59 Commits (1f85fc8da2fce9fa8928811459c411ba6b60680b)

Author	SHA1	Message	Date
Your Name	87ed60d675	Accept compacted Note attachments (#6588) ... Normalize JSON-LD compacted single attachments (a bare object instead of a one-item array) in getAttachments(), and route verifyAttachments() through it so validation and import share one normalization path. Includes PR #6589's tests plus additional edge-case coverage: list-form preservation, bare-input normalization, and guards for missing/empty/scalar attachments.	4 weeks ago
Your Name	3d82a8e8b2	Fix unauthenticated SSRF in remote media/avatar fetch (variant of CVE-2026-71246) ... The remote media path validated URLs only as strings (Helpers::validateUrl normalizes the host + checks a ban list) and then downloaded them with Http::head + file_get_contents($url), which resolve DNS themselves and follow redirects with no private-IP checks and no address pinning. A remote actor whose icon.url redirected to an internal address (e.g. 172.18.0.1 or 169.254.169.254) made the queue worker fetch internal content and, for image responses, republish it at a public avatar URL. No account required. Fixes: - Add SecureMediaFetchService: validates URL, resolves + rejects non-global IPs (fail-closed), pins the connection to the validated IP via CURLOPT_RESOLVE, disables auto-redirects with per-hop re-validation, and enforces https-only + a byte cap. Mirrors the ActivityPubFetchService hardening from CVE-2026-71246. - Route MediaStorageService head()/fetchAvatar()/remoteToCloud() through it, removing the bare Http::head and file_get_contents($url) sinks. - validateUrl(): when DNS verification is enabled, reject hosts that resolve into reserved ranges, closing the metadata.google.internal bypass. - Harden adjacent same-class sinks: CustomEmojiService (emoji doc + image + head), FetchCacheService/webfinger, and DiscoverActor. - Add regression tests (tests/Unit/ActivityPub/SsrfUrlValidationTest.php).	4 weeks ago
Your Name	c0cde2f682	refactor: move 52 legacy models from App\ to App\Models\ ... Move all Eloquent models from the app/ root directory to app/Models/ for consistency with modern Laravel conventions. The project already had 54 models in App\Models; this migrates the remaining 52 legacy models. Changes: - Move 52 model files from app/ to app/Models/ - Update namespace declarations in each model - Update all ~1000 import references across the codebase - Add Relation::morphMap() in AppServiceProvider for backward compatibility with existing polymorphic database records - Add missing HasSnowflakePrimary imports for models that relied on same-namespace resolution	4 weeks ago
Your Name	412c29bb47	Improve test assertions and imports	4 weeks ago
Your Name	43040a2275	fix: add missing property declarations (phpstan property.notFound) ... - Add $fractal property and initialization to NewPublicPost event - Add $mastodon and $pleroma property declarations to AudienceScopeTest	4 weeks ago
Shlee	fc8e025339	Merge pull request #6758 from pixelfed/shleeable-patch-4 ... Fix: INSTANCE_CUR_REG_NOTIFY_ADMIN_ON_VERIFY	4 weeks ago
Shlee	49d8e02411	Merge pull request #6757 from pixelfed/shleeable-patch-3 ... Fix RESTRICTED_INSTANCE	4 weeks ago
Your Name	de3375a9f9	Apply Pint formatting to tests/	4 weeks ago
Shlee	da0805c455	Create CuratedOnboardingNotifyAdminTest.php	4 weeks ago
Shlee	508b573371	Create RestrictedAccessMiddlewareTest.php	4 weeks ago
dansup	db0b096798	Staging (#6343) ... * Prepared new docker * Docker setup improvements and fixes * Update DOCKER_SETUP.md * Update DOCKER_SETUP.md * Update DOCKER_SETUP.md * Update DOCKER_SETUP.md * Update DOCKER_SETUP.md * Update DOCKER_SETUP.md * Update .dockerignore * DB/Redis health check * updated health checks * updated install guide * updated DOCKER_SETUP * Updated DOCKER_SETUP * Updated DOCKER_SETUP * Update and rename DOCKER_SETUP.md to DOCKER_COMPOSE_SETUP.md * RemoveUnreachableStatementRector * Update GroupActivityPubService.php * Larastan: Add @property * Delete rector.php * more properties * 2fa_enabled needs to be refactored * Fix AdminUser.php syntax error - remove invalid property declaration * Update AdminUser.php * update * Upgrade predis from v2.0 to v3.2 - Update predis/predis from ^2.0 to ^3.2 - Predis v3.2.0 includes RESP3 support, improved pipeline abstractions - No code changes required, configuration remains compatible - Tested successfully with tinker * Upgrade predis from v2.0 to v3.2 * Update * Update .env.docker.example * Update DOCKER_COMPOSE_SETUP.md * Create ImageDriverManager.php * Update image.php * Update ImageResizePipeline.php * Update StoryComposeController.php * Update AvatarOptimize.php * Update Image.php * Update composer.json * Update AvatarOptimize.php * update lock * Update composer.lock * update * update * update * Allow to set new image types in admin interface * Update composer, fix deps * Update composer --------- Co-authored-by: Shlee <github@shl.ee> Co-authored-by: Your Name <you@example.com> Co-authored-by: Severin <savewish@icloud.com>	10 months ago
Your Name	9a22a4dbda	more properties	10 months ago
Shlee	5d8e5b64aa	Update CryptoTest.php	11 months ago
Shlee	0e0f3b9e95	Larastan: Update CryptoTest.php - REVIEW	11 months ago
Ross Bearman	3bef8a349f	Make test URLs environment-agnostic ... Alter link generation tests to use `config('app.url')`, rather than hardcoding `https://pixelfed.dev`	1 year ago
Daniel Supernault	71e3fa7aff	Use pest for tests	1 year ago
Daniel Simon	92f615d469	remove test prefix from test method names	2 years ago
Daniel Simon	f39bfcfa1d	replace @test annotations with #[Test] attributes, and add it where it was missing	2 years ago
Daniel Supernault	778e83d398	Update lexer regex, fix mention regex and add more tests	3 years ago
Daniel Supernault	d295e6059b	Update StatusTagsPipeline, fix object tags and slug normalization	3 years ago
Daniel Supernault	0f72b33c0e	Add tests	3 years ago
Daniel Supernault	d4f92da0e5	Fix test	3 years ago
Daniel Supernault	222dc3a192	Update test	4 years ago
Daniel Supernault	6bae1d0327	Remove unused tests	4 years ago
Daniel Supernault	fb584c02a6	Update NoteAttachmentTest	4 years ago
Sven Luijten	13d359a3c5	Clean up styling in the tests	4 years ago
Daniel Supernault	e95b702e23	Add activitypub story validator	5 years ago
Daniel Supernault	e90637098a	Add Bearcap util	5 years ago
Daniel Supernault	0e13ab074c	Update SnowflakeService	5 years ago
Daniel Supernault	c55f14764f	Update SnowflakeTest, fixes #2661	6 years ago
Daniel Supernault	2598520bbe	Update tests	6 years ago
Daniel Supernault	044ad6450f	Update tests, fix namespace	6 years ago
Daniel Supernault	5c5931200b	Add AP LikeTest	6 years ago
Daniel Supernault	802dd326ce	Update AP tests	6 years ago
Daniel Supernault	5f73b08fd3	Remove CostarTest	7 years ago
Daniel Supernault	f911c96d16	Update lexer autolinker and extractor, add support for mentioned usernames containing dashes, periods and underscore characters	7 years ago
Daniel Supernault	84fba79f0e	Add new tests	7 years ago
Daniel Supernault	59340dee69	Add FollowTest	7 years ago
Daniel Supernault	43073bd226	Add AcceptVerbTest	7 years ago
Daniel Supernault	4227af1288	Add UndoFollowTest	7 years ago
Daniel Supernault	46a498d7a9	Update StatusLexerTest	7 years ago
Daniel Supernault	52b5eab9b7	Update Autolinker test	7 years ago
Daniel Supernault	78ccec53e0	Update StatusLexerTest	7 years ago
Daniel Supernault	a9072b3ad7	Add unit test	8 years ago
Daniel Supernault	4e14cabe70	Update html purifier config	8 years ago
Daniel Supernault	79da0692b4	Update Test	8 years ago
Daniel Supernault	847e7b7fa4	Add PurifierTest	8 years ago
Daniel Supernault	04a2c93096	Add CostarTest	8 years ago
Daniel Supernault	0c654f5e43	Update tests	8 years ago
Daniel Supernault	54d3879872	Remove old httpsig tests	8 years ago