Conversation

Notices

1.  (mint@ryona.agency)'s status on Saturday, 05-Aug-2023 01:36:15 JST 
   Some SPC oldfag tranny wanted a way to upload his pride flag emchichos without touching terminal gorillion years ago. Fast forward to today, another hysteria started because back then people didn't know to sanitize filenames, and this time even without any fun like defaced frontends or leaked DMs. Awaiting for someone to ragequit and close their instance down as usual.
   • pantherastare (pantherastare@lab.nyanide.com)'s status on Saturday, 05-Aug-2023 02:00:45 JST pantherastare

     in reply to
     @mint uploads on fedi are a lot like whores on the frontier
      likes this.
   • :apa: スプリットショックウイルス † (splitshockvirus@mstdn.starnix.network)'s status on Saturday, 05-Aug-2023 02:01:31 JST :apa: スプリットショックウイルス †

     in reply to

     @mint That import shit never fucking worked, pleroma's emoji system sucks.

      likes this.
   •  (mint@ryona.agency)'s status on Saturday, 05-Aug-2023 02:03:45 JST 

     in reply to

     • meso
     @meso You have filename anonymization/deduplication enabled, so it's safe for you right now. I assume the way it works is as follows:
     1. You register on a target instance and upload a file named pack.json and structured exactly like regular emoji pack metadata, except with files leading to, say, ../../../../etc/passwd.
     2. You then access the endpoint of the same instance that generates the archive out of emoji pack (don't know which, haven't looked for it yet, no idea how and why the fuck does it accept arbitrary json files instead of pack names that are already on instance).
     3. Wa la, you now have a specific file from the machive Pleroma is on, packed pu nicely in an archive.
   • meso (meso@the.asbestos.cafe)'s status on Saturday, 05-Aug-2023 02:03:46 JST meso

     in reply to
     @mint so whats the deal with this new update will i get haxored for existing or do i have to steal le emoji name
   • :ihavenomouth: (inginsub@clubcyberia.co)'s status on Saturday, 05-Aug-2023 02:08:45 JST :ihavenomouth:

     in reply to

     • meso
     @mint @meso filenamecels BTFOd again?
      likes this.
   •  (mint@ryona.agency)'s status on Saturday, 05-Aug-2023 02:09:22 JST 

     in reply to

     • :ihavenomouth:
     • meso
     @Inginsub @meso TDFNTD