mastodon

Commit Graph

Author	SHA1	Message	Date
Eugen Rochko	fd3a45e348	Add edit history to web UI (#17390 ) * Add edit history to web UI * Change history reducer to store items per status * Fix missing loading prop	3 years ago
Eugen Rochko	85b86fe28c	Add global `locale` param (#17464 ) - Remove the session-based locale stickyness	3 years ago
Claire	73a782391c	Fix replies collection incorrectly looping (#17462 ) * Refactor tests * Add tests * Fix replies collection incorrectly looping	3 years ago
Claire	92658f0fb0	Fix instance actor not being dereferenceable (#17457 ) * Add tests * Fix instance actor not being dereferenceable * Fix tests * Fix tests for real	3 years ago
Eugen Rochko	e03e7ac290	Fix error on account relationships page in admin UI (#17444 )	3 years ago
Claire	f5639e1cbe	Change public profile pages to be disabled for unconfirmed users (#17385 ) Fixes #17382 Note that unconfirmed and unapproved accounts can still be searched for and their (empty) account retrieved using the REST API.	3 years ago
Claire	03d59340da	Fix Sidekiq warnings about JSON serialization (#17381 ) * Fix Sidekiq warnings about JSON serialization This occurs on every symbol argument we pass, and every symbol key in hashes, because Sidekiq expects strings instead. See https://github.com/mperham/sidekiq/pull/5071 We do not need to change how workers parse their arguments because this has not changed and we were already converting to symbols adequately or using `with_indifferent_access`. * Set Sidekiq to raise on unsafe arguments in test mode In order to more easily catch issues that would produce warnings in production code.	3 years ago
Claire	bddd9ba36d	Add OMNIAUTH_ONLY environment variable to enforce externa log-in (#17288 ) * Remove support for OAUTH_REDIRECT_AT_SIGN_IN Fixes #15959 Introduced in #6540, OAUTH_REDIRECT_AT_SIGN_IN allowed skipping the log-in form to instead redirect to the external OmniAuth login provider. However, it did not prevent the log-in form on /about introduced by #10232 from appearing, and completely broke with the introduction of #15228. As I restoring that previous log-in flow without introducing a security vulnerability may require extensive care and knowledge of how OmniAuth works, this commit removes support for OAUTH_REDIRECT_AT_SIGN_IN instead for the time being. * Add OMNIAUTH_ONLY environment variable to enforce external log-in only * Disable user registration when OMNIAUTH_ONLY is set to true * Replace log-in links When OMNIAUTH_ONLY is set with exactly one OmniAuth provider	3 years ago
Claire	cfa583fa71	Remove support for OAUTH_REDIRECT_AT_SIGN_IN (#17287 ) Fixes #15959 Introduced in #6540, OAUTH_REDIRECT_AT_SIGN_IN allowed skipping the log-in form to instead redirect to the external OmniAuth login provider. However, it did not prevent the log-in form on /about introduced by #10232 from appearing, and completely broke with the introduction of #15228. As I restoring that previous log-in flow without introducing a security vulnerability may require extensive care and knowledge of how OmniAuth works, this commit removes support for OAUTH_REDIRECT_AT_SIGN_IN instead for the time being.	3 years ago
Eugen Rochko	1060666c58	Add support for editing for published statuses (#16697 ) * Add support for editing for published statuses * Fix references to stripped-out code * Various fixes and improvements * Further fixes and improvements * Fix updates being potentially sent to unauthorized recipients * Various fixes and improvements * Fix wrong words in test * Fix notifying accounts that were tagged but were not in the audience * Fix mistake	3 years ago
Eugen Rochko	14f436c457	Add notifications for statuses deleted by moderators (#17204 )	3 years ago
Claire	d5c9feb7b7	Add support for private pinned posts (#16954 ) * Add support for private pinned toots * Allow local user to pin private toots * Change wording to avoid "direct message"	3 years ago
Eugen Rochko	8e84ebf0cb	Remove IP tracking columns from users table (#16409 )	3 years ago
Claire	76761d5fc0	Add ability for admins to delete canonical email blocks (#16644 ) * Add admin option to remove canonical email blocks from a deleted account * Add tootctl canonical_email_blocks to inspect and remove canonical email blocks	3 years ago
Claire	7f803c41e2	Add ability to purge undeliverable domains from admin interface (#16686 ) * Add ability to purge undeliverable domains from admin interface * Add tests	3 years ago
heguro	41503507ec	Fix redirection when succeeded WebAuthn (#17098 )	3 years ago
Eugen Rochko	0fb9536d38	Add batch suspend for accounts in admin UI (#17009 )	3 years ago
Jeong Arm	1c826471e7	Fix admin statuses order(#16937 ) (#16969 ) * Fix #16937 * Add test for statuses order	3 years ago
Eugen Rochko	7de0ee7aba	Remove Keybase integration (#17045 )	3 years ago
Eugen Rochko	6e50134a42	Add trending links (#16917 ) * Add trending links * Add overriding specific links trendability * Add link type to preview cards and only trend articles Change trends review notifications from being sent every 5 minutes to being sent every 2 hours Change threshold from 5 unique accounts to 15 unique accounts * Fix tests	3 years ago
Claire	6da135a493	Fix reviving revoked sessions and invalidating login (#16943 ) Up until now, we have used Devise's Rememberable mechanism to re-log users after the end of their browser sessions. This mechanism relies on a signed cookie containing a token. That token was stored on the user's record, meaning it was shared across all logged in browsers, meaning truly revoking a browser's ability to auto-log-in involves revoking the token itself, and revoking access from all logged-in browsers. We had a session mechanism that dynamically checks whether a user's session has been disabled, and would log out the user if so. However, this would only clear a session being actively used, and a new one could be respawned with the `remember_user_token` cookie. In practice, this caused two issues: - sessions could be revived after being closed from /auth/edit (security issue) - auto-log-in would be disabled for all browsers after logging out from one of them This PR removes the `remember_token` mechanism and treats the `_session_id` cookie/token as a browser-specific `remember_token`, fixing both issues.	3 years ago
Jeong Arm	458830ee7c	Fix statuses order in account's statuses admin page (#16937 )	3 years ago
Takeshi Umeda	17f4e457b3	Add remove from followers api (#16864 ) * Add followed_by? to account_interactions * Add RemoveFromFollowersService * Fix AccountBatch to use RemoveFromFollowersService * Add remove from followers API	3 years ago
Eugen Rochko	07341e7aa6	Add graphs and retention metrics to admin dashboard (#16829 )	3 years ago
Claire	5159ba26e4	Fix error when rendering public pages with media attachments (#16763 ) * Add tests * Fix error when rendering public pages with media attachments * Add tests * Fix tests * Please CodeClimate	3 years ago
Claire	24f9ea7818	Fix webauthn secure key authentication (#16792 ) * Add tests * Fix webauthn secure key authentication Fixes #16769	3 years ago
Eugen Rochko	52e5c07948	Change routing paths to use usernames in web UI (#16171 )	3 years ago
Claire	e0af97164a	Fix followers synchronization mechanism not working when URI has empty path (#16744 ) Follow-up to #16510, forgot the controller exposing the actual followers…	3 years ago
Truong Nguyen	7283a5d3b9	Explicitly set userVerification to discoraged (#16545 )	4 years ago
Claire	94bcf45321	Fix authentication failures after going halfway through a sign-in attempt (#16607 ) * Add tests * Add security-related tests My first (unpublished) attempt at fixing the issues introduced (extremely hard-to-exploit) security vulnerabilities, addressing them in a test. * Fix authentication failures after going halfway through a sign-in attempt * Refactor `authenticate_with_sign_in_token` and `authenticate_with_two_factor` to make the two authentication steps more obvious	4 years ago
Daniel	5c21021176	Fix undefined variable for Auth::OmniauthCallbacksController (#16654 ) The addition of authentication history broke the omniauth login with the following error: method=GET path=/auth/auth/cas/callback format=html controller=Auth::OmniauthCallbacksController action=cas status=500 error='NameError: undefined local variable or method `user' for #<Auth::OmniauthCallbacksController:0x00000000036290> Did you mean? @user' duration=435.93 view=0.00 db=36.19 * app/controllers/auth/omniauth_callbacks_controller.rb: fix variable name to `@user`	4 years ago
Claire	4ac78e2a06	Add feature to automatically delete old toots (#16529 ) * Add account statuses cleanup policy model * Record last inspected toot to delete to speed up successive calls to statuses_to_delete * Add service to cleanup a given account's statuses within a budget * Add worker to go through account policies and delete old toots * Fix last inspected status id logic All existing statuses older or equal to last inspected status id must be kept by the current policy. This is an invariant that must be kept so that resuming deletion from the last inspected status remains sound. * Add tests * Refactor scheduler and add tests * Add user interface * Add support for discriminating based on boosts/favs * Add UI support for min_reblogs and min_favs, rework UI * Address first round of review comments * Replace Snowflake#id_at_start with with_random parameter * Add tests * Add tests for StatusesCleanupController * Rework settings page * Adjust load-avoiding mechanisms * Please CodeClimate	4 years ago
Claire	d8629e7b86	Add logging of S3-related errors (#16381 )	4 years ago
Claire	30ce6e395c	Fix user email address being banned on self-deletion (#16503 ) * Add tests * Fix user email address being banned on self-deletion Fixes #16498	4 years ago
Eugen Rochko	771c9d4ba8	Add ability to skip sign-in token authentication for specific users (#16427 ) Remove "active within last two weeks" exception for sign in token requirement Change admin reset password to lock access until the password is reset	4 years ago
Claire	49219508bc	Fix anonymous access to outbox not being cached by the reverse proxy (#16458 ) * Fix anonymous access to outbox not being cached by the reverse proxy Up until now, anonymous access to outbox was marked as public, but with a 0 duration for caching, which means remote proxies would only serve from cache when the server was completely overwhelmed. Changed that cache duration to one minute, so that repeated anonymous access to one account's outbox can be appropriately cached. Also added `Signature` to the `Vary` header in case a page is requested, so that authenticated fetches are never served from cache (which only contains public toots). * Remove Vary: Accept header from webfinger controller Indeed, we have stopped returning xrd, and only ever return jrd, so the Accept request header does not matter anymore. * Cache negative webfinger hits for 3 minutes	4 years ago
Claire	63b807cffc	Fix serialization of followers/following counts when user hides their network (#16418 ) * Add tests * Fix serialization of followers/following counts when user hides their network Fixes #16382 Signed-off-by: Claire <claire.github-309c@sitedethib.com>	4 years ago
Eugen Rochko	d174d12c83	Add authentication history (#16408 )	4 years ago
Eugen Rochko	1410dffdf4	Fix e-mail confirmations API not working correctly (#16348 ) * Fix e-mail confirmations API not working correctly * Fix typo	4 years ago
Claire	3b27b09acb	Fix some IDs in instance actor outbox (#16343 )	4 years ago
Jeong Arm	5ef216d032	Remove set-cookie header on custom.css (#16314 ) * Remove set-cookie header on custom.css * Additional fix for set-cookie	4 years ago
Claire	12f8f39e25	Fix media proxy RedisLocks auto-releasing too fast (#16291 ) Follow-up to #16276	4 years ago
Eugen Rochko	74081433d0	Change trending hashtags to be affected be reblogs (#16164 ) If a status with a hashtag becomes very popular, it stands to reason that the hashtag should have a chance at trending Fix no stats being recorded for hashtags that are not allowed to trend, and stop ignoring bots Remove references to hashtags in profile directory from the code and the admin UI	4 years ago
Claire	566fc90913	Add Ruby 3.0 support (#16046 ) * Fix issues with POSIX::Spawn, Terrapin and Ruby 3.0 Also improve the Terrapin monkey-patch for the stderr/stdout issue. * Fix keyword argument handling throughout the codebase * Monkey-patch Paperclip to fix keyword arguments handling in validators * Change validation_extensions to please CodeClimate * Bump microformats from 4.2.1 to 4.3.1 * Allow Ruby 3.0 * Add Ruby 3.0 test target to CircleCI * Add test for admin dashboard warnings * Fix admin dashboard warnings on Ruby 3.0	4 years ago
Takeshi Umeda	7cb34b32f8	Add management of delivery availability in Federation settings (#15771 ) * Add management of delivery availavility in Federation settings * fix translate * Remove useless object creation * Fix DeepSource issue * Add shortcut for all * Fix DeepSource(skipcq) * Change 'remove' to 'clear' * Fix style * Change class method name (exhausted_deliveries_key_by)	4 years ago
Eugen Rochko	351c744590	Fix error when trying to render component for media without meta (#16112 )	4 years ago
Eugen Rochko	059df83d1d	Fix database serialization failure returning HTTP 500 (#16101 ) Database serialization failure occurs when a read-replica is used and a query takes long enough that rows on the primary database become unavailable. It should return HTTP 503 as it is temporary. Re-order rescue definitions according to their status codes	4 years ago
Claire	8c44b723bb	Change confirmations controller to redirect to / for approved users (#16151 ) Clicking the confirmation link multiple times currently leads to entering account settings, which can be confusing. This commit changes that so that it redirects to the root path, so it behaves the same way as clicking only once in most cases.	4 years ago
abcang	d0fc69d721	Further improve the media attached status query for accounts (#16106 )	4 years ago
abcang	1f47511023	Improve media attached status query (#16105 )	4 years ago

1 2 3 4 5 ...

1146 Commits (5533fa28b6cb6ca71775b716a515c1745f76bf02)