123 Commits (90beba57d8d034adc2dd1022f709db2157ea7838)

Author	SHA1	Message	Date
Akihiko Odaki	64ef37b89d	Introduce ApplicationController#cache_collection_paginated_by_id (#14677) ... * Replace incorrect use of distinct with group Some uses of ActiveRecord::QueryMethods#distinct pass field names but they are incorrect for the current version of Rails. ActiveRecord::QueryMethods#group provides the expected behavior and benefits performance. See commit 6da24aad4c. * Introduce ApplicationController#cache_collection_paginated_by_id ApplicationController#cache_collection_paginated_by_id fuses ApplicationController#cache_collection and Paginable.paginate_by_id. An advantage of this method is that it prevents from modifying scope which Paginable.paginate_by_id may provide. ApplicationController#cache_collection always return an array and there is no possibility of the scope modification. It is also clear for a programmer, considering the implication of "cache". This method can also emit more efficient queries by using Cacheable.cache_ids before calling Paginable.paginate_by_id.	4 years ago
ThibG	b241f20bd2	Add support for latest HTTP Signatures spec draft (#14556) ... * Add support for latest HTTP Signatures spec draft https://www.ietf.org/id/draft-ietf-httpbis-message-signatures-00.html - add support for the “hs2019” signature algorithm (assumed to be equivalent to RSA-SHA256, since we do not have a mechanism to specify the algorithm within the key metadata yet) - add support for (created) and (expires) pseudo-headers and related signature parameters, when using the hs2019 signature algorithm - adjust default “headers” parameter while being backwards-compatible with previous implementation - change the acceptable time window logic from 12 hours surrounding the “date” header to accepting signatures created up to 1 hour in the future and expiring up to 1 hour in the past (but only allowing expiration dates up to 12 hours after the creation date) This doesn't conform with the current draft, as it doesn't permit accounting for clock skew. This, however, should be addressed in a next version of the draft: https://github.com/httpwg/http-extensions/pull/1235 * Add additional signature requirements * Rewrite signature params parsing using Parslet * Make apparent which signature algorithm Mastodon on verification failure Mastodon uses RSASSA-PKCS1-v1_5, which is not recommended for new applications, and new implementers may thus unknowingly use RSASSA-PSS. * Add workaround for PeerTube's invalid signature header The previous parser allowed incorrect Signature headers, such as those produced by old versions of the `http-signature` node.js package, and seemingly used by PeerTube. This commit adds a workaround for that. * Fix `signature_key_id` raising an exception Previously, parsing failures would result in `signature_key_id` being nil, but the parser changes made that result in an exception. This commit changes the `signature_key_id` method to return `nil` in case of parsing failures. * Move extra HTTP signature helper methods to private methods * Relax (request-target) requirement to (request-target) || digest This lets requests from Plume work without lowering security significantly.	4 years ago
santiagorodriguez96	e8d41bc2fe	Add WebAuthn as an alternative 2FA method (#14466) ... * feat: add possibility of adding WebAuthn security keys to use as 2FA This adds a basic UI for enabling WebAuthn 2FA. We did a little refactor to the Settings page for editing the 2FA methods – now it will list the methods that are available to the user (TOTP and WebAuthn) and from there they'll be able to add or remove any of them. Also, it's worth mentioning that for enabling WebAuthn it's required to have TOTP enabled, so the first time that you go to the 2FA Settings page, you'll be asked to set it up. This work was inspired by the one donde by Github in their platform, and despite it could be approached in different ways, we decided to go with this one given that we feel that this gives a great UX. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add request for WebAuthn as second factor at login if enabled This commits adds the feature for using WebAuthn as a second factor for login when enabled. If users have WebAuthn enabled, now a page requesting for the use of a WebAuthn credential for log in will appear, although a link redirecting to the old page for logging in using a two-factor code will also be present. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add possibility of deleting WebAuthn Credentials Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: disable WebAuthn when an Admin disables 2FA for a user Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: remove ability to disable TOTP leaving only WebAuthn as 2FA Following examples form other platforms like Github, we decided to make Webauthn 2FA secondary to 2FA with TOTP, so that we removed the possibility of removing TOTP authentication only, leaving users with just WEbAuthn as 2FA. Instead, users will have to click on 'Disable 2FA' in order to remove second factor auth. The reason for WebAuthn being secondary to TOPT is that in that way, users will still be able to log in using their code from their phone's application if they don't have their security keys with them – or maybe even lost them. * We had to change a little the flow for setting up TOTP, given that now it's possible to setting up again if you already had TOTP, in order to let users modify their authenticator app – given that now it's not possible for them to disable TOTP and set it up again with another authenticator app. So, basically, now instead of storing the new `otp_secret` in the user, we store it in the session until the process of set up is finished. This was because, as it was before, when users clicked on 'Edit' in the new two-factor methods lists page, but then went back without finishing the flow, their `otp_secret` had been changed therefore invalidating their previous authenticator app, making them unable to log in again using TOTP. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * refactor: fix eslint errors The PR build was failing given that linting returning some errors. This commit attempts to fix them. * refactor: normalize i18n translations The build was failing given that i18n translations files were not normalized. This commits fixes that. * refactor: avoid having the webauthn gem locked to a specific version * refactor: use symbols for routes without '/' * refactor: avoid sending webauthn disabled email when 2FA is disabled When an admins disable 2FA for users, we were sending two mails to them, one notifying that 2FA was disabled and the other to notify that WebAuthn was disabled. As the second one is redundant since the first email includes it, we can remove it and send just one email to users. * refactor: avoid creating new env variable for webauthn_origin config * refactor: improve flash error messages for webauthn pages Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>	4 years ago
fuyu	a279acc730	Fix not working I18n on 2FA and Sign in token page (#14087)	5 years ago
Eugen Rochko	72a7cfaa39	Add e-mail-based sign in challenge for users with disabled 2FA (#14013)	5 years ago
ThibG	4bcef12bad	Fix sr locale being selected over sr-Latn (#13693) ... * Fix sr locale being selected over sr-Latn * Update tests	5 years ago
Eugen Rochko	339ce1c4e9	Add specific rate limits for posting and following (#13172)	5 years ago
Eugen Rochko	5265df0a8a	Change signature verification to ignore signatures with invalid host (#13033) ... Instead of returning a signature verification error, pretend there was no signature (i.e., this does not allow access to resources that need a valid signature), so public resources can still be fetched Fix #13011	5 years ago
Eugen Rochko	49b2f7c0a2	Fix base64-encoded file uploads not being possible (#12748) ... Fix #3804, Fix #5776	5 years ago
Eugen Rochko	3ed94dcc1a	Add account migration UI (#11846) ... Fix #10736 - Change data export to be available for non-functional accounts - Change non-functional accounts to include redirecting accounts	5 years ago
Eugen Rochko	e1066cd431	Add password challenge to 2FA settings, e-mail notifications (#11878) ... Fix #3961	5 years ago
Eugen Rochko	1bc077dc74	Add HTTP signature keyId to request log (#11591)	5 years ago
Eugen Rochko	24552b5160	Add whitelist mode (#11291)	6 years ago
Eugen Rochko	c669bb42ba	Add (back) rails-level JSON caching (#11333)	6 years ago
Eugen Rochko	bd1545de5e	Change locale detection to run once per session (#8657) ... Fix #6462	6 years ago
Eugen Rochko	5bf67ca913	Add ActivityPub secure mode (#11269) ... * Add HTTP signature requirement for served ActivityPub resources * Change `SECURE_MODE` to `AUTHORIZED_FETCH` * Add 'Signature' to 'Vary' header and improve code style * Improve code style by adding `public_fetch_mode?` method	6 years ago
Eugen Rochko	4e92183227	Refactor domain block checks (#11268)	6 years ago
Eugen Rochko	63c7fe8e48	Refactor controllers for statuses, accounts, and more (#11249)	6 years ago
ThibG	cac9110533	Cleanup various controllers (#10972) ... * Remove skip_session! as it is not supported in Rails 5 * Minor cleanup in StreamEntriesController * Remove redundant mark_cacheable! calls	6 years ago
ThibG	89d600bedb	Move signature verification stoplight to the requests themselves (#10813) ... * Move signature verification stoplight to the requests themselves This avoids blocking messages from known keys for 5 minutes when only one fails… * Put the stoplight on the actual client IP, not a potential reverse proxy	6 years ago
ThibG	2361917944	Mark the 410 gone response for suspended accounts as cachable (#10339) ... This will help a great deal with #9377 when a caching reverse proxy is configured.	6 years ago
Eugen Rochko	51e154f5e8	Admission-based registrations mode (#10250) ... Fix #6856 Fix #6951	6 years ago
ThibG	28b482874a	Improvements to signature verification (#9667) ... * Refactor signature verification a bit * Rescue signature verification if recorded public key is invalid Fixes #8822 * Always re-fetch AP signing key when HTTP Signature verification fails But when the account is not marked as stale, avoid fetching collections and media, and avoid webfinger round-trip. * Apply stoplight to key/account update as well as initial key retrieval	6 years ago
Eugen Rochko	17cd91c777	Fix signature verification stoplight triggering on non-timeout errors (#9617)	6 years ago
ysksn	189a6b17fb	Remove RemoteAccountControllerConcern never used (#9482)	6 years ago
Eugen Rochko	4615512285	Reduce connect timeout limit and limit signature failures by source IP (#9236) ... * Reduce connect timeout from 10s to 1s * Limit failing signature verifications per source IP	6 years ago
Eugen Rochko	21ad21cb50	Improve signature verification safeguards (#8959) ... * Downcase signed_headers string before building the signed string The HTTP Signatures draft does not mandate the “headers” field to be downcased, but mandates the header field names to be downcased in the signed string, which means that prior to this patch, Mastodon could fail to process signatures from some compliant clients. It also means that it would not actually check the Digest of non-compliant clients that wouldn't use a lowercased Digest field name. Thankfully, I don't know of any such client. * Revert "Remove dead code (#8919)" This reverts commit a00ce8c92c. * Restore time window checking, change it to 12 hours By checking the Date header, we can prevent replaying old vulnerable signatures. The focus is to prevent replaying old vulnerable requests from software that has been fixed in the meantime, so a somewhat long window should be fine and accounts for timezone misconfiguration. * Escape users' URLs when formatting them Fixes possible HTML injection * Escape all string interpolations in Formatter class Slightly improve performance by reducing class allocations from repeated Formatter#encode calls * Fix code style issues	6 years ago
Eugen Rochko	a00ce8c92c	Remove dead code (#8919) ... SignatureVerification#matches_time_window? is not called anywhere.	6 years ago
Eugen Rochko	bb71538bb5	Redesign public profiles and toots (#8068)	7 years ago
Marty McGuire	8fea9cc311	Typo in signature verification failure logging (#7916) ... `@signature_verification_failure_reason` is used in most places but`@signed_verification_failure_reason` appears in two places. Likely those errors are not returned.	7 years ago
Eugen Rochko	dfb6907e08	HTTP signatures spec no longer requires algorithms field (#7525) ... Fix #7520	7 years ago
ThibG	352bae8c3e	Update session activation time (fixes #5605) (#7408)	7 years ago
Yamagishi Kazutoshi	87e3f0a41d	Fix spec for sr-Latn (#7203)	7 years ago
ThibG	1364e9e4ae	Fix follow/unfollow buttons on public profile (fixes #7036) (#7040) ... * Fix follow/unfollow buttons on public profile - Present non-logged users with web+mastodon:// URLs for remote accounts - Present logged-in users with appropriate links (authorize_follows and remote_unfollows) for remote accounts * Do not cache rendered cards if user is logged in	7 years ago
Eugen Rochko	39f27b6cf3	If DEFAULT_LOCALE is set, enforce it instead of HTTP request locale (#6817) ... Fix #6784	7 years ago
Akihiko Odaki	51d760960c	Set the default locale in config (#6580) ... Previously the default locale was set by Localized concern for controllers, but it was not enforced for mailers. config is enforced throughout the application and an appropriate place to set the default locale.	7 years ago
puckipedia	8e4cf6282b	Allow retrieval of private statuses (single or in outbox) using HTTP signatures (#6225)	7 years ago
Eugen Rochko	1cc44cba81	Fix #6331 (#6341) ... UserTrackingConcern is circumvented by SessionsController#create because it calls warden, which calls the User#update_tracked_fields! method directly. Move returning user logic to that method.	7 years ago
Akihiko Odaki	613e7c7521	Rename ResolveRemoteAccountService to ResolveAccountService (#6327) ... The service used to be named ResolveRemoteAccountService resolves local accounts as well.	7 years ago
Eugen Rochko	9b3b40df66	Fix regeneration marker not expiring (#6290) ... * Fix regeneration key not getting expired * Add rake task to remove old regeneration markers	7 years ago
Eugen Rochko	38fc1b498d	Add more instance stats APIs (#6125) ... * Add GET /api/v1/instance/peers API to reveal known domains * Add GET /api/v1/instance/activity API * Make new APIs disableable, exclude private statuses from activity stats * Fix code style issue * Fix week timestamps	7 years ago
Eugen Rochko	feed07227b	Apply a 25x rate limit by IP even to authenticated requests (#5948)	7 years ago
Eugen Rochko	a865b62efc	Rate limit by user instead of IP when API user is authenticated (#5923) ... * Fix #668 - Rate limit by user instead of IP when API user is authenticated * Fix code style issue * Use request decorator provided by Doorkeeper	7 years ago
Eugen Rochko	e84fecb7e9	Add logging of admin actions (#5757) ... * Add logging of admin actions * Update brakeman whitelist * Log creates, updates and destroys with history of changes * i18n: Update Polish translation (#5782) Signed-off-by: Marcin Mikołajczak <me@m4sk.in> * Split admin navigation into moderation and administration * Redesign audit log page * 🇵🇱 (#5795) * Add color coding to audit log * Change dismiss->resolve, log all outcomes of report as resolve * Update terminology (e-mail blacklist) (#5796) * Update terminology (e-mail blacklist) imho looks better * Update en.yml * Fix code style issues * i18n-tasks normalize	7 years ago
Eugen Rochko	7bb8b0b2fc	Add moderator role and add pundit policies for admin actions (#5635) ... * Add moderator role and add pundit policies for admin actions * Add rake task for turning user into mod and revoking it again * Fix handling of unauthorized exception * Deliver new report e-mails to staff, not just admins * Add promote/demote to admin UI, hide some actions conditionally * Fix unused i18n	7 years ago
Eugen Rochko	b8db386e05	Fix UserTrackingConcern firing on every request, optimize some queries (#5368) ... - For some reason, :if option on before_action did not work. It got executed every time, returned false, and the action run anyway, which led to the current_sign_in_at and sign_in_count being updated on every request - Return "do not filter" early in FeedManager#filter_from_home? if the status is authored by receiver. Usually this method is not called for own statuses at all, but it is called when Feed#get uses the database - Return early if #reload_stale_associations! has nothing to load to save a database query with WHERE 1=0	7 years ago
Akihiko Odaki	63f0979799	Validate id of ActivityPub representations (#5114) ... Additionally, ActivityPub::FetchRemoteStatusService no longer parses activities. OStatus::Activity::Creation no longer delegates to ActivityPub because the provided ActivityPub representations are not signed while OStatus representations are.	7 years ago
ThibG	dfaa219f88	Fix HTTP responses for salmon and ActivityPub inbox processing (#5200) ... * Return sensible HTTP status for ActivityPub inbox processing * Return sensible HTTP status for salmon slap processing * Return additional information to debug signature verification failures	7 years ago
Eugen Rochko	76f360c625	If HTTP signature is wrong and webfinger cache is stale, retry with resolve (#5129) ... If the signature could not be verified and the webfinger of the account was last retrieved longer than the cache period, try re-resolving the account and then attempting to verify the signature again	7 years ago
Eugen Rochko	72bb3e03fd	Support more variations of ActivityPub keyId in signature (#4630) ... - Tries to avoid performing HTTP request if the keyId is an actor URI - Likewise if the URI is a fragment URI on top of actor URI - Resolves public key, returns owner if the owner links back to the key	8 years ago
Eugen Rochko	a2aeacbfee	Add alternate links to ActivityPub resources from HTML/HEAD variants (#4586)	8 years ago
Eugen Rochko	fdea173237	Add Digest header to requests with body, handle acct and URI keyId (#4565)	8 years ago
Eugen Rochko	1618b68bfa	HTTP signatures (#4146) ... * Add Request class with HTTP signature generator Spec: https://tools.ietf.org/html/draft-cavage-http-signatures-06 * Add HTTP signature verification concern * Add test for SignatureVerification concern * Add basic test for Request class * Make PuSH subscribe/unsubscribe requests use new Request class Accidentally fix lease_seconds not being set and sent properly, and change the new minimum subscription duration to 1 day * Make all PuSH workers use new Request class * Make Salmon sender use new Request class * Make FetchLinkService use new Request class * Make FetchAtomService use the new Request class * Make Remotable use the new Request class * Make ResolveRemoteAccountService use the new Request class * Add more tests * Allow +-30 seconds window for signed request to remain valid * Disable time window validation for signed requests, restore 7 days as PuSH subscription duration (which was previous default due to a bug)	8 years ago
Eugen Rochko	dc8a6244fc	Fix #2619 - When redis feed is empty, fall back to database (#3721) ... * Fix #2619 - When redis feed is empty, fall back to database * Use redis value to return feed from database only while RegenerationWorker hasn't finished running * Fix specs * Replace usage of reject!	8 years ago
Akihiko Odaki (@fn_aki@pawoo.net)	4919b89ab8	Improve default language decision and spec (#3351) ... * Improve default language decision This change allows to takes account of accepted language determined by the user agent even if the custom default locale of the instance is configured. * Cover Localized more * Fix code style	8 years ago
Matt Jankowski	f0634ba876	Coverage improvement and concern extraction for rate limit headers in API controller (#3625) ... * Coverage for rate limit headers * Move rate limit headers methods to concern * Move throttle check to condition on before_action * Move match_data variable into method * Move utc timestamp to separate method * Move header setting into smaller methods * specs cleanup	8 years ago
Matt Jankowski	0ebe7d6d23	Remove exports/base controller in favor of shared concern (#3444)	8 years ago
Jack Jennings	3a2003ba86	Extract authorization policy for viewing statuses (#3150)	8 years ago
Akihiko Odaki	922fb74197	Remove methods from ObfuscateFilename and spec (#3347) ... * Remove methods from ObfuscateFilename * Spec ObfuscateFilename	8 years ago
HANATANI Takuma	388e70b881	Remove unnecessary keep file. (#2902)	8 years ago
yhirano	3988f2dade	Fix Rubocop offences (#2630) ... * disable Bundler/OrderedGems * fix rubocop Lint/UselessAssignment * fix rubocop Style/BlockDelimiters * fix rubocop Style/AlignHash * fix rubocop Style/AlignParameters, Style/EachWithObject * fix rubocop Style/SpaceInLambdaLiteral	8 years ago
Matt Jankowski	fdcf884cf7	Extract user tracking into concern (#2600)	8 years ago
alpaca-tc	9317ec8eb1	Localize with i18n for Devise::FailureApp (#2309) ... This PR fixes I18n.locale for rake middlewares. Mastodon uses Devise that depends on Warden. Warden::Manager can be found in rake middleware. It is outside of the controller. In the case of authentication failed, warden calls throw(:warden). At the time Warden::Manager delegates request to failure_app to generate response and flash[:alert] after catching it. Unfortunately, I18n.locale is already reset then because I18n.with_locale is enabled only inside the controller. If we used I18n.locale=, Devise::FailureApp could get the current locale.	8 years ago
Matt Jankowski	8bac0350d1	Restful refactor of accounts/ routes (#2133) ... * Add routing specs for accounts followers and following actions * Use more restful route naming for public account follow pages Moves two actions: - accounts#followers to accounts/follower_accounts#index - accounts#following to accounts/following_accounts#index Adds routing spec to ensure prior URLs are preserved.	8 years ago
Matt Jankowski	f5cd138323	Improve i18n chooser (#1804) ... * Add locale spec with failing locale plus region check * Use a more accurate locale when supplied by browser headers Previously we were using a matching option which would use the first locale available which matched the locale portion, even if a region was specified. This changes to first try to find an exact match, and then fall back to the region, and then fall back to the default. * Clean up default_locale method	8 years ago
Matt Jankowski	c44a700252	Quick best practice cleanup of views/helpers (#1546) ... * Remove trailing whitespace * Use query methods instead of explicit .blank? checks	8 years ago
David Authier	f0bd439486	Use HTTP Accept-Language to detect locale (#1166) ... * Use HTTP Accept-Language to detect locale * Fix gem order to comply with codeclimate * Sort gem to comply with rubocop * I18n.default_locale fallback when there is no accept-language header	8 years ago
Eugen Rochko	4b621188ad	Fix #1165 - before_action was called before protect_from_forgery	8 years ago
Eugen Rochko	e3a3422a65	Allow setting of default language through config ... Setting of locale in controller extracted to Localized concern, the doorkeeper authorized applications controller moved under custom namespace with inclusion of Localized, which resolves the "it sometimes appears in a different random language" bug	8 years ago
Eugen Rochko	02349b3269	Obfuscate filenames better, double rate limits	8 years ago
Eugen Rochko	149887a0ff	Make follow requests federate	8 years ago
Eugen Rochko	14bd46946d	Per-status control for unlisted mode, also federation for unlisted mode ... Fix #233, fix #268	8 years ago
Eugen Rochko	9c4856bdb1	Initial commit	9 years ago