378 Commits (1cad857f14f08370a023e46c24eb81f702bc7e86)

Author	SHA1	Message	Date
Claire	5973d7a4b6	Remove caching in `cache_collection` (#29862)	10 months ago
Claire	ba5551fd1d	Improve email address validation (#29838)	10 months ago
Jeong Arm	3ff575f54c	Normalize idna domain before account unblock domain (#29530)	10 months ago
Claire	3fecb36739	Change registrations to be disabled by default for new servers (#29354)	1 year ago
Claire	6f36b633a7	Merge pull request from GHSA-vm39-j3vx-pch3 ... * Prevent different identities from a same SSO provider from accessing a same account * Lock auth provider changes behind `ALLOW_UNSAFE_AUTH_PROVIDER_REATTACH=true` * Rename methods to avoid confusion between OAuth and OmniAuth	1 year ago
Claire	d807b3960e	Merge pull request from GHSA-7w3c-p9j8-mq3x ... * Ensure destruction of OAuth Applications notifies streaming Due to doorkeeper using a dependent: delete_all relationship, the destroy of an OAuth Application bypassed the existing AccessTokenExtension callbacks for announcing destructing of access tokens. * Ensure password resets revoke access to Streaming API * Improve performance of deleting OAuth tokens --------- Co-authored-by: Emelia Smith <ThisIsMissEm@users.noreply.github.com>	1 year ago
Claire	ab68df9af0	Fix hashtag matching pattern matching some URLs (#27584)	1 year ago
Claire	a89a25714d	Fix some link anchors being recognized as hashtags (#27271)	1 year ago
Matt Jankowski	335982325e	Dont match mention in url query string (#25656) ... Co-authored-by: Claire <claire.github-309c@sitedethib.com>	1 year ago
Claire	f2fff6be66	Fix crash when filtering for “dormant” relationships (#27306)	1 year ago
Emelia Smith	cf80d54cba	Allow reports with long comments from remote instances, but truncate (#25028)	2 years ago
Claire	0aa0b71f2c	Merge pull request from GHSA-9928-3cp5-93fm ... * Fix attachments getting processed despite failing content-type validation * Add a restrictive ImageMagick security policy tailored for Mastodon * Fix misdetection of MP3 files with large cover art * Reject unprocessable audio/video files instead of keeping them unchanged	2 years ago
Claire	7e58779300	Fix reports not being closed when performing batch suspensions (#24988)	2 years ago
Nick Schonning	0592937264	Apply Rubocop Rails/WhereNot (#23448) ... * Apply Rubocop Rails/WhereNot * Update spec for where.not	2 years ago
Nick Schonning	ed570050c6	Autofix Rails/EagerEvaluationLogMessage (#23429) ... * Autofix Rails/EagerEvaluationLogMessage * Update spec for debug block syntax	2 years ago
Claire	6883fddb19	Fix account activation being triggered before email confirmation (#23245) ... * Add tests * Fix account activation being triggered before email confirmation Fixes #23098	2 years ago
Partho Ghosh	115ab2869b	Fix ・ detection in hashtag regex to construct hashtag correctly (#22888) ... * Fix ・ detection in hashtag regex to construct hashtag correctly * Fixed rubocop liniting issues * More rubocop linting fix	2 years ago
Claire	70415714f1	Add follow request banner on account header (#20785) ... * Add requested_by to relationship maps * Display whether an account has requested to follow you on their profile	2 years ago
Jeong Arm	d412147d02	Save avatar or header correctly even if other one fails (#18465) ... * Save avatar or header correctly if other one fails * Fix test	2 years ago
Claire	b59fb28e90	Fix 500 error when trying to migrate to an invalid address (#21462) ... * Fix 500 error when trying to migrate to an invalid address * Add tests	2 years ago
David Leadbeater	69378eac99	Don't allow URLs that contain non-normalized paths to be verified (#20999) ... * Don't allow URLs that contain non-normalized paths to be verified This stops things like https://example.com/otheruser/../realuser where "/otheruser" appears to be the verified URL, but the actual URL being verified is "/realuser" due to the "/../". Also fix a test to use 'https', so it is testing the right thing, now that since #20304 https is required. * missing do	2 years ago
Eugen Rochko	b31afc6294	Fix error when passing unknown filter param in REST API (#20626) ... Fix #19156	2 years ago
Emily Strickland	c2231539c7	Test blank account field verifiability (#20458) ... * Test blank account field verifiability This change tests the need for #20428, which ensures that we guard against a situation in which `at_xpath` returns `nil`. * Test verifiability of blank fields for remote account profiles This adds a counterpart test for remote account profiles' fields' verifiability when those fields are blank. I previously added the same test for local accounts.	2 years ago
Eugen Rochko	9965a23b04	Change link verification to ignore IDN domains (#20295) ... Fix #3833	2 years ago
Eugen Rochko	e98833748e	Fix being able to spoof link verification (#20217) ... - Change verification to happen in `default` queue - Change verification worker to only be queued if there's something to do - Add `link` tags from metadata fields to page header of profiles	2 years ago
luzpaz	6ba52306f9	Fix typos (#19849) ... Found via `codespell -q 3 -S ./yarn.lock,./CHANGELOG.md,./AUTHORS.md,./config/locales,./app/javascript/mastodon/locales -L ba,followings,keypair,medias,pattens,pixelx,rememberable,ro,te`	2 years ago
Roni Laukkarinen	36b0ff57b7	Fix grammar (#20106)	2 years ago
Eugen Rochko	d0ba77047e	Change max. thumbnail dimensions to 640x360px (360p) (#19619)	2 years ago
Eugen Rochko	45ebdb72ca	Add support for language preferences for trending statuses and links (#18288)	2 years ago
Eugen Rochko	9f65909f42	Change public timelines to be filtered by current locale by default (#19291) ... In the absence of an opt-in to multiple specific languages in the preferences, it makes more sense to filter by the user's presumed language only (interface language or `lang` override)	2 years ago
Eugen Rochko	50948b46aa	Add ability to filter followed accounts' posts by language (#19095)	2 years ago
Eugen Rochko	0412a4d03e	Change e-mail domain blocks to match subdomains of blocked domains (#18979)	3 years ago
Eugen Rochko	c3f0621a59	Add ability to follow hashtags (#18809)	3 years ago
Eugen Rochko	e7aa2be828	Change how hashtags are normalized (#18795) ... * Change how hashtags are normalized * Fix tests	3 years ago
Eugen Rochko	44b2ee3485	Add customizable user roles (#18641) ... * Add customizable user roles * Various fixes and improvements * Add migration for old settings and fix tootctl role management	3 years ago
Claire	02851848e9	Revamp post filtering system (#18058) ... * Add model for custom filter keywords * Use CustomFilterKeyword internally Does not change the API * Fix /filters/edit and /filters/new * Add migration tests * Remove whole_word column from custom_filters (covered by custom_filter_keywords) * Redesign /filters Instead of a list, present a card that displays more information and handles multiple keywords per filter. * Redesign /filters/new and /filters/edit to add and remove keywords This adds a new gem dependency: cocoon, as well as a npm dependency: cocoon-js-vanilla. Those are used to easily populate and remove form fields from the user interface when manipulating multiple keyword filters at once. * Add /api/v2/filters to edit filter with multiple keywords Entities: - `Filter`: `id`, `title`, `filter_action` (either `hide` or `warn`), `context` `keywords` - `FilterKeyword`: `id`, `keyword`, `whole_word` API endpoits: - `GET /api/v2/filters` to list filters (including keywords) - `POST /api/v2/filters` to create a new filter `keywords_attributes` can also be passed to create keywords in one request - `GET /api/v2/filters/:id` to read a particular filter - `PUT /api/v2/filters/:id` to update a new filter `keywords_attributes` can also be passed to edit, delete or add keywords in one request - `DELETE /api/v2/filters/:id` to delete a particular filter - `GET /api/v2/filters/:id/keywords` to list keywords for a filter - `POST /api/v2/filters/:filter_id/keywords/:id` to add a new keyword to a filter - `GET /api/v2/filter_keywords/:id` to read a particular keyword - `PUT /api/v2/filter_keywords/:id` to edit a particular keyword - `DELETE /api/v2/filter_keywords/:id` to delete a particular keyword * Change from `irreversible` boolean to `action` enum * Remove irrelevent `irreversible_must_be_within_context` check * Fix /filters/new and /filters/edit with update for filter_action * Fix Rubocop/Codeclimate complaining about task names * Refactor FeedManager#phrase_filtered? This moves regexp building and filter caching to the `CustomFilter` class. This does not change the functional behavior yet, but this changes how the cache is built, doing per-custom_filter regexps so that filters can be matched independently, while still offering caching. * Perform server-side filtering and output result in REST API * Fix numerous filters_changed events being sent when editing multiple keywords at once * Add some tests * Use the new API in the WebUI - use client-side logic for filters we have fetched rules for. This is so that filter changes can be retroactively applied without reloading the UI. - use server-side logic for filters we haven't fetched rules for yet (e.g. network error, or initial timeline loading) * Minor optimizations and refactoring * Perform server-side filtering on the streaming server * Change the wording of filter action labels * Fix issues pointed out by linter * Change design of “Show anyway” link in accordence to review comments * Drop “irreversible” filtering behavior * Move /api/v2/filter_keywords to /api/v1/filters/keywords * Rename `filter_results` attribute to `filtered` * Rename REST::LegacyFilterSerializer to REST::V1::FilterSerializer * Fix systemChannelId value in streaming server * Simplify code by removing client-side filtering code The simplifcation comes at a cost though: filters aren't retroactively applied anymore.	3 years ago
Eugen Rochko	a2871cd747	Add administrative webhooks (#18510) ... * Add administrative webhooks * Fix error when webhook is deleted before delivery worker runs	3 years ago
Claire	440eb71310	Change unapproved and unconfirmed account to not be accessible in the REST API (#17530) ... * Change unapproved and unconfirmed account to not be accessible in the REST API * Change Account#searchable? to reject unconfirmed and unapproved users * Disable search for unapproved and unconfirmed users in Account.search_for * Disable search for unapproved and unconfirmed users in Account.advanced_search_for * Remove unconfirmed and unapproved accounts from Account.searchable scope * Prevent mentions to unapproved/unconfirmed accounts * Fix some old tests for Account.advanced_search_for * Add some Account.advanced_search_for tests for existing behaviors * Add some tests for Account.search_for * Add Account.advanced_search_for tests unconfirmed and unapproved accounts * Add Account.searchable tests * Fix Account.without_unapproved scope potentially messing with previously-applied scopes * Allow lookup of unconfirmed/unapproved accounts through /api/v1/accounts/lookup This is so that the API can still be used to check whether an username is free to use.	3 years ago
Eugen Rochko	3917353645	Fix single Redis connection being used across all threads (#18135) ... * Fix single Redis connection being used across all Sidekiq threads * Fix tests	3 years ago
Eugen Rochko	71f2b95106	Fix edits with no actual changes being allowed (#17843) ... * Fix edits with no actual changes being allowed locally * Fix edits with no actual changes being allowed through ActivityPub * Fix false positive changes caused by description processing in model * Fix not recording poll expiration update * Fix test * Revert changes to ProcessStatusUpdateService * Various fixes and improvements * Fix code style issues * Various changes and improvements * Add guard clause	3 years ago
Eugen Rochko	d17fb70131	Change how changes to media attachments are stored for edits (#17696) ... * Change how changes to media attachments are stored for edits Fix not being able to re-order media attachments * Fix not broadcasting updates when polls/media is changed through ActivityPub * Various fixes and improvements * Update app/models/report.rb Co-authored-by: Claire <claire.github-309c@sitedethib.com> * Add tracking of media attachment description changes * Change poll in status edit to have a structure closer to the real one Co-authored-by: Claire <claire.github-309c@sitedethib.com>	3 years ago
Eugen Rochko	8f6c67bfde	Fix performance of account timelines (#17709) ... * Fix performance of account timelines * Various fixes and improvements * Fix duplicate results being returned Co-authored-by: Claire <claire.github-309c@sitedethib.com> * Fix grouping for pinned statuses scope Co-authored-by: Claire <claire.github-309c@sitedethib.com>	3 years ago
Josh Soref	b5329e0035	Spelling (#17705) ... * spelling: account Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: affiliated Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: appearance Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: autosuggest Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: cacheable Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: component Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: conversations Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: domain.example Clarify what's distinct and use RFC friendly domain space. Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: environment Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: exceeds Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: functional Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: inefficiency Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: not Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: notifications Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: occurring Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: position Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: progress Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: promotable Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: reblogging Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: repetitive Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: resolve Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: saturated Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: similar Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: strategies Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: success Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: targeting Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: thumbnails Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: unauthorized Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: unsensitizes Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: validations Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> * spelling: various Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> Co-authored-by: Josh Soref <jsoref@users.noreply.github.com>	3 years ago
Eugen Rochko	27965ce5ed	Add trending statuses (#17431) ... * Add trending statuses * Fix dangling items with stale scores in localized sets * Various fixes and improvements - Change approve_all/reject_all to approve_accounts/reject_accounts - Change Trends::Query methods to not mutate the original query - Change Trends::Query#skip to offset - Change follow recommendations to be refreshed in a transaction * Add tests for trending statuses filtering behaviour * Fix not applying filtering scope in controller	3 years ago
Eugen Rochko	a29a982eaa	Change e-mail domain blocks to block IPs dynamically (#17635) ... * Change e-mail domain blocks to block IPs dynamically * Update app/workers/scheduler/email_domain_block_refresh_scheduler.rb Co-authored-by: Yamagishi Kazutoshi <ykzts@desire.sh> * Update app/workers/scheduler/email_domain_block_refresh_scheduler.rb Co-authored-by: Yamagishi Kazutoshi <ykzts@desire.sh> Co-authored-by: Yamagishi Kazutoshi <ykzts@desire.sh>	3 years ago
luzpaz	73f5e4a1d9	Fix various typos (#17621) ... Found via `codespell -q 3 -S ./CHANGELOG.md,./AUTHORS.md,./config/locales,./app/javascript/mastodon/locales -L ba,keypair,medias,ro`	3 years ago
Jeong Arm	2fd2666eea	Add test for user matching ip (#17572)	3 years ago
Eugen Rochko	564efd0651	Add appeals (#17364) ... * Add appeals * Add ability to reject appeals and ability to browse pending appeals in admin UI * Add strikes to account page in settings * Various fixes and improvements - Add separate notification setting for appeals, separate from reports - Fix style of links in report/strike header - Change approving an appeal to not restore statuses (due to federation complexities) - Change style of successfully appealed strikes on account settings page - Change account settings page to only show unappealed or recently appealed strikes * Change appealed_at to overruled_at * Fix missing method error	3 years ago
Claire	472bc89611	Fix some flaky tests that randomly failed because of item ordering (#17509)	3 years ago
Claire	e38fc319dc	Refactor and improve tests (#17386) ... * Change account and user fabricators to simplify and improve tests - `Fabricate(:account)` implicitly fabricates an associated `user` if no `domain` attribute is given (an account with `domain: nil` is considered a local account, but no user record was created), unless `user: nil` is passed - `Fabricate(:account, user: Fabricate(:user))` should still be possible but is discouraged. * Fix and refactor tests - avoid passing unneeded attributes to `Fabricate(:user)` or `Fabricate(:account)` - avoid embedding `Fabricate(:user)` into a `Fabricate(:account)` or the other way around - prefer `Fabricate(:user, account_attributes: …)` to `Fabricate(:user, account: Fabricate(:account, …)` - also, some tests were using remote accounts with local user records, which is not representative of production code.	3 years ago