mastodon

Commit Graph

Author	SHA1	Message	Date
Claire	86807e4799	Improve email address validation (#29838 )	10 months ago
Claire	0b0c7af2c1	Merge pull request from GHSA-7w3c-p9j8-mq3x * Ensure destruction of OAuth Applications notifies streaming Due to doorkeeper using a dependent: delete_all relationship, the destroy of an OAuth Application bypassed the existing AccessTokenExtension callbacks for announcing destructing of access tokens. * Ensure password resets revoke access to Streaming API * Improve performance of deleting OAuth tokens --------- Co-authored-by: Emelia Smith <ThisIsMissEm@users.noreply.github.com>	1 year ago
Eugen Rochko	4d96d716c4	Fix unsupported time zone or locale preventing sign-up (#28035 ) Co-authored-by: Claire <claire.github-309c@sitedethib.com>	1 year ago
Matt Jankowski	cf33028f35	Admin mailer parameterization (#25759 )	2 years ago
Eugen Rochko	4c9406bdb0	Add time zone preference (#25342 )	2 years ago
Matt Jankowski	d902a707a3	Fix Rails/CompactBlank cop (#24690 )	2 years ago
Eugen Rochko	a9b5598c97	Change user settings to be stored in a more optimal way (#23630 ) Co-authored-by: Claire <claire.github-309c@sitedethib.com>	2 years ago
Claire	86f8aa2db2	Fix unconfirmed accounts being registered as active users (#23803 )	2 years ago
Nick Schonning	717683d1c3	Autofix Rubocop remaining Layout rules (#23679 )	2 years ago
Nick Schonning	f68bb52556	Apply Rubocop Style/NegatedIfElseCondition (#23451 )	2 years ago
Claire	6883fddb19	Fix account activation being triggered before email confirmation (#23245 ) * Add tests * Fix account activation being triggered before email confirmation Fixes #23098	2 years ago
Alexander Ivanov	8eb29741b4	Add webhook `account.approved` (#22938 ) * Webhook `account.approved` when preparing new user * Update Webhook.EVENTS	2 years ago
Francis Murillo	5fb1c3e934	Revoke all authorized applications on password reset (#21325 ) * Clear sessions on password change * Rename User::clear_sessions to revoke_access for a clearer meaning * Add reset paassword controller test * Use User.find instead of User.find_for_authentication for reset password test * Use redirect and render for better test meaning in reset password Co-authored-by: Effy Elden <effy@effy.space>	2 years ago
Claire	ed07f10ca8	Fix failure when “Require a reason to join” is set with open registrations (#22127 )	2 years ago
Claire	00b2720ef0	Change automatic post deletion configuration to be accessible to redirected users (#20774 ) Fixes #20550	2 years ago
Eugen Rochko	839f893168	Change public accounts pages to mount the web UI (#19319 ) * Change public accounts pages to mount the web UI * Fix handling of remote usernames in routes - When logged in, serve web app - When logged out, redirect to permalink - Fix `app-body` class not being set sometimes due to name conflict * Fix missing `multiColumn` prop * Fix failing test * Use `discoverable` attribute to control indexing directives * Fix `<ColumnLoading />` not using `multiColumn` * Add `noindex` to accounts in REST API * Change noindex directive to not be rendered by default before a route is mounted * Add loading indicator for detailed status in web UI * Fix missing indicator appearing while account is loading in web UI	2 years ago
Eugen Rochko	0d0f3c15d3	Fix language dropdown sometimes not appearing in web UI (#19246 ) When user has no locale preference saved (such as never changing it from the default), the preferred posting language is nil, and the dropdown is not visible	2 years ago
Eugen Rochko	0b3e4fd5de	Remove digest e-mails (#17985 ) * Remove digest e-mails * Remove digest-related code	3 years ago
Eugen Rochko	0396acf39e	Add audit log entries for user roles (#19040 ) * Refactor audit log schema * Add audit log entries for user roles	3 years ago
Claire	03241d884e	Add option for EMAIL_DOMAIN_DENYLIST/EMAIL_DOMAIN_ALLOWLIST to apply after confirmation (#18642 ) Fixes #18620	3 years ago
Eugen Rochko	44b2ee3485	Add customizable user roles (#18641 ) * Add customizable user roles * Various fixes and improvements * Add migration for old settings and fix tootctl role management	3 years ago
Eugen Rochko	a2871cd747	Add administrative webhooks (#18510 ) * Add administrative webhooks * Fix error when webhook is deleted before delivery worker runs	3 years ago
Claire	e34dd3644c	Remove unused `filtered_languages` column (#18533 ) * Remove unused `filtered_languages` column Fixes #18522 * Fix tests	3 years ago
Eugen Rochko	6c699b1723	Fix preferred posting language returning unusable value in REST API (#18428 )	3 years ago
Eugen Rochko	3917353645	Fix single Redis connection being used across all threads (#18135 ) * Fix single Redis connection being used across all Sidekiq threads * Fix tests	3 years ago
Eugen Rochko	8e20e16cf0	Change e-mail notifications to only be sent when recipient is offline (#17984 ) * Change e-mail notifications to only be sent when recipient is offline Change the default for follow and mention notifications back on * Add preference to always send e-mail notifications * Change wording	3 years ago
Eugen Rochko	6221b36b27	Remove sign-in token authentication, instead send e-mail about new sign-in (#17970 )	3 years ago
Eugen Rochko	5554ff2a1d	Fix being able to bypass e-mail restrictions (#17909 )	3 years ago
Eugen Rochko	2dd30804b6	Change how unconfirmed accounts are displayed in admin UI (#17874 ) Fix #17815	3 years ago
Eugen Rochko	edf09ec747	Add `/api/v1/accounts/familiar_followers` to REST API (#17700 ) * Add `/api/v1/accounts/familiar_followers` to REST API * Change hide network preference to be stored consistently for local and remote accounts * Add dummy classes to migration * Apply suggestions from code review Co-authored-by: Claire <claire.github-309c@sitedethib.com> Co-authored-by: Claire <claire.github-309c@sitedethib.com>	3 years ago
Eugen Rochko	27965ce5ed	Add trending statuses (#17431 ) * Add trending statuses * Fix dangling items with stale scores in localized sets * Various fixes and improvements - Change approve_all/reject_all to approve_accounts/reject_accounts - Change Trends::Query methods to not mutate the original query - Change Trends::Query#skip to offset - Change follow recommendations to be refreshed in a transaction * Add tests for trending statuses filtering behaviour * Fix not applying filtering scope in controller	3 years ago
Eugen Rochko	564efd0651	Add appeals (#17364 ) * Add appeals * Add ability to reject appeals and ability to browse pending appeals in admin UI * Add strikes to account page in settings * Various fixes and improvements - Add separate notification setting for appeals, separate from reports - Fix style of links in report/strike header - Change approving an appeal to not restore statuses (due to federation complexities) - Change style of successfully appealed strikes on account settings page - Change account settings page to only show unappealed or recently appealed strikes * Change appealed_at to overruled_at * Fix missing method error	3 years ago
Eugen Rochko	6240466866	Fix duplicate accounts when searching by IP range in admin UI (#17524 )	3 years ago
Eugen Rochko	b6d7726ecb	Remove language detection through cld3 (#17478 ) * Remove language detection through cld3 * Update app/helpers/languages_helper.rb Co-authored-by: Yamagishi Kazutoshi <ykzts@desire.sh> Co-authored-by: Yamagishi Kazutoshi <ykzts@desire.sh>	3 years ago
Claire	987d88ea56	Fix requiring an extra restart after recent post-deployment migrations (#17422 ) Follow-up to #16409	3 years ago
Claire	8a07ecd377	Remove leftover database columns from Devise::Models::Rememberable (#17191 ) * Remove leftover database columns from Devise::Models::Rememberable * Update fix-duplication maintenance script * Improve errors/warnings in the fix-duplicates maintenance script	3 years ago
Eugen Rochko	8e84ebf0cb	Remove IP tracking columns from users table (#16409 )	3 years ago
Jeong Arm	720e8ab0f5	Fix duplicate record on admin/accounts when searching with IP (#17150 )	3 years ago
Claire	6da135a493	Fix reviving revoked sessions and invalidating login (#16943 ) Up until now, we have used Devise's Rememberable mechanism to re-log users after the end of their browser sessions. This mechanism relies on a signed cookie containing a token. That token was stored on the user's record, meaning it was shared across all logged in browsers, meaning truly revoking a browser's ability to auto-log-in involves revoking the token itself, and revoking access from all logged-in browsers. We had a session mechanism that dynamically checks whether a user's session has been disabled, and would log out the user if so. However, this would only clear a session being actively used, and a new one could be respawned with the `remember_user_token` cookie. In practice, this caused two issues: - sessions could be revived after being closed from /auth/edit (security issue) - auto-log-in would be disabled for all browsers after logging out from one of them This PR removes the `remember_token` mechanism and treats the `_session_id` cookie/token as a browser-specific `remember_token`, fixing both issues.	3 years ago
Eugen Rochko	771c9d4ba8	Add ability to skip sign-in token authentication for specific users (#16427 ) Remove "active within last two weeks" exception for sign in token requirement Change admin reset password to lock access until the password is reset	4 years ago
Claire	566fc90913	Add Ruby 3.0 support (#16046 ) * Fix issues with POSIX::Spawn, Terrapin and Ruby 3.0 Also improve the Terrapin monkey-patch for the stderr/stdout issue. * Fix keyword argument handling throughout the codebase * Monkey-patch Paperclip to fix keyword arguments handling in validators * Change validation_extensions to please CodeClimate * Bump microformats from 4.2.1 to 4.3.1 * Allow Ruby 3.0 * Add Ruby 3.0 test target to CircleCI * Add test for admin dashboard warnings * Fix admin dashboard warnings on Ruby 3.0	4 years ago
Eugen Rochko	fab65848d2	Fix empty home feed before first follow has finished processing (#16152 ) Change queue of merge worker from pull to default	4 years ago
Eugen Rochko	af8fe6e1e9	WIP (#15222 )	4 years ago
ThibG	e955ca5463	Fix sign-up restrictions based on IP addresses not being enforced (#15607 ) Fixes #15606 Co-authored-by: Claire <claire.github-309c@sitedethib.com>	4 years ago
ThibG	1cf2c3a810	Fix external user creation failing when invite request text is required (#15405 ) * Fix external user creation failing when invite request text is required Also fixes tootctl-based user creation. * Add test about invites when invite request text is otherwise required Co-authored-by: Claire <claire.github-309c@sitedethib.com>	4 years ago
ThibG	6f51fd7435	Fix invitation links not working when invite request text is required (#15385 ) Fixes #15383 Co-authored-by: Claire <claire.github-309c@sitedethib.com>	4 years ago
ThibG	47e507fa61	Add ability to require invite request text (#15326 ) Fixes #15273 Co-authored-by: Claire <claire.github-309c@sitedethib.com>	4 years ago
ThibG	49eb4d4ddf	Add honeypot fields and minimum fill-out time for sign-up form (#15276 ) * Add honeypot fields to limit non-specialized spam Add two honeypot fields: a fake website input and a fake password confirmation one. The label/placeholder/aria-label tells not to fill them, and they are hidden in CSS, so legitimate users should not fall into these. This should cut down on some non-Mastodon-specific spambots. * Require a 3 seconds delay before submitting the registration form * Fix tests * Move registration form time check to model validation * Give people a chance to clear the honeypot fields * Refactor honeypot translation strings Co-authored-by: Claire <claire.github-309c@sitedethib.com>	4 years ago
Eugen Rochko	8532429af7	Fix 2FA/sign-in token sessions being valid after password change (#14802 ) If someone tries logging in to an account and is prompted for a 2FA code or sign-in token, even if the account's password or e-mail is updated in the meantime, the session will show the prompt and allow the login process to complete with a valid 2FA code or sign-in token	4 years ago
Eugen Rochko	5e1364c448	Add IP-based rules (#14963 )	4 years ago

1 2 3 4

194 Commits (0e8f23ebeeb4cea2d11a92d737adca337645144a)