Conversation

Notices

1.  (mint@ryona.agency)'s status on Thursday, 02-Mar-2023 17:55:26 JST 
   bitch
   Husky_1677747305158_7DV9YHXIJ9.…
   •  (mint@ryona.agency)'s status on Thursday, 02-Mar-2023 18:08:15 JST 

     in reply to

     • bot :kiwi_dumbbell:
     @bot Critical security changes in pleromer that I can't quickly merge through ssh on my phone due to the fact those fags updated mix.exs/lock and bundled frontend as well.
   • bot :kiwi_dumbbell: (bot@seal.cafe)'s status on Thursday, 02-Mar-2023 18:08:16 JST bot :kiwi_dumbbell:

     in reply to
     What happened?
   •  (mint@ryona.agency)'s status on Thursday, 02-Mar-2023 18:11:46 JST 

     in reply to

     • bot :kiwi_dumbbell:
     • <script> alert("sogg"); </script>
     @pedophilesoftwareinc @bot I have no fucking idea how this shit went unnoticed for six years. At least it shouldn't be able to escape from /var/lib/pleroma due to the user/group permissions.
   • <script> alert("sogg"); </script> (pedophilesoftwareinc@cum.salon)'s status on Thursday, 02-Mar-2023 18:11:47 JST <script> alert("sogg"); </script>

     in reply to

     • bot :kiwi_dumbbell:
     @mint @bot LOL
   • 🌲Number 1 Pleroma Criminal on XBL 🇵🇱|🇺🇸 (phenomx6@fedi.pawlicker.com)'s status on Thursday, 02-Mar-2023 18:16:01 JST 🌲Number 1 Pleroma Criminal on XBL 🇵🇱|🇺🇸

     in reply to

     • bot :kiwi_dumbbell:
     • <script> alert("sogg"); </script>
     they were too busy finding out how to ban Alex Gleason from the project than they were fixing their shit
      likes this.
   •  (mint@ryona.agency)'s status on Thursday, 02-Mar-2023 18:41:08 JST 

     in reply to

     • 🌲Number 1 Pleroma Criminal on XBL 🇵🇱|🇺🇸
     • bot :kiwi_dumbbell:
     • <script> alert("sogg"); </script>
     @PhenomX6 @pedophilesoftwareinc @bot To be fair, it isn't fixed in soybox yet.
     https://gitlab.com/soapbox-pub/rebased/-/blob/develop/lib/pleroma/web/activity_pub/activity_pub.ex#L1541
     🌲Number 1 Pleroma Criminal on XBL 🇵🇱|🇺🇸 likes this.
   • ew (e@masochi.st)'s status on Thursday, 02-Mar-2023 18:48:47 JST ew

     in reply to

     • bot :kiwi_dumbbell:
     • <script> alert("sogg"); </script>
     @mint @pedophilesoftwareinc @bot close registrations immediately
   •  (mint@ryona.agency)'s status on Thursday, 02-Mar-2023 18:48:47 JST 

     in reply to

     • bot :kiwi_dumbbell:
     • ew
     • <script> alert("sogg"); </script>
     @e @pedophilesoftwareinc @bot Just came back home and updated it.
   •  (mint@ryona.agency)'s status on Thursday, 02-Mar-2023 18:58:24 JST 

     in reply to

     • pomstan
     • bot :kiwi_dumbbell:
     • <script> alert("sogg"); </script>
     @pomstan @pedophilesoftwareinc @bot No screening for ../ paths in uploader, apparently. Still not sure how it can be exploited since pleromer saves images with their hash instead of filename by default.
   • pomstan (pomstan@xn--p1abe3d.xn--80asehdb)'s status on Thursday, 02-Mar-2023 18:58:26 JST pomstan

     in reply to

     • bot :kiwi_dumbbell:
     • <script> alert("sogg"); </script>

     @mint @pedophilesoftwareinc @bot what’s the exact issue

   •  (mint@ryona.agency)'s status on Thursday, 02-Mar-2023 18:58:45 JST 

     in reply to

     • pomstan
     • bot :kiwi_dumbbell:
     • <script> alert("sogg"); </script>
     @pomstan @bot @pedophilesoftwareinc Apparently, Pleb managed to exploit in on poast and got IP banned.
   • <script> alert("sogg"); </script> (pedophilesoftwareinc@cum.salon)'s status on Thursday, 02-Mar-2023 19:00:32 JST <script> alert("sogg"); </script>

     in reply to

     • pomstan
     • bot :kiwi_dumbbell:
     @mint @bot @pomstan no, it was for this
      likes this.
   •  (mint@ryona.agency)'s status on Thursday, 02-Mar-2023 19:01:52 JST 

     in reply to

     • pomstan
     • bot :kiwi_dumbbell:
     • <script> alert("sogg"); </script>
     @pedophilesoftwareinc @bot @pomstan Ah, okay. The timing between posts was too good to not speculate on that.
   •  (mint@ryona.agency)'s status on Thursday, 02-Mar-2023 19:02:29 JST 

     in reply to

     • big dog
     @dc That's because I've replaced the frontend bundle with mine. Nothing critical, it's just something I'm not willing to fix over SSH from my phone.
   • big dog (dc@pl.starnix.network)'s status on Thursday, 02-Mar-2023 19:02:30 JST big dog

     in reply to
     @mint you were not able to just git check out? i need to update my server to so i want to make sure
   • meso (meso@asbestos.cafe)'s status on Thursday, 02-Mar-2023 19:04:19 JST meso

     in reply to

     • pomstan
     • bot :kiwi_dumbbell:
     • <script> alert("sogg"); </script>
     @pedophilesoftwareinc @mint @bot @pomstan did :blackoma: fix it (>it didnt)
      likes this.
   • <script> alert("sogg"); </script> (pedophilesoftwareinc@cum.salon)'s status on Thursday, 02-Mar-2023 19:04:20 JST <script> alert("sogg"); </script>

     in reply to

     • pomstan
     • bot :kiwi_dumbbell:
     • meso
     @meso @mint @bot @pomstan 2.5.1 pleroma update
     
     relative file names, might be a non issue, but god knows
   • meso (meso@asbestos.cafe)'s status on Thursday, 02-Mar-2023 19:04:21 JST meso

     in reply to

     • pomstan
     • bot :kiwi_dumbbell:
     • <script> alert("sogg"); </script>
     @mint @pedophilesoftwareinc @bot @pomstan wait what's the issue how to fix it
   • <script> alert("sogg"); </script> (pedophilesoftwareinc@cum.salon)'s status on Thursday, 02-Mar-2023 19:04:44 JST <script> alert("sogg"); </script>

     in reply to

     • pomstan
     • bot :kiwi_dumbbell:
     • meso
     @meso @mint @bot @pomstan nope, not patched
     https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/pleroma/web/activity_pub/activity_pub.ex#L1505
      likes this.
   • pomstan (pomstan@xn--p1abe3d.xn--80asehdb)'s status on Thursday, 02-Mar-2023 19:13:30 JST pomstan

     in reply to

     • bot :kiwi_dumbbell:
     • <script> alert("sogg"); </script>

     @mint @pedophilesoftwareinc @bot

     No screening for ../ paths in uploader, apparently.

     jesus christ, that’s an exploit right from the 1995 or something, older than most of pleroma users

      likes this.