mastodon

Commit Graph

Author	SHA1	Message	Date
ThibG	47e507fa61	Add ability to require invite request text (#15326 ) Fixes #15273 Co-authored-by: Claire <claire.github-309c@sitedethib.com>	4 years ago
Eugen Rochko	216b85b053	Fix performance on instances list in admin UI (#15282 ) - Reduce duplicate queries - Remove n+1 queries - Add accounts count to detailed view - Add separate action log entry for updating existing domain blocks	4 years ago
Eugen Rochko	a3b5675aa8	Change number format on about page from full to shortened (#15327 )	4 years ago
ThibG	49eb4d4ddf	Add honeypot fields and minimum fill-out time for sign-up form (#15276 ) * Add honeypot fields to limit non-specialized spam Add two honeypot fields: a fake website input and a fake password confirmation one. The label/placeholder/aria-label tells not to fill them, and they are hidden in CSS, so legitimate users should not fall into these. This should cut down on some non-Mastodon-specific spambots. * Require a 3 seconds delay before submitting the registration form * Fix tests * Move registration form time check to model validation * Give people a chance to clear the honeypot fields * Refactor honeypot translation strings Co-authored-by: Claire <claire.github-309c@sitedethib.com>	4 years ago
ThibG	d849aad852	Change public thread view to hide "Show thread" link (#15266 ) Fixes #15262	4 years ago
Eugen Rochko	13b07b88f1	Fix omniauth (SAML/CAS) sign-in routes not having CSRF protection (#15228 )	4 years ago
ThibG	96c1e71329	Add import/export feature for bookmarks (#14956 ) * Add ability to export bookmarks * Add support for importing bookmarks * Add bookmark import tests * Add bookmarks export test	4 years ago
Takeshi Umeda	148ce97e21	Add interrelationship icon (#15149 ) * Add interrelationship icon * Fix arrow for rtl * Fix to predefined color	4 years ago
Takeshi Umeda	2b1a6e734f	Add follow selected followers button (#15148 ) * Add follow selected followers button * Fix unused variable * Fix i18n normalize	4 years ago
Eugen Rochko	9b1f2a4b61	Add subresource integrity for JS and CSS assets (#15096 ) Fix #2744	4 years ago
Mélanie Chauvel	68d4b2b83e	Display “Show newer” and “Show older” instead of “Show more” in public pages (#15052 )	4 years ago
Takeshi Umeda	d6fe0c94ca	Add account sensitized (#14361 ) * Add account sensitized * Fix i18n normalize * Fix description and spec * Fix spec * Fix wording	4 years ago
Mélanie Chauvel	1d07f51039	Make visibility icon clickable as part of the time of a toot (#15053 ) - Makes permalink to a toot more easily clickable - Fix clicking between icon and time in fact clicking the display name - Fix clicking slightly under time in fact clicking the display name	4 years ago
ThibG	4c45b43cb8	Change how CDN_HOST is passed down to make assets build reproducible (#14381 ) * Change how CDN_HOST is passed down to make assets build reproducible * Change webpacker/webpack configuration to dynamically load publicPath based on meta header * Fix embedded layout missing the cdn-host meta header	4 years ago
Eugen Rochko	5e1364c448	Add IP-based rules (#14963 )	4 years ago
Eugen Rochko	7d985f2aac	Remove dependency on goldfinger gem (#14919 ) There are edge cases where requests to certain hosts timeout when using the vanilla HTTP.rb gem, which the goldfinger gem uses. Now that we no longer need to support OStatus servers, webfinger logic is so simple that there is no point encapsulating it in a gem, so we can just use our own Request class. With that, we benefit from more robust timeout code and IPv4/IPv6 resolution. Fix #14091	4 years ago
Eugen Rochko	a549415868	Fix regressions in icon buttons in web UI (#14915 )	4 years ago
ThibG	78e45a5285	Add option to disable swiping motions across the WebUI (#13885 ) Fixes #13882	4 years ago
Jeremy Rose	03b6b034b9	add og:published_time to opengraph meta tags (#14865 )	4 years ago
Takeshi Umeda	070026e634	Fix method of the DELETE DATA button (#14855 )	4 years ago
Eugen Rochko	ed099d8bdc	Change account suspensions to be reversible by default (#14726 )	4 years ago
Eugen Rochko	4e4b3a0c8e	Refactor settings controllers (#14767 ) - Disallow suspended accounts from revoking sessions and apps - Allow suspended accounts to access exports	4 years ago
abcang	e79d719e92	Changed tag most_used to recently_used (#14760 )	4 years ago
santiagorodriguez96	e8d41bc2fe	Add WebAuthn as an alternative 2FA method (#14466 ) * feat: add possibility of adding WebAuthn security keys to use as 2FA This adds a basic UI for enabling WebAuthn 2FA. We did a little refactor to the Settings page for editing the 2FA methods – now it will list the methods that are available to the user (TOTP and WebAuthn) and from there they'll be able to add or remove any of them. Also, it's worth mentioning that for enabling WebAuthn it's required to have TOTP enabled, so the first time that you go to the 2FA Settings page, you'll be asked to set it up. This work was inspired by the one donde by Github in their platform, and despite it could be approached in different ways, we decided to go with this one given that we feel that this gives a great UX. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add request for WebAuthn as second factor at login if enabled This commits adds the feature for using WebAuthn as a second factor for login when enabled. If users have WebAuthn enabled, now a page requesting for the use of a WebAuthn credential for log in will appear, although a link redirecting to the old page for logging in using a two-factor code will also be present. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add possibility of deleting WebAuthn Credentials Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: disable WebAuthn when an Admin disables 2FA for a user Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: remove ability to disable TOTP leaving only WebAuthn as 2FA Following examples form other platforms like Github, we decided to make Webauthn 2FA secondary to 2FA with TOTP, so that we removed the possibility of removing TOTP authentication only, leaving users with just WEbAuthn as 2FA. Instead, users will have to click on 'Disable 2FA' in order to remove second factor auth. The reason for WebAuthn being secondary to TOPT is that in that way, users will still be able to log in using their code from their phone's application if they don't have their security keys with them – or maybe even lost them. * We had to change a little the flow for setting up TOTP, given that now it's possible to setting up again if you already had TOTP, in order to let users modify their authenticator app – given that now it's not possible for them to disable TOTP and set it up again with another authenticator app. So, basically, now instead of storing the new `otp_secret` in the user, we store it in the session until the process of set up is finished. This was because, as it was before, when users clicked on 'Edit' in the new two-factor methods lists page, but then went back without finishing the flow, their `otp_secret` had been changed therefore invalidating their previous authenticator app, making them unable to log in again using TOTP. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * refactor: fix eslint errors The PR build was failing given that linting returning some errors. This commit attempts to fix them. * refactor: normalize i18n translations The build was failing given that i18n translations files were not normalized. This commits fixes that. * refactor: avoid having the webauthn gem locked to a specific version * refactor: use symbols for routes without '/' * refactor: avoid sending webauthn disabled email when 2FA is disabled When an admins disable 2FA for users, we were sending two mails to them, one notifying that 2FA was disabled and the other to notify that WebAuthn was disabled. As the second one is redundant since the first email includes it, we can remove it and send just one email to users. * refactor: avoid creating new env variable for webauthn_origin config * refactor: improve flash error messages for webauthn pages Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>	5 years ago
ThibG	62a45ae26e	Fix client-side form validation not accepting handles with uppercase letters (#14599 )	5 years ago
ThibG	0f38f9726a	Fix hardcoded non-breaking space in public view (#14568 )	5 years ago
ThibG	7dc4c74265	Add client-side validation in password change forms (#14564 ) * Fix client-side username validation at registration It used the Account::USERNAME_RE regexp which is for remote users, local user validation is stricter. Also take into account max username length. * Add client-side form validation for password change * Add client-side form validation to dedicated registration form Previous changes only applied to the /about page, not the dedicated form on /auth	5 years ago
ThibG	d70c3ab4c3	Add HTML form validation for the registration form (#14560 ) * Add HTML-level validation of username in sign-up form * Make required fields with incorrect values more visible * Enable HTML form validation for the registration form * Mark agreement checkbox as required client-side * Add minimum length to password * Add client-side password confirmation validation	5 years ago
ThibG	8ce962e148	Fix audio/video player not using CDN_HOST in media paths on public pages (#14486 )	5 years ago
Eugen Rochko	5b7a93b02c	Fix videos on public pages not using custom thumbnails (#14273 )	5 years ago
ThibG	a783bdf4ad	Fix hashtag column options styling (#14247 ) * Enable nonces for stylesheets * Pass nonce to react-select	5 years ago
Eugen Rochko	99f3a55540	Add color extraction for audio thumbnails (#14209 )	5 years ago
ThibG	4babf5b8b5	Fix lock icon not being shown when locking account in profile settings (#14190 )	5 years ago
Eugen Rochko	64aac30733	Add customizable thumbnails for audio and video attachments (#14145 ) - Change audio files to not be stripped of metadata - Automatically extract cover art from audio if it exists - Add `thumbnail` parameter to `POST /api/v1/media`, `POST /api/v2/media` and `PUT /api/v1/media/:id` - Add `icon` to represent it in attachments in ActivityPub - Fix `preview_url` containing URL of missing missing image when there is no thumbnail instead of null - Fix duration of audio not being displayed on public pages until the file is loaded	5 years ago
Mélanie Chauvel	08cf81f8c1	Improve appearence consistency of settings pages (#13938 ) * Fix header button changing header size in settings pages * Make form buttons look more like a part of the form in settings pages - Put buttons closer, using same distance as between inputs - Make buton font size a bit smaller to blend a bit more - Add the class button to button tags for consisent styling	5 years ago
Takeshi Umeda	418f0a33e9	Add a visibility icon to status (#14123 ) * Add a visibility icon to status * Change to using the icon element * Fix RTL * Add a public globe	5 years ago
Eugen Rochko	662a49dc3f	Fix various issues around OpenGraph representation of media (#14133 ) - Fix audio attachments not being represented in OpenGraph tags - Fix audio being represented as "1 image" in OpenGraph descriptions - Fix video metadata being overwritten by paperclip-av-transcoder - Fix embedded player not using Mastodon's UI - Fix audio/video progress bars not moving smoothly - Fix audio/video buffered bars not displaying correctly	5 years ago
Mélanie Chauvel	ac3c83ef6f	Improve wording and add titles on moderated servers section in /about/more (#13930 )	5 years ago
Eugen Rochko	72a7cfaa39	Add e-mail-based sign in challenge for users with disabled 2FA (#14013 )	5 years ago
ThibG	8e96510b25	Hide sensitive preview cards with blurhash (#13985 ) * Use preview card blurhash in WebUI * Handle sensitive preview cards	5 years ago
ThibG	bf6745b9c3	Fix unpermitted operations on custom emojis leading to cryptic errors (#13951 ) * Display appropriate error when performing unpermitted operation on custom emoji Fixes #13897 * Remove links to custom emoji actions not performable by moderators	5 years ago
Mélanie Chauvel	77619b1654	Put “Add new domain block” button on /admin/instances in header (#13934 )	5 years ago
ThibG	48503384d0	Fix some account avatars on public pages having incorrect size (#13692 ) * Fix some account avatars on public pages having incorrect size * Remove outdated and overridden width and height attributes * Remove more hardcoded width/height attributes	5 years ago
Eugen Rochko	8be4c2ba21	Add ability to remove identity proofs from account (#13682 ) Fix #12613	5 years ago
ThibG	e1629a7758	Remove 'unsafe-inline' from Content-Security-Policy style-src (#13679 ) * Make sure wicg-inert doesn't rely on inline CSS * Remove unsafe-inline from style-src	5 years ago
ThibG	c0b849bdfd	Fix use of inline CSS in public pages (#13576 ) Change `account_link_to` to use an image tag rather than some inline CSS. Dropped the `size` parameter in the process, but it wasn't used for anything except the default value of 36px. Dropped CSS rules that were always overriden, and defaulted to 36px width and height instead.	5 years ago
ThibG	b8ba977497	Fix admin-facing uses of inline CSS (#13575 ) * Move .back-button inline styles to CSS file All occurrences of the back-button CSS class used the same inline CSS rules, so moved them over to the CSS file * Fix “Add new domain block” button using inline CSS * Replace common pattern of inline-styled button boxes by a CSS class In particular, switching from `float: left/right` to a flexbox with `justify-content: space-between`. This implied changing the order of a few HTML tags and adding an empty `div` in one case. Also removed a `margin-bottom` rule that wasn't needed due to the margins of surrounding elements. * Move account admin view inline CSS to CSS file	5 years ago
ThibG	0e362b7678	Fix end-user-facing uses of inline CSS (#13438 ) * Move some inline styles to CSS files * Move default_account_display_name span to fix useless tags with duplicate id * Change handling of public pages spoiler text from inline CSS to dataset attribute * Use the `dir` HTML attribute instead of inline CSS * Move status action bar inline CSS to CSS file * Hide logo resources from CSS file, not inline CSS Fixes #11601 * Move translation prompt styling from inline CSS to CSS file * Move “invited by” styling on registration form from inline to CSS file * Use the progress tag to display poll results in JS fallback * Fix poll results JS-less fallback when the user has voted for an option * Change account public page “moved” notice to use img tags instead of inline CSS * Move OTP hint inline CSS to SCSS file * Hide JS-less fallback vote progressbars from accessibility tools Co-authored-by: Eugen Rochko <eugen@zeonfederated.com>	5 years ago
ThibG	b3d0de8b40	Fix /public showing public instead of community timeline for logged-in users (#13499 )	5 years ago
sternenseemann	679980f77c	Allow users to delete their header and avatar (#13234 ) This is achieved by sending a DELETE request to /settings/profile/pictures/{avatar,header} via a link that is part of the upload form's hint of the respective picture.	5 years ago

1 2 3 4 5 ...

1064 Commits (9342705e6bfc4f0e4f999bd3c1bb70d425fcb598)