Merge branch 'security/clear-oauth-with-password' into 'develop'

[akkoma] / config / config.exs

diff --git a/config/config.exs b/config/config.exs
index ed718c3d3cd6f583a8a7d1a55f53a474abf2f5c5..32029699129892006180f436d1b51e7b1ead1961 100644 (file)
--- a/config/config.exs
+++ b/config/config.exs
@@ -74,7 +74,25 @@ config :pleroma, :instance,
   rewrite_policy: Pleroma.Web.ActivityPub.MRF.NoOpPolicy,
   public: true,
   quarantined_instances: [],
-  managed_config: true
+  managed_config: true,
+  allowed_post_formats: [
+    "text/plain",
+    "text/html",
+    "text/markdown"
+  ],
+  mrf_transparency: true
+
+config :pleroma, :markup,
+  # XXX - unfortunately, inline images must be enabled by default right now, because
+  # of custom emoji.  Issue #275 discusses defanging that somehow.
+  allow_inline_images: true,
+  allow_headings: false,
+  allow_tables: false,
+  allow_fonts: false,
+  scrub_policy: [
+    Pleroma.HTML.Transform.MediaProxy,
+    Pleroma.HTML.Scrubber.Default
+  ]
 
 config :pleroma, :fe,
   theme: "pleroma-dark",
@@ -86,15 +104,19 @@ config :pleroma, :fe,
   redirect_root_login: "/main/friends",
   show_instance_panel: true,
   scope_options_enabled: false,
+  formatting_options_enabled: false,
   collapse_message_with_subject: false
 
 config :pleroma, :activitypub,
   accept_blocks: true,
   unfollow_blocked: true,
-  outgoing_blocks: true
+  outgoing_blocks: true,
+  follow_handshake_timeout: 500
 
 config :pleroma, :user, deny_follow_blocked: true
 
+config :pleroma, :mrf_normalize_markup, scrub_policy: Pleroma.HTML.Scrubber.Default
+
 config :pleroma, :mrf_rejectnonpublic,
   allow_followersonly: false,
   allow_direct: false