed are no longer configurable. RelMe should always be activated and Feed only provides a <link> header tag for the actual RSS/Atom feed when the instance is public. +- Improved error message when cmake is not available at build stage. + +### Added +- Rich media failure tracking (along with `:failure_backoff` option). + +### Fixed +- Default HTTP adapter not respecting pool setting, leading to possible OOM. +- Fixed uploading webp images when the Exiftool Upload Filter is enabled by skipping them +- Mastodon API: Search parameter `following` now correctly returns the followings rather than the followers +- Mastodon API: Timelines hanging for (`number of posts with links * rich media timeout`) in the worst case. + Reduced to just rich media timeout. +- Mastodon API: Cards being wrong for preview statuses due to cache key collision. +- Password resets no longer processed for deactivated accounts. +- Favicon scraper raising exceptions on URLs longer than 255 characters. + ## [2.1.0] - 2020-08-28 ### Changed |