Commit Graph

1832 Commits (0e8f23ebeeb4cea2d11a92d737adca337645144a)

Author SHA1 Message Date
Claire d675803f07
Fix broken notifications for mentions from local moderators in 4.2.11 (#31484) 6 months ago
Jeong Arm 8fe1cefe4c Handle featured collections without items (#27581) 7 months ago
Claire 297ad9aeb8 Fix already-invalid reports failing to resolve (#29027) 7 months ago
Adam Niedzielski 7b7d404efe Fix ß bug in regexp for mentions and tags (#31122) 7 months ago
Claire 0fc738a323 Fix hashtag matching pattern matching some link anchors (#30190) 7 months ago
Claire 13bab94265 Fix duplicate `orderedItems` in user archive's `outbox.json` (#31099) 7 months ago
Adam Niedzielski 161aa0f8f6 Select correct self link when parsing Webfinger response (#31110) 7 months ago
Claire 4fb4721072
Merge pull request from GHSA-58x8-3qxw-6hm7
* Fix insufficient permission checking for public timeline endpoints

Note that this changes unauthenticated access failure code from 401 to 422

* Add more tests for public timelines

* Require user token in `/api/v1/statuses/:id/translate` and `/api/v1/scheduled_statuses`
8 months ago
Claire df974a912b
Merge pull request from GHSA-vp5r-5pgw-jwqx
* Fix streaming sessions not being closed when revoking access to an app

* Add tests for GHSA-7w3c-p9j8-mq3x
8 months ago
Claire 6cd9bd6ae1 fix: Return HTTP 422 when scheduled status time is less than 5 minutes (#30584) 8 months ago
David Roetzel 9b6219c48f Improve encoding detection for link cards (#30780) 8 months ago
David Roetzel 846f59c6e9 Add size limit for link preview URLs (#30854) 8 months ago
Claire fcae9435ec Fix `/admin/accounts/:account_id/statuses/:id` for edited posts with media attachments (#30819) 8 months ago
Claire 19ed22dc58 Fix duplicate `@context` attribute in user export (#30653) 9 months ago
Claire 7920aa59e8
Merge pull request from GHSA-q3rg-xx5v-4mxh 9 months ago
Claire 943792c187
Merge pull request from GHSA-5fq7-3p3j-9vrf 9 months ago
Emelia Smith 186f916192 Fix: remove broken OAuth Application vacuuming & throttle OAuth Application registrations (#30316)
Co-authored-by: Claire <claire.github-309c@sitedethib.com>
9 months ago
Claire f9c41ae43b Normalize language code of incoming posts (#30403) 9 months ago
Claire 56b7d1a7b6 Fix not being able to block a subdomain of an already-blocked domain through the API (#30119) 10 months ago
Claire 51ef619140 Fix Idempotency-Key ignored when scheduling a post (#30084) 10 months ago
Claire c3be5a3d2e Remove caching in `cache_collection` (#29862) 10 months ago
Claire 86807e4799 Improve email address validation (#29838) 10 months ago
Matt Jankowski 0143c9d3e1 Fix results/query in `api/v1/featured_tags/suggestions` (#29597) 10 months ago
Jeong Arm ab3f9852f2 Normalize idna domain before account unblock domain (#29530) 10 months ago
Emelia Smith f784213c64 Return domain block digests from admin domain blocks API (#29092) 10 months ago
Claire f3ad918950
Fix processing of `Link` objects in `Image` objects (#29363) 1 year ago
Claire 9a7802655f
Fix link verifications when page size exceeds 1MB (#29361) 1 year ago
Claire 328a9b8157
Change registrations to be disabled by default for new servers (#29353) 1 year ago
Claire 28b666b0d5
Automatically switch from open to approved registrations in absence of moderators (#29337) 1 year ago
Claire 15de520201
Merge pull request from GHSA-jhrq-qvrm-qr36
* Fix insufficient Content-Type checking of fetched ActivityStreams objects

* Allow JSON-LD documents with multiple profiles
1 year ago
Claire 870ee80fd3 Fix user creation failure handling in OAuth paths (#29207) 1 year ago
Claire 76a37bd040 Fix OmniAuth tests (#29201) 1 year ago
Claire f1700523f1
Merge pull request from GHSA-vm39-j3vx-pch3
* Prevent different identities from a same SSO provider from accessing a same account

* Lock auth provider changes behind `ALLOW_UNSAFE_AUTH_PROVIDER_REATTACH=true`

* Rename methods to avoid confusion between OAuth and OmniAuth
1 year ago
Claire 0b0c7af2c1
Merge pull request from GHSA-7w3c-p9j8-mq3x
* Ensure destruction of OAuth Applications notifies streaming

Due to doorkeeper using a dependent: delete_all relationship, the destroy of an OAuth Application bypassed the existing AccessTokenExtension callbacks for announcing destructing of access tokens.

* Ensure password resets revoke access to Streaming API

* Improve performance of deleting OAuth tokens

---------

Co-authored-by: Emelia Smith <ThisIsMissEm@users.noreply.github.com>
1 year ago
Emelia Smith 6d43b63275 Disable administrative doorkeeper routes (#29187) 1 year ago
Claire a6641f828b
Merge pull request from GHSA-3fjr-858r-92rw
* Fix insufficient origin validation

* Bump version to v4.2.5
1 year ago
Claire b377f82b1d Fix processing of compacted single-item JSON-LD collections (#28816) 1 year ago
Claire 6fe2a47357 Add rate-limit of TOTP authentication attempts at controller level (#28801) 1 year ago
Claire 3837ec2227 Fix Mastodon not correctly processing HTTP Signatures with query strings (#28476) 1 year ago
Claire 1998c561b2 Convert signature verification specs to request specs (#28443) 1 year ago
Claire c0a9db3611 Fix potential redirection loop of streaming endpoint (#28665) 1 year ago
Eugen Rochko 4d96d716c4 Fix unsupported time zone or locale preventing sign-up (#28035)
Co-authored-by: Claire <claire.github-309c@sitedethib.com>
1 year ago
MitarashiDango 0a01bc01d2 Fix Undo Announce activity is not sent, when not followed by the reblogged post author (#18482)
Co-authored-by: Claire <claire.github-309c@sitedethib.com>
1 year ago
Claire d7875adad2
Fix call to inefficient `delete_matched` cache method in domain blocks (#28367) 1 year ago
Claire 1076a6cd62 Fix incoming status creation date not being restricted to standard ISO8601 (#27655) 1 year ago
Claire 54a07731d1 Fix posts from threads received out-of-order sometimes not being inserted into timelines (#27653) 1 year ago
Claire e6f4c91c5c Fix hashtag matching pattern matching some URLs (#27584) 1 year ago
Claire c66ade7de8 Fix processing LDSigned activities from actors with unknown public keys (#27474) 1 year ago
Claire bece853e3c Fix error and incorrect URLs in `/api/v1/accounts/:id/featured_tags` for remote accounts (#27459) 1 year ago
Claire 13205b54fd Fix handling of `inLanguage` attribute in preview card processing (#27423) 1 year ago