X-Git-Url: https://git.squeep.com/?a=blobdiff_plain;f=lib%2Fpleroma%2Fweb%2Fendpoint.ex;h=c5f9d51d92d77cc9675d384b842810c98d838a19;hb=4944498133d4a945650201226808b1f09d355014;hp=45a3a345d94b34f1b8cd8fb35f8a0092508d27bb;hpb=5e7ceeba94c179b5ffe98d1bb1115a2e0af196e2;p=akkoma

diff --git a/lib/pleroma/web/endpoint.ex b/lib/pleroma/web/endpoint.ex
index 45a3a345d..c5f9d51d9 100644
--- a/lib/pleroma/web/endpoint.ex
+++ b/lib/pleroma/web/endpoint.ex
@@ -1,45 +1,69 @@
 defmodule Pleroma.Web.Endpoint do
   use Phoenix.Endpoint, otp_app: :pleroma
 
-  socket "/socket", Pleroma.Web.UserSocket
+  socket("/socket", Pleroma.Web.UserSocket)
+
+  socket("/api/v1", Pleroma.Web.MastodonAPI.MastodonSocket)
 
   # Serve at "/" the static files from "priv/static" directory.
   #
   # You should set gzip to true if you are running phoenix.digest
   # when deploying your static files in production.
-  plug Plug.Static,
-    at: "/media", from: "uploads", gzip: false
-  plug Plug.Static,
-    at: "/", from: :pleroma,
-    only: ~w(index.html static)
+  plug(CORSPlug)
+  plug(Pleroma.Plugs.HTTPSecurityPlug)
+
+  plug(Pleroma.Plugs.UploadedMedia)
+
+  plug(
+    Plug.Static,
+    at: "/",
+    from: :pleroma,
+    only:
+      ~w(index.html static finmoji emoji packs sounds images instance sw.js favicon.png schemas)
+  )
 
   # Code reloading can be explicitly enabled under the
   # :code_reloader configuration of your endpoint.
   if code_reloading? do
-    plug Phoenix.CodeReloader
+    plug(Phoenix.CodeReloader)
   end
 
-  plug TrailingFormatPlug
-  plug Plug.RequestId
-  plug Plug.Logger
+  plug(TrailingFormatPlug)
+  plug(Plug.RequestId)
+  plug(Plug.Logger)
 
-  plug Plug.Parsers,
+  plug(
+    Plug.Parsers,
     parsers: [:urlencoded, :multipart, :json],
     pass: ["*/*"],
-    json_decoder: Poison
+    json_decoder: Jason,
+    length: Application.get_env(:pleroma, :instance) |> Keyword.get(:upload_limit),
+    body_reader: {Pleroma.Web.Plugs.DigestPlug, :read_body, []}
+  )
+
+  plug(Plug.MethodOverride)
+  plug(Plug.Head)
 
-  plug Plug.MethodOverride
-  plug Plug.Head
+  cookie_name =
+    if Application.get_env(:pleroma, Pleroma.Web.Endpoint) |> Keyword.get(:secure_cookie_flag),
+      do: "__Host-pleroma_key",
+      else: "pleroma_key"
 
   # The session will be stored in the cookie and signed,
   # this means its contents can be read but not tampered with.
   # Set :encryption_salt if you would also like to encrypt it.
-  plug Plug.Session,
+  plug(
+    Plug.Session,
     store: :cookie,
-    key: "_pleroma_key",
-    signing_salt: "CqaoopA2"
+    key: cookie_name,
+    signing_salt: {Pleroma.Config, :get, [[__MODULE__, :signing_salt], "CqaoopA2"]},
+    http_only: true,
+    secure:
+      Application.get_env(:pleroma, Pleroma.Web.Endpoint) |> Keyword.get(:secure_cookie_flag),
+    extra: "SameSite=Strict"
+  )
 
-  plug Pleroma.Web.Router
+  plug(Pleroma.Web.Router)
 
   @doc """
   Dynamically loads configuration from the system environment