61 Commits (8eee7ae4c32dabb117b62cc5a36b6d6001024173)

Author	SHA1	Message	Date
Eugen Rochko	ca45f896dd	Fix various visual sign-up flow issues (#33206)	2 months ago
Matt Jankowski	a9d0b48b65	Set "admin" body class from `admin` nested layout (#31269)	5 months ago
Claire	2ec1181ee5	Fix contrast between background and form elements on some pages (#31266)	6 months ago
Matt Jankowski	929b9fdaff	Remove exclusion for `Rails/LexicallyScopedActionFilter` cop (#30697)	8 months ago
Matt Jankowski	9b5055d34d	Fix `Style/SuperArguments` cop (#30406)	9 months ago
Claire	963354978a	Add `Account#unavailable?` and `Account#permanently_unavailable?` aliases (#28053)	1 year ago
Matt Jankowski	1f1c75bba5	File cleanup/organization in `controllers/concerns` (#27846)	1 year ago
Claire	07a4059901	Add support for invite codes in the registration API (#27805)	1 year ago
Claire	379115e601	Add SELF_DESTRUCT env variable to process self-destructions in the background (#26439)	1 year ago
Matt Jankowski	340f1a68be	Simplify instance presenter view access (#26046)	1 year ago
Frankie Roberto	36a77748b4	Order sessions by most-recent to least-recently updated (#25005)	2 years ago
Matt Jankowski	6e226f5a32	Fix Rails/ActionOrder cop (#24692)	2 years ago
Eugen Rochko	e98c86050a	Refactor `Cache-Control` and `Vary` definitions (#24347)	2 years ago
Claire	280fa3b2c0	Fix invalid/expired invites being processed on sign-up (#24337)	2 years ago
Nick Schonning	e2a3ebb271	Autofix Rubocop Style/IfUnlessModifier (#23697)	2 years ago
David Vega	1b5d207131	Fix single name variables on controller folder (#20092) ... Co-authored-by: petrokoriakin1 <116151189+petrokoriakin1@users.noreply.github.com> Co-authored-by: petrokoriakin1 <116151189+petrokoriakin1@users.noreply.github.com> Co-authored-by: Effy Elden <effy@effy.space>	2 years ago
Daniel Axtens	4d85c27d1a	Add 'private' to Cache-Control, match Rails expectations (#20608) ... Several controlers set quite intricate Cache-Control headers in order to hopefully not be cached by any intermediate proxies or local caches. Unfortunately, these headers are processed by ActionDispatch::HTTP::Cache in a way that squashes and discards any values set alongside no-store other than private: 8015c2c2cf/actionpack/lib/action_dispatch/http/cache.rb (L207-L209) We want to preserve no-store on these responses, but we might as well remove parts that are going to be dropped anyway. As many of the endpoints in these controllers are private to a particular user, we should also add "private", which will be preserved alongside no-store.	2 years ago
Claire	a529d6d93e	Fix invites (#19560) ... Fixes #19507 Fix regression from #19296	2 years ago
Eugen Rochko	679274465b	Add server rules to sign-up flow (#19296)	2 years ago
Eugen Rochko	d83faa1a89	Add ability to block sign-ups from IP (#19037)	3 years ago
Claire	14919fe11e	Change old moderation strikes to be displayed in a separate page (#17566) ... * Change old moderation strikes to be displayed in a separate page Fixes #17552 This changes the moderation strikes displayed on `/auth/edit` to be those from the past 3 months, and make all moderation strikes targeting the current user available in `/disputes`. * Add short description of what the strikes page is for * Move link to list of strikes to “Account status” instead of navigation item * Normalize i18n file * Fix layout and styling of strikes link * Revert highlights_on regexp * Reintroduce account status summary - this way, “Account status” is never empty - account status is not necessarily bound to strikes, or recent strikes	3 years ago
Eugen Rochko	564efd0651	Add appeals (#17364) ... * Add appeals * Add ability to reject appeals and ability to browse pending appeals in admin UI * Add strikes to account page in settings * Various fixes and improvements - Add separate notification setting for appeals, separate from reports - Fix style of links in report/strike header - Change approving an appeal to not restore statuses (due to federation complexities) - Change style of successfully appealed strikes on account settings page - Change account settings page to only show unappealed or recently appealed strikes * Change appealed_at to overruled_at * Fix missing method error	3 years ago
Claire	bddd9ba36d	Add OMNIAUTH_ONLY environment variable to enforce externa log-in (#17288) ... * Remove support for OAUTH_REDIRECT_AT_SIGN_IN Fixes #15959 Introduced in #6540, OAUTH_REDIRECT_AT_SIGN_IN allowed skipping the log-in form to instead redirect to the external OmniAuth login provider. However, it did not prevent the log-in form on /about introduced by #10232 from appearing, and completely broke with the introduction of #15228. As I restoring that previous log-in flow without introducing a security vulnerability may require extensive care and knowledge of how OmniAuth works, this commit removes support for OAUTH_REDIRECT_AT_SIGN_IN instead for the time being. * Add OMNIAUTH_ONLY environment variable to enforce external log-in only * Disable user registration when OMNIAUTH_ONLY is set to true * Replace log-in links When OMNIAUTH_ONLY is set with exactly one OmniAuth provider	3 years ago
Claire	6da135a493	Fix reviving revoked sessions and invalidating login (#16943) ... Up until now, we have used Devise's Rememberable mechanism to re-log users after the end of their browser sessions. This mechanism relies on a signed cookie containing a token. That token was stored on the user's record, meaning it was shared across all logged in browsers, meaning truly revoking a browser's ability to auto-log-in involves revoking the token itself, and revoking access from *all* logged-in browsers. We had a session mechanism that dynamically checks whether a user's session has been disabled, and would log out the user if so. However, this would only clear a session being actively used, and a new one could be respawned with the `remember_user_token` cookie. In practice, this caused two issues: - sessions could be revived after being closed from /auth/edit (security issue) - auto-log-in would be disabled for *all* browsers after logging out from one of them This PR removes the `remember_token` mechanism and treats the `_session_id` cookie/token as a browser-specific `remember_token`, fixing both issues.	3 years ago
ThibG	49eb4d4ddf	Add honeypot fields and minimum fill-out time for sign-up form (#15276) ... * Add honeypot fields to limit non-specialized spam Add two honeypot fields: a fake website input and a fake password confirmation one. The label/placeholder/aria-label tells not to fill them, and they are hidden in CSS, so legitimate users should not fall into these. This should cut down on some non-Mastodon-specific spambots. * Require a 3 seconds delay before submitting the registration form * Fix tests * Move registration form time check to model validation * Give people a chance to clear the honeypot fields * Refactor honeypot translation strings Co-authored-by: Claire <claire.github-309c@sitedethib.com>	4 years ago
Eugen Rochko	5e1364c448	Add IP-based rules (#14963)	4 years ago
Eugen Rochko	844870273f	Fix other sessions not being logged out on password change (#14252) ... While OAuth tokens were immediately revoked, accessing the home controller immediately generated new OAuth tokens and "revived" the session due to a combination of using remember_me tokens and overwriting the `authenticate_user!` method	5 years ago
ThibG	c48d895ea7	Fix sign-ups without checked user agreement being accepted through the web form (#13088) ... * Fix user agreement not being verified * Fix tests * Fix up agreement field being dismissed	5 years ago
Eugen Rochko	daf71573d0	Fix password change/reset not immediately invalidating other sessions (#12928) ... While making browser requests in the other sessions after a password change or reset does not allow you to be logged in and correctly invalidates the session making the request, sessions have API tokens associated with them, which can still be used until that session is invalidated. This is a security issue for accounts that were already compromised some other way because it makes it harder to throw out the hijacker.	5 years ago
Eugen Rochko	6e9e8d89fa	Fix settings pages being cacheable by the browser (#12714) ... Fix #12255	5 years ago
Eugen Rochko	964ae8eee5	Change unconfirmed user login behaviour (#11375) ... Allow access to account settings, 2FA, authorized applications, and account deletions to unconfirmed and pending users, as well as users who had their accounts disabled. Suspended users cannot update their e-mail or password or delete their account. Display account status on account settings page, for example, when an account is frozen, limited, unconfirmed or pending review. After sign up, login users straight away and show a simple page that tells them the status of their account with links to account settings and logout, to reduce onboarding friction and allow users to correct wrongly typed e-mail addresses. Move the final sign-up step of SSO integrations to be the same as above to reduce code duplication.	6 years ago
ThibG	21a73c52a7	Check that an invite link is valid before bypassing approval mode (#10657) ... * Check that an invite link is valid before bypassing approval mode Fixes #10656 * Add tests * Only consider valid invite links in registration controller * fixup	6 years ago
Eugen Rochko	8b69a66380	Add "why do you want to join" field to invite requests (#10524) ... * Add "why do you want to join" field to invite requests Fix #10512 * Remove unused translations * Fix broken registrations when no invite request text is submitted	6 years ago
Eugen Rochko	51e154f5e8	Admission-based registrations mode (#10250) ... Fix #6856 Fix #6951	6 years ago
ThibG	67215692fc	Save IP address used for sign-up, not only sign-in (#10026) ... Fixes #9995	6 years ago
Eugen Rochko	5d2fc6de32	Add REST API for creating an account (#9572) ... * Add REST API for creating an account The method is available to apps with a token obtained via the client credentials grant. It creates a user and account records, as well as an access token for the app that initiated the request. The user is unconfirmed, and an e-mail is sent as usual. The method returns the access token, which the app should save for later. The REST API is not available to users with unconfirmed accounts, so the app must be smart to wait for the user to click a link in their e-mail inbox. The method is rate-limited by IP to 5 requests per 30 minutes. * Redirect users back to app from confirmation if they were created with an app * Add tests * Return 403 on the method if registrations are not open * Require agreement param to be true in the API when creating an account	6 years ago
ThibG	215e649391	Fix styling in /auth/edit (#9117)	6 years ago
Eugen Rochko	60df87f6f0	Compensate for scrollbar disappearing when media modal visible (#8100) ... * Compensate for scrollbar disappearing when media modal visible Make auth pages backgrounds lighter * Fix typo	7 years ago
Eugen Rochko	baff4a7ce0	If signed in, redirect autofollow invite to profile page (#7956) ... Fix #7944	7 years ago
Eugen Rochko	ca85658975	Add autofollow option to invites (#7805) ... * Add autofollow option to invites * Trigger CodeClimate rebuild	7 years ago
Alexander	04fef7b888	pam authentication (#5303) ... * add pam support, without extra column * bugfixes for pam login * document options * fix code style * fix codestyle * fix tests * don't call remember_me without password * fix codestyle * improve checks for pam usage (should fix tests) * fix remember_me part 1 * add remember_token column because :rememberable requires either a password or this column. * migrate db for remember_token * move pam_authentication to the right place, fix logic bug in edit.html.haml * fix tests * fix pam authentication, improve username lookup, add comment * valid? is sometimes not honored, return nil instead trying to authenticate with pam * update devise_pam_authenticatable2 and adjust code. Fixes sideeffects observed in tests * update devise_pam_authenticatable gem, fixes for codeconventions, fix finding user * codeconvention fixes * code convention fixes * fix idention * update dependency, explicit conflict check * fix disabled password updates if in pam mode * fix check password if password is present, fix templates * block registration if account is maintained by pam * Revert "block registration if account is maintained by pam" This reverts commit 8e7a083d650240b6fac414926744b4b90b435f20. * fix identation error introduced by rebase * block usernames maintained by pam * document pam settings better * fix code style	7 years ago
Patrick Figel	04ecf44c2f	Add confirmation step for email changes (#6071) ... * Add confirmation step for email changes This adds a confirmation step for email changes of existing users. Like the initial account confirmation, a confirmation link is sent to the new address. Additionally, a notification is sent to the existing address when the change is initiated. This message includes instruction to reset the password immediately or to contact the instance admin if the change was not initiated by the account owner. Fixes #3871 * Add review fixes	7 years ago
Eugen Rochko	740f8a95a9	Add consumable invites (#5814) ... * Add consumable invites * Add UI for generating invite codes * Add tests * Display max uses and expiration in invites table, delete invite * Remove unused column and redundant validator - Default follows not used, probably bad idea - InviteCodeValidator is redundant because RegistrationsController checks invite code validity * Add admin setting to disable invites * Add admin UI for invites, configurable role for invite creation - Admin UI that lists everyone's invites, always available - Admin setting min_invite_role to control who can invite people - Non-admin invite UI only visible if users are allowed to * Do not remove invites from database, expire them instantly	7 years ago
Yamagishi Kazutoshi	dc91fd482a	Set InstancePresenter to `Auth::RegistrationsController#create` (#5366)	7 years ago
takayamaki	552d22bec9	sign_in and sign_up views present og meta infos (#5308)	7 years ago
Eugen Rochko	f7301bd5b9	Add overview of active sessions (#3929) ... * Add overview of active sessions * Better display of browser/platform name * Improve how browser information is stored and displayed for sessions overview * Fix test	8 years ago
Eugen Rochko	2ca1f0737a	Fix Devise destroy method being available to delete user record (#3266) ... (You may think that we need account deletions, but this way would've just orphaned the db records)	8 years ago
saturday06	d87ee1167e	Assign user locale on signup (#1982)	8 years ago
Marcin Cieślak	1c8477eab2	Give SINGLE_USER a chance to register (#1820) ... An attempt to open a brand new Mastodon instance configured as SINGLE_USER_MODE=true will cause an exception. Enable temporary registration if we have no users in the database Fixes #1817	8 years ago
Eugen Rochko	5f54981846	New admin setting: open/close registrations, with custom message, from the admin UI	8 years ago