2026-11-03 11:00 UTC
@coltofox@red.fox.yt Yes, add your instance domains to this .env variable like this
`PF_SECURITY_URL_TRUSTED_DOMAINS="instance.example,other.server"`
Replies (1)
-
@coltofox@red.fox.yt 2026-11-03 11:22
@dansup@mastodon.social Tried adding the .env variable but it didn't seem to have any effect. I tried looking through the code, I think this was the commit that blocked the private IPs: https://github.com/pixelfed/pixelfed/commit/0e0de62dd9767f8da8a76fa0ff4e5e2be5981744 Am assuming it's related to the SSRF mentioned in CVE-2026-71246. It looks like there is a boolean env variable for "AP_SKIP_LOCAL_URL_CHECKS". Not sure if that will do something.