mastodon

Commit Graph

Author	SHA1	Message	Date
Eugen Rochko	74081433d0	Change trending hashtags to be affected be reblogs (#16164 ) If a status with a hashtag becomes very popular, it stands to reason that the hashtag should have a chance at trending Fix no stats being recorded for hashtags that are not allowed to trend, and stop ignoring bots Remove references to hashtags in profile directory from the code and the admin UI	4 years ago
Claire	566fc90913	Add Ruby 3.0 support (#16046 ) * Fix issues with POSIX::Spawn, Terrapin and Ruby 3.0 Also improve the Terrapin monkey-patch for the stderr/stdout issue. * Fix keyword argument handling throughout the codebase * Monkey-patch Paperclip to fix keyword arguments handling in validators * Change validation_extensions to please CodeClimate * Bump microformats from 4.2.1 to 4.3.1 * Allow Ruby 3.0 * Add Ruby 3.0 test target to CircleCI * Add test for admin dashboard warnings * Fix admin dashboard warnings on Ruby 3.0	4 years ago
abcang	7f0c49c58a	Improve tag search query (#16104 )	4 years ago
Claire	a6564d56d6	Fix edge case where accepted follow cannot be processed because of follow limit (#16098 )	4 years ago
Eugen Rochko	b3ceb3dcc4	Add canonical e-mail blocks for suspended accounts (#16049 ) Prevent new accounts from being created using the same underlying e-mail as a suspended account using extensions and period permutations. Stores e-mails as a SHA256 hash	4 years ago
Eugen Rochko	ce2148c571	Add `policy` param to `POST /api/v1/push/subscriptions` (#16040 ) With possible values `all`, `followed`, `follower`, and `none`, control from whom notifications will generate a Web Push alert	4 years ago
Eugen Rochko	f7117646af	Add cold-start follow recommendations (#15945 )	4 years ago
Claire	cbd0ee1d07	Update Mastodon to Rails 6.1 (#15910 ) * Update devise-two-factor to unreleased fork for Rails 6 support Update tests to match new `rotp` version. * Update nsa gem to unreleased fork for Rails 6 support * Update rails to 6.1.3 and rails-i18n to 6.0 * Update to unreleased fork of pluck_each for Ruby 6 support * Run "rails app:update" * Add missing ActiveStorage config file * Use config.ssl_options instead of removed ApplicationController#force_ssl Disabled force_ssl-related tests as they do not seem to be easily testable anymore. * Fix nonce directives by removing Rails 5 specific monkey-patching * Fix fixture_file_upload deprecation warning * Fix yield-based test failing with Rails 6 * Use Rails 6's index_with when possible * Use ActiveRecord::Cache::Store#delete_multi from Rails 6 This will yield better performances when deleting an account * Disable Rails 6.1's automatic preload link headers Since Rails 6.1, ActionView adds preload links for javascript files in the Links header per default. In our case, that will bloat headers too much and potentially cause issues with reverse proxies. Furhermore, we don't need those links, as we already output them as HTML link tags. * Switch to Rails 6.0 default config * Switch to Rails 6.1 default config * Do not include autoload paths in the load path	4 years ago
Claire	051efed5ed	Bypass MX validation for explicitly allowed domains (#15930 ) * Bypass MX validation for explicitly allowed domains This spares some lookups and prevent issues in some edge cases with local domains. * Add tests * Fix test	4 years ago
Claire	741d0952b1	Improve account counters handling (#15913 ) * Improve account counters handling * Use ActiveRecord::Base::sanitize_sql to pass values instead of interpolating them Keep using string interpolation for `key` as it is safe and using “ActiveRecord::Base::sanitize_sql_hash_for_assignment” would require stitching bits of SQL in a way that is not more easily checked for safety. * Add migration hook to catch PostgreSQL versions earlier than 9.5	4 years ago
Claire	5cc45d22d3	Remove subscription_expires_at leftover from OStatus (#15857 )	4 years ago
Eugen Rochko	8331fdf7e0	Add server rules (#15769 )	4 years ago
abcang	7ab53f221a	Improved performance of notification preloading (#15640 ) * Improved performance of notification preloading * Remove Cacheable from Notification * Fix test	4 years ago
ThibG	54d4e5252b	Use Rails' index_by where it makes sense (#15542 ) * Use Rails' index_by where it makes sense * Fix tests Co-authored-by: Claire <claire.github-309c@sitedethib.com>	4 years ago
Eugen Rochko	eb35be0431	Fix follow limit preventing re-following of a moved account (#14207 )	4 years ago
ThibG	8357969559	Fix admins being able to suspend their instance actor (#14567 ) * Fix admin being able to suspend their own instance account * Add text about the instance's own actor in admin view * Change instance actor notice from flash message to template * Do not list local instance actor in account moderation list	4 years ago
Eugen Rochko	216b85b053	Fix performance on instances list in admin UI (#15282 ) - Reduce duplicate queries - Remove n+1 queries - Add accounts count to detailed view - Add separate action log entry for updating existing domain blocks	4 years ago
Eugen Rochko	337dc6e0ad	Fix updating account counters when account_stat is not yet created (#15108 )	4 years ago
Takeshi Umeda	d6fe0c94ca	Add account sensitized (#14361 ) * Add account sensitized * Fix i18n normalize * Fix description and spec * Fix spec * Fix wording	4 years ago
ThibG	ca56527140	Add follower synchronization mechanism (#14510 ) * Add support for followers synchronization on the receiving end Check the `collectionSynchronization` attribute on `Create` and `Announce` activities and synchronize followers from provided collection if possible. * Add tests for followers synchronization on the receiving end * Add support for follower synchronization on the sender's end * Add tests for the sending end * Switch from AS attributes to HTTP header Replace the custom `collectionSynchronization` ActivityStreams attribute by an HTTP header (`X-AS-Collection-Synchronization`) with the same syntax as the `Signature` header and the following fields: - `collectionId` to specify which collection to synchronize - `digest` for the SHA256 hex-digest of the list of followers known on the receiving instance (where “receiving instance” is determined by accounts sharing the same host name for their ActivityPub actor `id`) - `url` of a collection that should be fetched by the instance actor Internally, move away from the webfinger-based `domain` attribute and use account `uri` prefix to group accounts. * Add environment variable to disable followers synchronization Since the whole mechanism relies on some new preconditions that, in some extremely rare cases, might not be met, add an environment variable (DISABLE_FOLLOWERS_SYNCHRONIZATION) to disable the mechanism altogether and avoid followers being incorrectly removed. The current conditions are: 1. all managed accounts' actor `id` and inbox URL have the same URI scheme and netloc. 2. all accounts whose actor `id` or inbox URL share the same URI scheme and netloc as a managed account must be managed by the same Mastodon instance as well. As far as Mastodon is concerned, breaking those preconditions require extensive configuration changes in the reverse proxy and might also cause other issues. Therefore, this environment variable provides a way out for people with highly unusual configurations, and can be safely ignored for the overwhelming majority of Mastodon administrators. * Only set follower synchronization header on non-public statuses This is to avoid unnecessary computations and allow Follow-related activities to be handled by the usual codepath instead of going through the synchronization mechanism (otherwise, any Follow/Undo/Accept activity would trigger the synchronization mechanism even if processing the activity itself would be enough to re-introduce synchronization) * Change how ActivityPub::SynchronizeFollowersService handles follow requests If the remote lists a local follower which we only know has sent a follow request, consider the follow request as accepted instead of sending an Undo. * Integrate review feeback - rename X-AS-Collection-Synchronization to Collection-Synchronization - various minor refactoring and code style changes * Only select required fields when computing followers_hash * Use actor URI rather than webfinger domain in synchronization endpoint * Change hash computation to be a XOR of individual hashes Makes it much easier to be memory-efficient, and avoid sorting discrepancy issues. * Marginally improve followers_hash computation speed * Further improve hash computation performances by using pluck_each	4 years ago
Eugen Rochko	5e1364c448	Add IP-based rules (#14963 )	4 years ago
Eugen Rochko	974b1b79ce	Add option to be notified when a followed user posts (#13546 ) * Add bell button Fix #4890 * Remove duplicate type from post-deployment migration * Fix legacy class type mappings * Improve query performance with better index * Fix validation * Remove redundant index from notifications	4 years ago
kawaguchi	5d3c8baa9a	Fix validates :sign_count of WebauthnCredential (#14806 )	4 years ago
Eugen Rochko	ed099d8bdc	Change account suspensions to be reversible by default (#14726 )	4 years ago
Eugen Rochko	e8bc187845	Refactor how public and tag timelines are queried (#14728 )	5 years ago
santiagorodriguez96	e8d41bc2fe	Add WebAuthn as an alternative 2FA method (#14466 ) * feat: add possibility of adding WebAuthn security keys to use as 2FA This adds a basic UI for enabling WebAuthn 2FA. We did a little refactor to the Settings page for editing the 2FA methods – now it will list the methods that are available to the user (TOTP and WebAuthn) and from there they'll be able to add or remove any of them. Also, it's worth mentioning that for enabling WebAuthn it's required to have TOTP enabled, so the first time that you go to the 2FA Settings page, you'll be asked to set it up. This work was inspired by the one donde by Github in their platform, and despite it could be approached in different ways, we decided to go with this one given that we feel that this gives a great UX. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add request for WebAuthn as second factor at login if enabled This commits adds the feature for using WebAuthn as a second factor for login when enabled. If users have WebAuthn enabled, now a page requesting for the use of a WebAuthn credential for log in will appear, although a link redirecting to the old page for logging in using a two-factor code will also be present. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add possibility of deleting WebAuthn Credentials Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: disable WebAuthn when an Admin disables 2FA for a user Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: remove ability to disable TOTP leaving only WebAuthn as 2FA Following examples form other platforms like Github, we decided to make Webauthn 2FA secondary to 2FA with TOTP, so that we removed the possibility of removing TOTP authentication only, leaving users with just WEbAuthn as 2FA. Instead, users will have to click on 'Disable 2FA' in order to remove second factor auth. The reason for WebAuthn being secondary to TOPT is that in that way, users will still be able to log in using their code from their phone's application if they don't have their security keys with them – or maybe even lost them. * We had to change a little the flow for setting up TOTP, given that now it's possible to setting up again if you already had TOTP, in order to let users modify their authenticator app – given that now it's not possible for them to disable TOTP and set it up again with another authenticator app. So, basically, now instead of storing the new `otp_secret` in the user, we store it in the session until the process of set up is finished. This was because, as it was before, when users clicked on 'Edit' in the new two-factor methods lists page, but then went back without finishing the flow, their `otp_secret` had been changed therefore invalidating their previous authenticator app, making them unable to log in again using TOTP. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * refactor: fix eslint errors The PR build was failing given that linting returning some errors. This commit attempts to fix them. * refactor: normalize i18n translations The build was failing given that i18n translations files were not normalized. This commits fixes that. * refactor: avoid having the webauthn gem locked to a specific version * refactor: use symbols for routes without '/' * refactor: avoid sending webauthn disabled email when 2FA is disabled When an admins disable 2FA for users, we were sending two mails to them, one notifying that 2FA was disabled and the other to notify that WebAuthn was disabled. As the second one is redundant since the first email includes it, we can remove it and send just one email to users. * refactor: avoid creating new env variable for webauthn_origin config * refactor: improve flash error messages for webauthn pages Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>	5 years ago
Eugen Rochko	7aaf2b44ec	Fix remote files not using Content-Type header, streaming (#14184 )	5 years ago
Eugen Rochko	1b198d6489	Fix trying to write non-existent image remote URL attribute on preview cards (#14181 ) Regression from #14145	5 years ago
Eugen Rochko	64aac30733	Add customizable thumbnails for audio and video attachments (#14145 ) - Change audio files to not be stripped of metadata - Automatically extract cover art from audio if it exists - Add `thumbnail` parameter to `POST /api/v1/media`, `POST /api/v2/media` and `PUT /api/v1/media/:id` - Add `icon` to represent it in attachments in ActivityPub - Fix `preview_url` containing URL of missing missing image when there is no thumbnail instead of null - Fix duration of audio not being displayed on public pages until the file is loaded	5 years ago
Eugen Rochko	5d8398c8b8	Add E2EE API (#13820 )	5 years ago
Takeshi Umeda	26b08a3c54	Add remote only to public timeline (#13504 ) * Add remote only to public timeline * Fix code style	5 years ago
ThibG	a4240fd027	Improve RSS entries for statuses (#13592 ) * Improve RSS entries for statuses - Render polls in both accounts and tags serializers - Refactor RSS serializers - Change title preview to include ellipsis when truncated - Change title preview to show CW instead of toot text - Add tests * Remove title from OEmbed serialization Twitter doesn't serialize title either, and tihs allows us to move the title formatting code to the RSS serializers.	5 years ago
Taras Gogol	6748a5acb1	Fix followings list order \| Issue #13538 (#13676 )	5 years ago
Yamagishi Kazutoshi	e223fd8c61	Revert "improve status title (#8596 )" (#13591 ) This reverts commit `05756c9a14`.	5 years ago
Eugen Rochko	5edff32733	Change delivery failure tracking to work with hostnames instead of URLs (#13437 )	5 years ago
abcang	61a7390b66	Search account domain in lowercase (#13016 ) * Search account domain in lowercase * fix rubocop error * fix spec/models/account_spec.rb	5 years ago
Eugen Rochko	71921f6bc3	Fix user disabling changing activity timestamps, fix nil error (#12943 )	5 years ago
Eugen Rochko	f52c988e12	Add announcements (#12662 ) * Add announcements Fix #11006 * Add reactions to announcements * Add admin UI for announcements * Add unit tests * Fix issues - Add `with_dismissed` param to announcements API - Fix end date not being formatted when time range is given - Fix announcement delete causing reactions to send streaming updates - Fix announcements container growing too wide and mascot too small - Fix `all_day` being settable when no time range is given - Change text "Update" to "Announcement" * Fix scheduler unpublishing announcements before they are due * Fix filter params not being passed to announcements filter	5 years ago
Eugen Rochko	81cc86bb1f	Fix media attachments without file being uploadable (#12562 ) Fix #12554	5 years ago
ThibG	57e2833f6a	Remove dependency on OStatus2 gem (#12822 )	5 years ago
Alexander	05756c9a14	improve status title (#8596 ) * improve shown status title, useful for atom/rss * use single quotes to satisfy codeclimate * fix tests, make message more pretty * fix tests * fix codestyle * fix codestyle * remove atom_serializer_spec Co-authored-by: Yamagishi Kazutoshi <ykzts@desire.sh>	5 years ago
ThibG	51eb111503	Allow blocking TLDs, and fix TLD blocks not being editable (#12805 ) Fixes #12795 It was already possible to create domain blocks for TLDs, but those weren't enforced, nor editable. This commit changes it so that they are enforced and editable.	5 years ago
Eugen Rochko	49b2f7c0a2	Fix base64-encoded file uploads not being possible (#12748 ) Fix #3804, Fix #5776	5 years ago
ThibG	911cc14481	Add follow_request notification type (#12198 ) * Add follow_request notification type The notification type already existed in the backend but was never pushed to the front-end. This also means translation strings were also available for the backend, from the notification mailer. Unlike other notification types, these are off by default, to match what I remember of Gargron's view on the topic: that follow requests should not clutter notifications and should instead be reviewed at the user's own leisure in the dedicated column. Since follow requests have their own column, I've deemed it unnecessary to add a specific tab for them in the notification quick filter. * Show follow request link in single-column if there are pending requests, even if account isn't locked * Push follow requests from notifications to the follow_requests list * Offer to accept or reject follow request from the notification * Redesign follow request notification	5 years ago
ThibG	650820d62d	Fix remote media descriptions being cut off at 420 chars (#12262 ) * Fix remote media descriptions being cut off at 420 chars Fixes #12258 * Fix tests	5 years ago
Eugen Rochko	354fdd317e	Fix attachment not being re-downloaded even if file is not stored (#12125 ) Change the behaviour of remotable concern. Previously, it would skip downloading an attachment if the stored remote URL is identical to the new one. Now it would not be skipped if the attachment is not actually currently stored by Paperclip.	5 years ago
Eugen Rochko	f665901e3c	Fix performance of home feed regeneration (#12084 ) Fetching statuses from all followed accounts at once takes too long within Postgres. Fetching them one by one and merging in Ruby could be a lot less resource-intensive Because the query for dynamically fetching the home timeline is so heavy, we can no longer offer it when the home timeline is missing	5 years ago
Eugen Rochko	62f60e86c2	Fix account counters being overwritten by parallel writes (#12045 )	5 years ago
Eugen Rochko	3ed94dcc1a	Add account migration UI (#11846 ) Fix #10736 - Change data export to be available for non-functional accounts - Change non-functional accounts to include redirecting accounts	6 years ago
Eugen Rochko	0762258aec	Fix hashtags being split by ZWNJ character (#11821 ) Fix #11761	6 years ago

1 2 3 4 5 ...

311 Commits (7342d3b132f2e5c382dc880712aaef78e1948569)