Write Freely

Recent Commits

• Matt Baer(28 Aug 26)

  Merge pull request #1731 from writefreely/improve-missing-dir-errors Output more helpful error messages at startup

• Matt Baer(28 Aug 26)

  Merge pull request #1748 from writefreely/fix-signup-paths Enforce signup checks consistently across all registration paths

• Matt Baer(28 Aug 26)

  Merge pull request #1736 from writefreely/fix-robots-txt Support serving robots.txt on single-user instances

• Matt Baer(26 Aug 26)

  Merge commit from fork Prevent access to private / password-protected blogs via ActivityPub

• Matt Baer(21 Aug 26)

  Prevent access to private / password-protected blogs via ActivityPub This fixes GHSA-cx5r-gg25-76ph

• Matt Baer(20 Aug 26)

  Merge pull request #1738 from c7io-dev/fix-customize-username-shadow Fix shadowed .Username on collection customize page

• Matt Baer(20 Aug 26)

  Enforce signup checks consistently across all registration paths Previously, registration eligibility (closed registration, invite validity, and password-auth availability) was checked inconsistently depending on the endpoint, including /api/auth/signup, /oauth/signup, and instances with password auth disabled. Funnels all paths (web, API, OAuth) through a single canRegister() gate so the checks can't be bypassed by picking a different endpoint, and includes the invite code in the OAuth signature. Extends the invite validation from #1724 to the API and OAuth paths it didn't cover. Also adds regression tests covering each path.

• Matt Baer(20 Aug 26)

  Merge commit from fork Prevent SSRF via ActivityPub inbox actor/object IRI resolution

• Matt Baer(20 Aug 26)

  Merge commit from fork Block SSRF in webfinger RemoteLookup

• Matt Baer(20 Aug 26)

  Merge pull request #1730 from writefreely/fix-uppercase-usernames Normalize usernames on signups via OAuth

• Matt Baer(19 Aug 26)

  Merge pull request #1727 from writefreely/fix-password-protected Fix password-protected blogs not unlocking after cookie expires

• Matt Baer(15 Aug 26)

  Merge pull request #1729 from writefreely/fedi-image-description Include image alt text in fediverse attachment data

• sNullp(12 Aug 26)

  Fix shadowed .Username on collection customize page EmailCfg.Username shadows the promoted StaticPage.Username in the customize struct, so the "blog uses your username in its URL" note never rendered. Use .UserPage.Username. Co-Authored-By: Claude Opus 4.8 <[email protected]>

• Matt Baer(11 Aug 26)

  Support serving robots.txt on single-user instances Fixes #1427

• Matt Baer(11 Aug 26)

  Output friendly error when templates directories not found Fixes #757

• Matt Baer(11 Aug 26)

  Output friendly error when keys haven't been found

• Matt Baer(11 Aug 26)

  Output friendly error when no configuration file

• Matt Baer(11 Aug 26)

  On startup, log notification of migrations needed

• Matt Baer(11 Aug 26)

  Merge pull request #1712 from writefreely/dependabot/github_actions/docker/login-action-4.6.0 Bump docker/login-action from 4.3.0 to 4.6.0

• Matt Baer(11 Aug 26)

  Merge pull request #1714 from writefreely/dependabot/go_modules/github.com/writeas/web-core-1.8.0 Bump github.com/writeas/web-core from 1.7.0 to 1.8.0

• Matt Baer(11 Aug 26)

  Add tests for normalizing usernames via OAuth

• Matt Baer(11 Aug 26)

  Normalize usernames for signups through OAuth This ensures, for example, new users don't get created with uppercase usernames that later cause issues when we automatically redirect to lowercase equivalents, resulting in 404s. It also adds an `author.IsValidUsername` check when registering via OAuth. **Note**: this does _not_ automatically fix current users who might've ended up with a faulty username. This fixes #648 #844

• Matt Baer(11 Aug 26)

  Add tests for Markdown alt text extraction

• Matt Baer(11 Aug 26)

  Include image alt text in fediverse attachment data This parses out any alt text found in Markdown images included in a post, and adds the text as the image attachment's `name` property, so it shows up across the fediverse, as well. Fixes #698

• Matt Baer(10 Aug 26)

  Fix password-protected blogs not unlocking after cookie expires Previously, we would only set a new cookie to replace the older, expired one if there was absolutely no error. Instead, we now safely ignore any errors and attempt to re-set the cookie, which should fix this. Fixes #298

• Matt Baer(10 Aug 26)

  Revert webfinger changes The SSRF fix is already handled more robustly in other pending changes.

• Matt Baer(10 Aug 26)

  Prevent SSRF via ActivityPub inbox actor/object IRI resolution resolveIRI() fetched attacker-controlled actor/object IRIs from the unauthenticated federation inbox endpoint with no restriction on the destination host, allowing internal network/cloud metadata access (e.g. 169.254.169.254). Add isPublicIRI() to reject loopback, private, link-local, and unspecified addresses, and apply it in resolveIRI() (covering both the actor IRI and the response-controlled PublicKey.Owner follow-up fetch) and in webfinger.go's RemoteLookup(). Fixes GHSA-7635-vx4w-qww7.

• Matt Baer(10 Aug 26)

  Block SSRF in webfinger RemoteLookup RemoteLookup() built a URL straight from the domain part of an attacker-controlled handle and fetched it, letting a crafted handle (e.g. [email protected]) make the server issue requests to private IPs, loopback, link-local, and cloud metadata endpoints. Requests now go through a hardened client that validates the actually-resolved IP at dial time (so DNS rebinding can't bypass it), applied to redirects too, and rejects malformed handles up front. This fixes GHSA-wvrr-gx9p-xvxm

• Matt Baer(10 Aug 26)

  Merge commit from fork Ensure users can only un/pin a post that belongs to a collection they own

• Matt Baer(10 Aug 26)

  Merge commit from fork Always sanitize slugs on post creation