mastodon

Commit Graph

Author	SHA1	Message	Date
Claire	2ec1181ee5	Fix contrast between background and form elements on some pages (#31266 )	5 months ago
Matt Jankowski	17ea22671d	Fix `Style/GuardClause` cop in app/controllers (#28420 )	11 months ago
Claire	379115e601	Add SELF_DESTRUCT env variable to process self-destructions in the background (#26439 )	1 year ago
Francis Murillo	5fb1c3e934	Revoke all authorized applications on password reset (#21325 ) * Clear sessions on password change * Rename User::clear_sessions to revoke_access for a clearer meaning * Add reset paassword controller test * Use User.find instead of User.find_for_authentication for reset password test * Use redirect and render for better test meaning in reset password Co-authored-by: Effy Elden <effy@effy.space>	2 years ago
Claire	6da135a493	Fix reviving revoked sessions and invalidating login (#16943 ) Up until now, we have used Devise's Rememberable mechanism to re-log users after the end of their browser sessions. This mechanism relies on a signed cookie containing a token. That token was stored on the user's record, meaning it was shared across all logged in browsers, meaning truly revoking a browser's ability to auto-log-in involves revoking the token itself, and revoking access from all logged-in browsers. We had a session mechanism that dynamically checks whether a user's session has been disabled, and would log out the user if so. However, this would only clear a session being actively used, and a new one could be respawned with the `remember_user_token` cookie. In practice, this caused two issues: - sessions could be revived after being closed from /auth/edit (security issue) - auto-log-in would be disabled for all browsers after logging out from one of them This PR removes the `remember_token` mechanism and treats the `_session_id` cookie/token as a browser-specific `remember_token`, fixing both issues.	3 years ago
Eugen Rochko	844870273f	Fix other sessions not being logged out on password change (#14252 ) While OAuth tokens were immediately revoked, accessing the home controller immediately generated new OAuth tokens and "revived" the session due to a combination of using remember_me tokens and overwriting the `authenticate_user!` method	5 years ago
Eugen Rochko	daf71573d0	Fix password change/reset not immediately invalidating other sessions (#12928 ) While making browser requests in the other sessions after a password change or reset does not allow you to be logged in and correctly invalidates the session making the request, sessions have API tokens associated with them, which can still be used until that session is invalidated. This is a security issue for accounts that were already compromised some other way because it makes it harder to throw out the hijacker.	5 years ago
Eugen Rochko	60df87f6f0	Compensate for scrollbar disappearing when media modal visible (#8100 ) * Compensate for scrollbar disappearing when media modal visible Make auth pages backgrounds lighter * Fix typo	7 years ago
nullkal	dfcd2834f9	Redirect to PasswordController#new when reset_password_token is invalid (#4506 )	8 years ago
Eugen Rochko	fdc17bea58	Fix rubocop issues, introduce usage of frozen literal to improve performance	8 years ago
Eugen Rochko	43bb8a25e7	Remember user logins by default	9 years ago
Eugen Rochko	6045b6cb18	Customizing devise views and controllers	9 years ago

12 Commits (i18n/crowdin/translations)