0159a6dbe9
Search calls are generally expensive and allow unauthenticated users to crawl the instance for user profiles or posts which contain specified keywords. An adversary can build a distributed search engine which not only will consume significant instance resources, but also can be used for undesirable purposes such as datamining. Accordingly, require authenticated access to use the search API endpoints. This acts as a nice balance as it allows guest users to make use of most functionality available in Pleroma FE while ensuring that Pleroma instances are reasonably protected from resource exhaustion. It also removes Pleroma as a potential vector in distributed search engines. |
||
|---|---|---|
| .. | ||
| mix/tasks | ||
| pleroma | ||
| healthcheck.ex | ||
| jason_types.ex | ||
| transports.ex | ||
| xml_builder.ex | ||