961 Commits (99adf00d111540f3b3ef7c3b00c23264e46941fa)

Author	SHA1	Message	Date
Eugen Rochko	b851456139	Remove Atom feeds and old URLs in the form of `GET /:username/updates/:id` (#11247)	6 years ago
Eugen Rochko	23aeef52cc	Remove Salmon and PubSubHubbub (#11205) ... * Remove Salmon and PubSubHubbub endpoints * Add error when trying to follow OStatus accounts * Fix new accounts not being created in ResolveAccountService	6 years ago
Eugen Rochko	0c1b1069c9	Remove deprecated REST API `GET /api/v1/statuses/:id/card` (#11213)	7 years ago
Eugen Rochko	3fd6ab99e6	Remove deprecated REST API `GET /api/v1/timelines/direct` (#11212)	7 years ago
Eugen Rochko	e64e6a03dd	Add categories for custom emojis (#11196) ... Fix #7940	7 years ago
ThibG	3086c645fd	Add option to disable blurhash previews (#11188) ... * Add option to disable blurhash previews * Update option text * Change options order	7 years ago
Eugen Rochko	6836587117	Fix unnecessary SQL query performed on unauthenticated requests (#11179)	7 years ago
Eugen Rochko	707ddf7808	Change domain blocks to automatically support subdomains (#11138) ... * Change domain blocks to automatically support subdomains If a more authoritative domain is blocked (example.com), then the same block will be applied to a subdomain (foo.example.com) * Match subdomains of existing accounts when blocking/unblocking domains * Improve code style	7 years ago
Eugen Rochko	7696f77245	Add moderation API (#9387) ... Fix #8580 Fix #7143	7 years ago
Acid Chicken (硫酸鶏)	33144e132d	Fix layout of identity proofs settings (#11126)	7 years ago
Eugen Rochko	f7f23b4a19	Add audio uploads (#11123) ... * Add audio uploads Fix #4827 Accept uploads of OGG, WAV, FLAC, OPUS and MP3 files, and converts them to OGG. Media attachments get a new `audio` type. In the UI, audio uploads are displayed identically to video uploads. * Improve code style	7 years ago
Eugen Rochko	8514ef723c	Fix login sometimes redirecting to paths that are not pages (#11019) ... Fix #11016	7 years ago
Eugen Rochko	560ec24e58	Change /settings/preferences to redirect to appearance, add /settings/preferences/other (#10988)	7 years ago
Eugen Rochko	1db4117030	Change preferences page into appearance, notifications, and other (#10977)	7 years ago
Eugen Rochko	a60364ca7d	Add waiting time to list of pending accounts in admin UI (#10985)	7 years ago
ThibG	cac9110533	Cleanup various controllers (#10972) ... * Remove skip_session! as it is not supported in Rails 5 * Minor cleanup in StreamEntriesController * Remove redundant mark_cacheable! calls	7 years ago
ThibG	7fa23ec697	Fix potential private status leak (#10969)	7 years ago
Eugen Rochko	48fee1a800	Fix poll API not requiring authentication on non-public polls (#10960) ... * Fix poll API not requiring authentication on non-public polls That API does not reveal the content of the status, i.e. the question itself, nor who the author is, nor which status it belongs to, but it does reveal the poll options and how many answers they got Fix #10959 * Add test	7 years ago
ThibG	fe3b863926	Fix web push notifications for polls (#10864) ... Fixes #10861	7 years ago
Eugen Rochko	1e5532e693	Add responsive panels to the single-column layout (#10820) ... * Add responsive panels to the single-column layout * Fixes * Fix not being able to save the preference * Fix code style issues * Set max-height on the compose textarea and add a link to relationship manager	7 years ago
ThibG	89d600bedb	Move signature verification stoplight to the requests themselves (#10813) ... * Move signature verification stoplight to the requests themselves This avoids blocking messages from known keys for 5 minutes when only one fails… * Put the stoplight on the actual client IP, not a potential reverse proxy	7 years ago
Paul Woolcock	0c933c1b8c	Add `account_id` param to `GET /api/v1/notifications` (#10796) ... * Add `from_account` to notifications API this adds the ability to filter notifications by the account they originated from * passing a non-existent user should cause none to be returned * Fix codeclimate warnings * fix more codeclimate warnings * make requested changes: * use account id instead of user@domain * name the param `account_id` instead of `from_account` * Don't use `return` in a lambda	7 years ago
ThibG	14f6ce2885	Record account suspend/silence time and keep track of domain blocks (#10660) ... * Record account suspend/silence time and keep track of domain blocks * Also unblock users who were suspended/silenced before dates were recorded * Add tests * Keep track of suspending date for users suspended through the CLI * Show accurate number of accounts that would be affected by unsuspending an instance * Change migration to set silenced_at and suspended_at * Revert "Also unblock users who were suspended/silenced before dates were recorded" This reverts commit a015c65d2d. * Switch from using suspended and silenced to suspended_at and silenced_at * Add post-deployment migration script to remove `suspended` and `silenced` columns * Use Account#silence! and Account#suspend! instead of updating the underlying property * Add silenced_at and suspended_at migration to post-migration * Change account fabricator to translate suspended and silenced attributes * Minor fixes * Make unblocking domains always retroactive	7 years ago
ThibG	6d44f2441b	Add toot source to delete result to ease Delete & Redraft (#10669) ... * Return Status with raw text in raw_content when deleting a status * Use raw content if available on delete & redraft * Rename raw_content to text; do not serialize formatted content when source is requested	7 years ago
ThibG	26fc21c188	Add some caching for HTML versions of statuses pages (#10701)	7 years ago
ThibG	91634947f8	Explicitly disable storage of REST API results (#10655) ... Fixes #10652	7 years ago
ThibG	011b032300	Provide a link to existing domain block when trying to block an already-blocked domain (#10663) ... * When trying to block an already-blocked domain, provide a link to the block * Fix styling for links in flash messages * Allow blocks to be upgraded but not downgraded	7 years ago
ThibG	21a73c52a7	Check that an invite link is valid before bypassing approval mode (#10657) ... * Check that an invite link is valid before bypassing approval mode Fixes #10656 * Add tests * Only consider valid invite links in registration controller * fixup	7 years ago
Eugen Rochko	f27d709351	Fix not being able to save e-mail preference for new pending accounts (#10622)	7 years ago
Alex Gessner	154106c0c3	compare usernames case-insensitively on new proof creation flow (#10544) ... * compare usernames case-insensitively on new proof creation flow * Fix code style issue	7 years ago
Eugen Rochko	46cb36fd2c	Add invite request to pending account notification e-mail (#10528) ... Fix sorting of the pending accounts page	7 years ago
Eugen Rochko	36b39fbac5	Add preference to disable e-mails about new pending accounts (#10529)	7 years ago
Eugen Rochko	8b69a66380	Add "why do you want to join" field to invite requests (#10524) ... * Add "why do you want to join" field to invite requests Fix #10512 * Remove unused translations * Fix broken registrations when no invite request text is submitted	7 years ago
Eugen Rochko	654f79d2b1	Fix permission denied bug on approve all/reject all pending accounts (#10519)	7 years ago
ThibG	5247ea4efd	Fix batch actions not working on pending accounts (#10508)	7 years ago
Eugen Rochko	67b3b62b98	Improve blocked view of profiles (#10491) ... * Revert "Fix filtering of favourited_by, reblogged_by, followers and following (#10447)" This reverts commit 120544067f. * Revert "Hide blocking accounts from blocked users (#10442)" This reverts commit 62bafa20a1. * Improve blocked view of profiles - Change "You are blocked" to "Profile unavailable" - Hide following/followers in API when blocked - Disable follow button and show "Profile unavailable" on public profile as well	7 years ago
Eugen Rochko	e1d0390e29	Add batch actions for approving and rejecting pending accounts (#10469)	7 years ago
Eugen Rochko	2c63e0292a	Fix admin validation being too strict about usernames (#10449) ... * Fix admin validation being too strict about usernames Fix #10446 * Strip Setting.site_contact_username consistently throughout the codebase	7 years ago
ThibG	cc6e3c3900	Cache featured collections, as well as outbox, followers and following (#10467)	7 years ago
ThibG	62bafa20a1	Hide blocking accounts from blocked users (#10442) ... * Revert "Add indication that you have been blocked in web UI (#10420)" This reverts commit bd02ec6daa. * Revert "Add `blocked_by` relationship to the REST API (#10373)" This reverts commit 9745de883b. * Hide blocking accounts from search results * Filter blocking accouts from account followers * Filter blocking accouts from account's following accounts * Filter blocking accounts from “reblogged by” and “favourited by” lists * Remove blocking account from URL search * Return 410 on trying to fetch user data from a user who blocked us * Return 410 in /api/v1/account/statuses for suspended or blocking accounts * Fix status filtering when performing URL search * Restore some React improvements Restore some cleanup from bd02ec6daa * Refactor by adding `without_blocking` scope	7 years ago
ThibG	68c797bece	Ensure request.body isn't emptied out before signature verification (#10432) ... Fixes #10429	7 years ago
Alex Gessner	69141dca26	squashed identity proof updates (#10375)	7 years ago
Eugen Rochko	08ec7435ce	Add order options to relationship manager UI (#10404)	7 years ago
Eugen Rochko	e117964325	Change icons of features on admin dashboard to remove bias (#10366) ... Red crosses implied that it was bad/unexpected that certain features were not enabled. In reality, they are options, so showing a green or grey power-off icon is more appropriate. Add status of timeline preview as well Fix sample accounts changing too frequently due to wrong query Sample accounts are intended to be sorted by popularity	7 years ago
Eugen Rochko	555c4e11ba	Add validations to admin settings (#10348) ... * Add validations to admin settings - Validate correct HTML markup - Validate presence of contact username & e-mail - Validate that all usernames are valid - Validate that enums have expected values * Fix code style issue * Fix tests	7 years ago
ThibG	2361917944	Mark the 410 gone response for suspended accounts as cachable (#10339) ... This will help a great deal with #9377 when a caching reverse proxy is configured.	7 years ago
ThibG	66d9452092	Do not try fetching keys of unknown accounts on a Delete from them (#10326)	7 years ago
ThibG	1217185cfa	Do not distribute Delete when rejecting unapproved accounts (#10321)	7 years ago
Eugen Rochko	9c4cbdbafb	Add Keybase integration (#10297) ... * create account_identity_proofs table * add endpoint for keybase to check local proofs * add async task to update validity and liveness of proofs from keybase * first pass keybase proof CRUD * second pass keybase proof creation * clean up proof list and add badges * add avatar url to keybase api * Always highlight the “Identity Proofs” navigation item when interacting with proofs. * Update translations. * Add profile URL. * Reorder proofs. * Add proofs to bio. * Update settings/identity_proofs front-end. * Use `link_to`. * Only encode query params if they exist. URLs without params had a trailing `?`. * Only show live proofs. * change valid to active in proof list and update liveness before displaying * minor fixes * add keybase config at well-known path * extremely naive feature flagging off the identity proof UI * fixes for rubocop * make identity proofs page resilient to potential keybase issues * normalize i18n * tweaks for brakeman * remove two unused translations * cleanup and add more localizations * make keybase_contacts an admin setting * fix ExternalProofService my_domain * use Addressable::URI in identity proofs * use active model serializer for keybase proof config * more cleanup of keybase proof config * rename proof is_valid and is_live to proof_valid and proof_live * cleanup * assorted tweaks for more robust communication with keybase * Clean up * Small fixes * Display verified identity identically to verified links * Clean up unused CSS * Add caching for Keybase avatar URLs * Remove keybase_contacts setting	7 years ago
Eugen Rochko	b8e4c85e69	Add dormant filter to relationship manager, rename other filters (#10308) ... Rename "abandoned" to "moved", and "active" to "primary"	7 years ago
Ben Lubar	c3d1594576	Reduce server load caused by anonymous viewing. (#9059) ... Do not start a session if the current user is not logged in for public-facing pages. Mark pages that don't care about sessions as publicly cacheable. Keep the max age as 0 so proxies and browsers will still try to retrieve an updated version but can still fall back to the stale version if the site is down or too slow. Fixes #9035.	7 years ago
Eugen Rochko	1c113fd72d	Add relationship manager UI (#10268)	7 years ago
Eugen Rochko	ba84b6d4d7	Add `visibility` param to reblog REST API (#9851) ... Use async worker for creating reblog notification to improve performance	7 years ago
Eugen Rochko	d94e21f933	Add a preferences API so apps can share basic behaviours (#10109)	7 years ago
Eugen Rochko	51e154f5e8	Admission-based registrations mode (#10250) ... Fix #6856 Fix #6951	7 years ago
Eugen Rochko	06663fcf87	Fix `tagged` param not being normalized before querying tags (#10249)	7 years ago
Eugen Rochko	65fffeac3f	Redesign landing page (#10232)	7 years ago
ThibG	5506b9406d	Avoid race conditions when creating backups (#10234) ... Under load, multiple backups for a single user could be planned, which is very expensive.	7 years ago
Eugen Rochko	230a012f00	Add polls (#10111) ... * Add polls Fix #1629 * Add tests * Fixes * Change API for creating polls * Use name instead of content for votes * Remove poll validation for remote polls * Add polls to public pages * When updating the poll, update options just in case they were changed * Fix public pages showing both poll and other media	7 years ago
ThibG	d8498b3983	Give the `replies` collection an identifier and enable pagination (#10128)	7 years ago
abcang	a5e7ada62f	Improve account media query (#10121)	7 years ago
Eugen Rochko	e7f20cc43f	Add type, limit, offset, min_id, max_id, account_id to search API (#10091) ... * Add type, limit, offset, min_id, max_id, account_id to search API Fix #8939 * Make the offset work on accounts and hashtags search as well * Assure brakeman we are not doing mass assignment here * Do not allow paginating unless a type is chosen * Fix search query and index id field on statuses instead of created_at	7 years ago
Hinaloe	d7ad42a888	Randomize emoji filename (#10090)	7 years ago
ThibG	738c034213	Do not error out when performing admin actions on no statuses (#10094) ... Same as #8220 but for reports	7 years ago
ThibG	6840a77711	Add domain search/filter to the "Federation" (/admin/instances) page (#10071)	7 years ago
Eugen Rochko	cc84a407f4	Add vapid_key to the application entity in the REST API (#10058) ... Fix #8785	7 years ago
ThibG	67215692fc	Save IP address used for sign-up, not only sign-in (#10026) ... Fixes #9995	7 years ago
Takeshi Umeda	5bffb53a76	Fix it as tagged_request of accounts_controller is not addressable_uri (#9976)	7 years ago
Eugen Rochko	2557cb2f95	Fix pinned statuses being shown in a featured hashtag (#9971)	7 years ago
rinsuki	88f35f339d	Fix authorized applications list page design (#9969)	7 years ago
Eugen Rochko	364f2ff9aa	Add featured hashtags to profiles (#9755) ... * Add hashtag filter to profiles GET /@:username/tagged/:hashtag GET /api/v1/accounts/:id/statuses?tagged=:hashtag * Display featured hashtags on public profile * Use separate model for featured tags * Update featured hashtag counters on-write * Limit featured tags to 10	7 years ago
ThibG	ed30110618	Make displaying application used to toot opt-in (#9897) ... * Make storing and displaying application used to toot opt-in * Revert to storing application info, and display it to the author via API	7 years ago
Eugen Rochko	6b91da97bb	Fix directory showing tags that have no currently eligible accounts (#9872)	7 years ago
Eugen Rochko	32daecffef	Fix REST API showing non-public reblogs for a given status (#9850)	7 years ago
Eugen Rochko	bc642ac24b	Redesign public hashtag page to use a masonry layout (#9822)	7 years ago
Eugen Rochko	1c6588accc	Redesign admin instances area (#9645)	7 years ago
ThibG	28b482874a	Improvements to signature verification (#9667) ... * Refactor signature verification a bit * Rescue signature verification if recorded public key is invalid Fixes #8822 * Always re-fetch AP signing key when HTTP Signature verification fails But when the account is not marked as stale, avoid fetching collections and media, and avoid webfinger round-trip. * Apply stoplight to key/account update as well as initial key retrieval	7 years ago
Eugen Rochko	5654535728	Change remote interaction dialog to use specific actions (#9743) ... * Change remote interaction dialog to use specific actions Instead of just "interact", use different strings based on whether it's a reply, reblog or favourite. Add explanation why the step is necessary in the first place * Remove obsolete strings	7 years ago
Eugen Rochko	43c61bca60	Add locale param to sign-up API (#9747) ... Fix #9627	7 years ago
Eugen Rochko	5dbe186585	Add cache to custom emojis API (#9732) ... Fix #9729	7 years ago
Eugen Rochko	a49d43d112	Add scheduled statuses (#9706) ... Fix #340	7 years ago
ThibG	6f9a7bd02c	Add quick links to the admin interface in the WebUI (#8545) ... * Allow to show a specific status in the admin interface * Let the front-end know the current account is a moderator * Add admin links to status and account menus If the current logged-in user is an admin, add quick links to the admin interface in account and toot dropdown menu. Suggestion by @ashkitten * Use @statuses.first instead of @statuses[0]	7 years ago
Eugen Rochko	82ef5c0461	Fix list of local followers showing remote followers in admin UI (#9700)	7 years ago
Eugen Rochko	7fc7437d05	Add CSV export for lists and domain blocks (#9677) ... Fix #6893 Fix #9268	7 years ago
Eugen Rochko	6e49907ecf	Improve admin UI for account view (#9643)	7 years ago
chr v1.x	c3465f699e	Add local followers page to admin account UI (#9610) ... * Add local followers page to admin account UI For moderation, I often find myself wondering who, locally, is following a remote user. Currently, to see this, I have to go back to the web UI, paste in their full handle, click their profile, and go to the "Followers" tab (plus, this information is incidental, and if mastodon ever decides to resolve all of the follower information, there will be no place local followers are shown). This PR adds a new page which is accessible via the "following" count on the admin's account view page, which shows the local followers. (It has filter parameters for account location to indicate that only local followers are shown, and leave room for expansion if mastodon ever decides to store the entire remote follow list). * Normalize en.yml	7 years ago
Eugen Rochko	ee1ba59692	Add exclude_reblogs option to account statuses API (#9640) ... Fix #9606	7 years ago
Eugen Rochko	9b8c7a9aad	Redirect to reports overview instead of report after account action (#9639)	7 years ago
ThibG	4423999609	Fix account unsilencing and unsuspension (#9637) ... Fix regression from 3c033c4352	7 years ago
Eugen Rochko	17cd91c777	Fix signature verification stoplight triggering on non-timeout errors (#9617)	7 years ago
Takeshi Umeda	bf70e5cfda	Add error message with invalid email confirmation (#9625)	7 years ago
Eugen Rochko	5d2fc6de32	Add REST API for creating an account (#9572) ... * Add REST API for creating an account The method is available to apps with a token obtained via the client credentials grant. It creates a user and account records, as well as an access token for the app that initiated the request. The user is unconfirmed, and an e-mail is sent as usual. The method returns the access token, which the app should save for later. The REST API is not available to users with unconfirmed accounts, so the app must be smart to wait for the user to click a link in their e-mail inbox. The method is rate-limited by IP to 5 requests per 30 minutes. * Redirect users back to app from confirmation if they were created with an app * Add tests * Return 403 on the method if registrations are not open * Require agreement param to be true in the API when creating an account	7 years ago
ThibG	e25947db4a	Sanitize and sandbox toot embeds (#9552)	7 years ago
Eugen Rochko	59e333385b	Show 40 profiles per directory page instead of 30 (#9609) ... To better align with the list of hashtags	7 years ago
Eugen Rochko	3c033c4352	Add moderation warnings (#9519) ... * Add moderation warnings Replace individual routes for disabling, silencing, and suspending a user, as well as the report update route, with a unified account action controller that allows you to select an action (none, disable, silence, suspend) as well as whether it should generate an e-mail notification with optional custom text. That notification, with the optional custom text, is saved as a warning. Additionally, there are warning presets you can configure to save time when performing the above. * Use Account#local_username_and_domain	7 years ago
Eugen Rochko	108b2139cd	Allow unauthenticated REST API access to GET /api/v1/accounts/:id/statuses (#9573) ... Fix #7087 The same data is available over the ActivityPub outbox, RSS, and Atom, so there is little benefit to keeping it limited in this method.	7 years ago
jomo	2c1a6f746f	fix CSP / X-Frame-Options for media embeds (#9558)	7 years ago
ysksn	3281df0df1	Move #set_user to Admin::BaseController (#9470) ... * Move #set_user to Admin::BaseController * Rename Admin::TwoFactorAuthenticationsController from `#set_user` to `#set_target_user` .	7 years ago
Eugen Rochko	087e118971	Remove "most popular" tab from profile directory, add responsive design (#9539) ... * Remove "most popular" tab from profile directory, add responsive design * Remove unused translations	7 years ago
ysksn	b048926e67	Create Settings::BaseController (#9507) ... Define `Settings::BaseController#set_body_classes` so that sub classes inherit `Settings::BaseController` don't need to define `#set_body_classes` agein.	7 years ago
ThibG	cf6ee4ff24	Add admin ability to remove an user's header image (#9495) ... * Fix markup in admin/accounts/:id table for avatar * Add admin ability to remove an user's header image	7 years ago
ThibG	720daa8143	Add instance-wide setting to disable profile directory (#9497) ... * Add instance-wide setting to disable profile directory Fixes #9496 When the profile directory is disabled: - The “discoverable” setting is hidden from users - The “profile directory” link is not shown on public pages - /explore returns 404 * Move Setting.profile_directory check to a before_action filter	7 years ago
ysksn	ed24bb2c3e	Add specs for activitypub collections controller (#9484) ... * Add specs for ActivityPub::CollectionsController#show * Raise ActiveRecord::RecordNotFound Raising ActiveRecord::NotFound raises NameError: uninitialized constant ActiveRecord::NotFound.	7 years ago
ysksn	189a6b17fb	Remove RemoteAccountControllerConcern never used (#9482)	7 years ago
ysksn	361818e931	Fix Admin::TagsController#unhide (#9481)	7 years ago
ThibG	81bda7d67c	Add setting to not aggregate reblogs (#9248) ... * Add setting to not aggregate reblogs Fixes #9222 * Handle cases where user is nil in add_to_home and add_to_list * Add hint for setting_aggregate_reblogs option * Reword setting_aggregate_reblogs label	7 years ago
Eugen Rochko	73be8f38c1	Add profile directory (#9427) ... Fix #5578	7 years ago
ThibG	e88c6a5c3c	Fix thread depth computation in statuses_controller (#9426) ... * Add test that should currently fail * Fix depth computation (will still fail if statuses have been filtered out) * Fix handling of broken threads	7 years ago
Eugen Rochko	73faadad28	Redesign admin accounts index (#9340) ... * Improve overview of accounts in admin UI - Display suspended status, role, last activity and IP prominently - Default to showing local accounts - Default to not showing suspended accounts * Remove unused strings * Fix tests * Allow filtering accounts by IP mask	7 years ago
Eugen Rochko	d6b9a62e0a	Extract counters from accounts table to account_stats table (#9295)	7 years ago
Eugen Rochko	8069fd636b	Remove intermediary arrays when creating hash maps from results (#9291)	7 years ago
Eugen Rochko	4615512285	Reduce connect timeout limit and limit signature failures by source IP (#9236) ... * Reduce connect timeout from 10s to 1s * Limit failing signature verifications per source IP	7 years ago
Eugen Rochko	6d59dfa15d	Optimize the process of following someone (#9220) ... * Eliminate extra accounts select query from FollowService * Optimistically update follow state in web UI and hide loading bar Fix #6205 * Asynchronize NotifyService in FollowService And fix failing test * Skip Webfinger resolve routine when called from FollowService if possible If an account is ActivityPub, then webfinger re-resolving is not necessary when called from FollowService. Improve options of ResolveAccountService	7 years ago
James Kiesel	4c03e05a4e	Allow joining several hashtags in a single column (#8904) ... * Nascent tag menu on frontend * Hook up frontend to search * Tag intersection backend first pass * Update yarnlock * WIP * Fix for tags not searching correctly * Make radio buttons function * Simplify radio buttons with modeOption * Better naming * Rearrange options * Add all/any/none functionality on backend * Small PR cleanup * Move to service from scope * Small cleanup, add proper service tests * Don't use send with user input :D * Set appropriate column header * Handle auto updating timeline * Fix up toggle function * Use tag value correctly * A bit more correct to use 'self' rather than 'all' in status scope * Fix some style issues * Fix more code style issues * Style select dropdown more better * Only use to_id'ed value to ensure no SQL injection * Revamp frontend to allow for multiple selects * Update backend / col header to account for more flexible tagging * Update brakeman ignore * Codeclimate suggestions * Fix presenter tag_url * Implement initial PR feedback * Handle additional tag streaming * CodeClimate tweak	7 years ago
Eugen Rochko	5c8e7f0e1d	Revert "feat(auth/session_controller): Send Clear-Site-Data when logging out (8627)" (#9161) ... This reverts commit 10680f93e7.	7 years ago
Eugen Rochko	795f0107d2	Include preview cards in status entity in REST API (#9120) ... * Include preview cards in status entity in REST API * Display preview card in-stream * Improve in-stream display of preview cards	7 years ago
ThibG	215e649391	Fix styling in /auth/edit (#9117)	7 years ago
Eugen Rochko	d4cf963749	Allow inbox owner to view implicitly targeted ActivityPub payload (#9093) ... Fix #9091	7 years ago
Yamagishi Kazutoshi	e8ffecbd36	Set @body_classes to admin layout (#9081)	7 years ago
Eugen Rochko	fd5285658f	Add option to block reports from domain (#8830)	7 years ago
Eugen Rochko	9486f0ca77	Add "disable" button to report screen (#9024) ... * Add "disable" button to report screen * i18n-tasks remove-unused	7 years ago
Eugen Rochko	a38a452481	Add unread indicator to conversations (#9009)	7 years ago
Eugen Rochko	21ad21cb50	Improve signature verification safeguards (#8959) ... * Downcase signed_headers string before building the signed string The HTTP Signatures draft does not mandate the “headers” field to be downcased, but mandates the header field names to be downcased in the signed string, which means that prior to this patch, Mastodon could fail to process signatures from some compliant clients. It also means that it would not actually check the Digest of non-compliant clients that wouldn't use a lowercased Digest field name. Thankfully, I don't know of any such client. * Revert "Remove dead code (#8919)" This reverts commit a00ce8c92c. * Restore time window checking, change it to 12 hours By checking the Date header, we can prevent replaying old vulnerable signatures. The focus is to prevent replaying old vulnerable requests from software that has been fixed in the meantime, so a somewhat long window should be fine and accounts for timezone misconfiguration. * Escape users' URLs when formatting them Fixes possible HTML injection * Escape all string interpolations in Formatter class Slightly improve performance by reducing class allocations from repeated Formatter#encode calls * Fix code style issues	7 years ago
ThibG	2d27c11061	Set Content-Security-Policy rules through RoR's config (#8957) ... * Set CSP rules in RoR's configuration * Override CSP setting in the embed controller to allow frames	7 years ago
Eugen Rochko	a00ce8c92c	Remove dead code (#8919) ... SignatureVerification#matches_time_window? is not called anywhere.	7 years ago
ashleyhull-versent	2dba313100	Replace SVG asset with Custom mascot (#8766)	7 years ago
Eugen Rochko	774ac47373	Add conversations API (#8832) ... * Add conversations API * Add web UI for conversations * Add test for conversations API * Add tests for ConversationAccount * Improve web UI * Rename ConversationAccount to AccountConversation * Remove conversations on block and mute * Change last_status_id to be a denormalization of status_ids * Add optimistic locking	7 years ago
ThibG	25744d43b0	Ensure only toots from the reported users are reported (#8916)	7 years ago
Eugen Rochko	e645ae9561	Change admin accounts default sort to most recent (#8813)	7 years ago
Eugen Rochko	f0fff3eb10	Support min_id-based pagination in REST API (#8736) ... * Allow min_id pagination in Feed#get * Add min_id pagination to home and list timeline APIs * Add min_id pagination to account statuses, public and tag APIs * Remove unused stub in reports API * Use min_id pagination in notifications, favourites, and fix order * Fix HomeFeed#from_database not using paginate_by_id	7 years ago
ふぁぼ原	f7a6f9489d	Add a new preference to always hide all media (#8569)	7 years ago
Yamagishi Kazutoshi	86f138ed16	Cache instance info (#8765)	7 years ago
Matt Sweetman	1889526e23	Add user preference to always expand toots marked with content warnings (#8762)	7 years ago
luzpaz	40dd19be37	Misc. typos (#8694) ... Found via `codespell -q 3 --skip="./app/javascript/mastodon/locales,./config/locales"`	7 years ago
Eugen Rochko	2288d50a7b	Add force_login option to OAuth authorize page (#8655) ... * Add force_login option to OAuth authorize page For when a user needs to sign into an app from multiple accounts on the same server * When logging out from modal header, redirect back after re-login	7 years ago
Sorin Davidoi	10680f93e7	feat(auth/session_controller): Send Clear-Site-Data when logging out (#8627) ... Will clear the browser's cache, cookies and storage. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data https://w3c.github.io/webappsec-clear-site-data/	7 years ago
Eugen Rochko	075e162319	Whitelist report notification param in Settings::NotificationsController (#8560) ... Bug in #8559	7 years ago
Eugen Rochko	c593d6df9c	Add preference for report notification e-mails, skip for duplicates (#8559) ... If an unresolved report for the same target account already exists, no new notification is generated	7 years ago
ThibG	0b62585748	Self-notify on accepting follow requests (#8541)	7 years ago
Renato "Lond" Cerqueira	11658d8653	Add animate custom emoji param to embed pages (#8507) ... * Add animate custom emoji param to embed pages * Rename param, use it for avatars and gifs * Fix issues pointed by codeclimate and breaking test * Ignore brakeman warning	7 years ago
Jakub Mendyk	f3a12ddfd0	Make Api::V1::MutesController paginate properly (#8472) ... Fixes #8463	7 years ago
Quint Guvernator	da13fa5021	Fix low-hanging rubocop gripes (#8458) ... * rubocop: quit being so picky * rubocop: miscellany * rubocop: prefer present to blank	7 years ago
Eugen Rochko	a2cabf3f4a	Add admin custom CSS setting (#8399) ... Fix #3894	7 years ago
Eugen Rochko	2f34b747b3	Allow mods to disable login, improve message when login disabled (#8329) ... * Allow moderators to disable/enable login * Instead of rejecting login, show forbidden error when login disabled Avoid confusion because when login is rejected, the message is that the account is not activated, which is wrong. * Fix tests	7 years ago
Eugen Rochko	9d58daac6c	Fix regression when suspending not from report (#8400) ... Regression from #8353	7 years ago
Jakub Mendyk	6cb3514d64	Add ability to change an instance default theme from the administration panel (#7092) (#8381) ... * Add default_settings class method to ScopedSettings ScopedSettings was extended to use value of unscoped setting instead of only using defaults set in config/settings.yml for selected settings. This adds possibility for admins to set default values of users' settings, for example default theme (as requested in #7092). * Add ability to change an instance default theme Closes #7092	7 years ago
Eugen Rochko	2374a00c10	Add confirmation step to account suspensions (#8353) ... * Add confirmation page for suspensions * Suspension confirmation closes reports, linked from report UI * Fix tests	7 years ago
ThibG	b34d6238cb	Add API endpoint to list featured accounts (fixes #8315) (#8317)	7 years ago
abcang	9e75aa30cd	Unuse ActiveRecord::Base#cache_key (#8185) ... * Unuse ActiveRecord::Base#cache_key * Enable cache_versioning * Call cache_collection	7 years ago
Eugen Rochko	9dd5639f90	Add admin function to deactivate all invites (#8279) ... Fix #8261	7 years ago