mastodon

Commit Graph

Author	SHA1	Message	Date
Eugen Rochko	6221b36b27	Remove sign-in token authentication, instead send e-mail about new sign-in (#17970 )	3 years ago
Claire	894956e20c	Fix /api/v1/admin/accounts (#17887 ) * Fix /api/v1/admin/accounts Compatibility was broken since #17009 which changed the underlying filter class without changing the controller. This commits restore support for the old parameters. * Add /api/v2/admin/accounts with the new parameters * Add tests * Add missing filter for `silenced` status Co-authored-by: Eugen Rochko <eugen@zeonfederated.com> Co-authored-by: Eugen Rochko <eugen@zeonfederated.com>	3 years ago
Eugen Rochko	bd53dd5210	Change design of federation pages in admin UI (#17704 ) * Change design of federation pages in admin UI * Fix query performance in instance media attachments measure * Fix reblogs being included in instance languages dimension	3 years ago
Eugen Rochko	edf09ec747	Add `/api/v1/accounts/familiar_followers` to REST API (#17700 ) * Add `/api/v1/accounts/familiar_followers` to REST API * Change hide network preference to be stored consistently for local and remote accounts * Add dummy classes to migration * Apply suggestions from code review Co-authored-by: Claire <claire.github-309c@sitedethib.com> Co-authored-by: Claire <claire.github-309c@sitedethib.com>	3 years ago
Claire	14919fe11e	Change old moderation strikes to be displayed in a separate page (#17566 ) * Change old moderation strikes to be displayed in a separate page Fixes #17552 This changes the moderation strikes displayed on `/auth/edit` to be those from the past 3 months, and make all moderation strikes targeting the current user available in `/disputes`. * Add short description of what the strikes page is for * Move link to list of strikes to “Account status” instead of navigation item * Normalize i18n file * Fix layout and styling of strikes link * Revert highlights_on regexp * Reintroduce account status summary - this way, “Account status” is never empty - account status is not necessarily bound to strikes, or recent strikes	3 years ago
Eugen Rochko	27965ce5ed	Add trending statuses (#17431 ) * Add trending statuses * Fix dangling items with stale scores in localized sets * Various fixes and improvements - Change approve_all/reject_all to approve_accounts/reject_accounts - Change Trends::Query methods to not mutate the original query - Change Trends::Query#skip to offset - Change follow recommendations to be refreshed in a transaction * Add tests for trending statuses filtering behaviour * Fix not applying filtering scope in controller	3 years ago
Eugen Rochko	a29a982eaa	Change e-mail domain blocks to block IPs dynamically (#17635 ) * Change e-mail domain blocks to block IPs dynamically * Update app/workers/scheduler/email_domain_block_refresh_scheduler.rb Co-authored-by: Yamagishi Kazutoshi <ykzts@desire.sh> * Update app/workers/scheduler/email_domain_block_refresh_scheduler.rb Co-authored-by: Yamagishi Kazutoshi <ykzts@desire.sh> Co-authored-by: Yamagishi Kazutoshi <ykzts@desire.sh>	3 years ago
Eugen Rochko	564efd0651	Add appeals (#17364 ) * Add appeals * Add ability to reject appeals and ability to browse pending appeals in admin UI * Add strikes to account page in settings * Various fixes and improvements - Add separate notification setting for appeals, separate from reports - Fix style of links in report/strike header - Change approving an appeal to not restore statuses (due to federation complexities) - Change style of successfully appealed strikes on account settings page - Change account settings page to only show unappealed or recently appealed strikes * Change appealed_at to overruled_at * Fix missing method error	3 years ago
Eugen Rochko	d0fcf07436	Change actions in reports to require only one click (#17487 )	3 years ago
Eugen Rochko	63002cde03	Add editing for published statuses (#17320 ) * Add editing for published statuses * Fix change of multiple-choice boolean in poll not resetting votes * Remove the ability to update existing media attachments for now	3 years ago
Eugen Rochko	1060666c58	Add support for editing for published statuses (#16697 ) * Add support for editing for published statuses * Fix references to stripped-out code * Various fixes and improvements * Further fixes and improvements * Fix updates being potentially sent to unauthorized recipients * Various fixes and improvements * Fix wrong words in test * Fix notifying accounts that were tagged but were not in the audience * Fix mistake	3 years ago
Eugen Rochko	14f436c457	Add notifications for statuses deleted by moderators (#17204 )	3 years ago
Claire	76761d5fc0	Add ability for admins to delete canonical email blocks (#16644 ) * Add admin option to remove canonical email blocks from a deleted account * Add tootctl canonical_email_blocks to inspect and remove canonical email blocks	3 years ago
Claire	7f803c41e2	Add ability to purge undeliverable domains from admin interface (#16686 ) * Add ability to purge undeliverable domains from admin interface * Add tests	3 years ago
Eugen Rochko	0fb9536d38	Add batch suspend for accounts in admin UI (#17009 )	3 years ago
Eugen Rochko	7de0ee7aba	Remove Keybase integration (#17045 )	3 years ago
Eugen Rochko	6e50134a42	Add trending links (#16917 ) * Add trending links * Add overriding specific links trendability * Add link type to preview cards and only trend articles Change trends review notifications from being sent every 5 minutes to being sent every 2 hours Change threshold from 5 unique accounts to 15 unique accounts * Fix tests	3 years ago
Takeshi Umeda	17f4e457b3	Add remove from followers api (#16864 ) * Add followed_by? to account_interactions * Add RemoveFromFollowersService * Fix AccountBatch to use RemoveFromFollowersService * Add remove from followers API	3 years ago
Eugen Rochko	07341e7aa6	Add graphs and retention metrics to admin dashboard (#16829 )	3 years ago
Claire	4ac78e2a06	Add feature to automatically delete old toots (#16529 ) * Add account statuses cleanup policy model * Record last inspected toot to delete to speed up successive calls to statuses_to_delete * Add service to cleanup a given account's statuses within a budget * Add worker to go through account policies and delete old toots * Fix last inspected status id logic All existing statuses older or equal to last inspected status id must be kept by the current policy. This is an invariant that must be kept so that resuming deletion from the last inspected status remains sound. * Add tests * Refactor scheduler and add tests * Add user interface * Add support for discriminating based on boosts/favs * Add UI support for min_reblogs and min_favs, rework UI * Address first round of review comments * Replace Snowflake#id_at_start with with_random parameter * Add tests * Add tests for StatusesCleanupController * Rework settings page * Adjust load-avoiding mechanisms * Please CodeClimate	4 years ago
Eugen Rochko	771c9d4ba8	Add ability to skip sign-in token authentication for specific users (#16427 ) Remove "active within last two weeks" exception for sign in token requirement Change admin reset password to lock access until the password is reset	4 years ago
Eugen Rochko	d174d12c83	Add authentication history (#16408 )	4 years ago
Eugen Rochko	74081433d0	Change trending hashtags to be affected be reblogs (#16164 ) If a status with a hashtag becomes very popular, it stands to reason that the hashtag should have a chance at trending Fix no stats being recorded for hashtags that are not allowed to trend, and stop ignoring bots Remove references to hashtags in profile directory from the code and the admin UI	4 years ago
Takeshi Umeda	7cb34b32f8	Add management of delivery availability in Federation settings (#15771 ) * Add management of delivery availavility in Federation settings * fix translate * Remove useless object creation * Fix DeepSource issue * Add shortcut for all * Fix DeepSource(skipcq) * Change 'remove' to 'clear' * Fix style * Change class method name (exhausted_deliveries_key_by)	4 years ago
Eugen Rochko	f7117646af	Add cold-start follow recommendations (#15945 )	4 years ago
Eugen Rochko	ed7d459d7f	Fix deprecation warning for Sidekiq web session secret (#16009 )	4 years ago
Eugen Rochko	82cce18227	Change health check (#15988 )	4 years ago
Eugen Rochko	ee1119208c	Add `POST /api/v1/emails/confirmations` to REST API (#15816 ) Only available to the application the user originally signed-up with	4 years ago
Eugen Rochko	8331fdf7e0	Add server rules (#15769 )	4 years ago
Eugen Rochko	e31ed27485	Add `GET /api/v1/accounts/lookup` REST API (#15740 )	4 years ago
ThibG	96c1e71329	Add import/export feature for bookmarks (#14956 ) * Add ability to export bookmarks * Add support for importing bookmarks * Add bookmark import tests * Add bookmarks export test	4 years ago
Takeshi Umeda	d6fe0c94ca	Add account sensitized (#14361 ) * Add account sensitized * Fix i18n normalize * Fix description and spec * Fix spec * Fix wording	4 years ago
ThibG	ca56527140	Add follower synchronization mechanism (#14510 ) * Add support for followers synchronization on the receiving end Check the `collectionSynchronization` attribute on `Create` and `Announce` activities and synchronize followers from provided collection if possible. * Add tests for followers synchronization on the receiving end * Add support for follower synchronization on the sender's end * Add tests for the sending end * Switch from AS attributes to HTTP header Replace the custom `collectionSynchronization` ActivityStreams attribute by an HTTP header (`X-AS-Collection-Synchronization`) with the same syntax as the `Signature` header and the following fields: - `collectionId` to specify which collection to synchronize - `digest` for the SHA256 hex-digest of the list of followers known on the receiving instance (where “receiving instance” is determined by accounts sharing the same host name for their ActivityPub actor `id`) - `url` of a collection that should be fetched by the instance actor Internally, move away from the webfinger-based `domain` attribute and use account `uri` prefix to group accounts. * Add environment variable to disable followers synchronization Since the whole mechanism relies on some new preconditions that, in some extremely rare cases, might not be met, add an environment variable (DISABLE_FOLLOWERS_SYNCHRONIZATION) to disable the mechanism altogether and avoid followers being incorrectly removed. The current conditions are: 1. all managed accounts' actor `id` and inbox URL have the same URI scheme and netloc. 2. all accounts whose actor `id` or inbox URL share the same URI scheme and netloc as a managed account must be managed by the same Mastodon instance as well. As far as Mastodon is concerned, breaking those preconditions require extensive configuration changes in the reverse proxy and might also cause other issues. Therefore, this environment variable provides a way out for people with highly unusual configurations, and can be safely ignored for the overwhelming majority of Mastodon administrators. * Only set follower synchronization header on non-public statuses This is to avoid unnecessary computations and allow Follow-related activities to be handled by the usual codepath instead of going through the synchronization mechanism (otherwise, any Follow/Undo/Accept activity would trigger the synchronization mechanism even if processing the activity itself would be enough to re-introduce synchronization) * Change how ActivityPub::SynchronizeFollowersService handles follow requests If the remote lists a local follower which we only know has sent a follow request, consider the follow request as accepted instead of sending an Undo. * Integrate review feeback - rename X-AS-Collection-Synchronization to Collection-Synchronization - various minor refactoring and code style changes * Only select required fields when computing followers_hash * Use actor URI rather than webfinger domain in synchronization endpoint * Change hash computation to be a XOR of individual hashes Makes it much easier to be memory-efficient, and avoid sorting discrepancy issues. * Marginally improve followers_hash computation speed * Further improve hash computation performances by using pluck_each	4 years ago
Eugen Rochko	5e1364c448	Add IP-based rules (#14963 )	4 years ago
Eugen Rochko	ed099d8bdc	Change account suspensions to be reversible by default (#14726 )	4 years ago
ThibG	abee40b232	Add outbox attribute to instance actor (#14721 ) It's not useful for now, but it's required by ActivityPub	5 years ago
Takeshi Umeda	33ad850c98	Added account featured tags API (#11817 )	5 years ago
santiagorodriguez96	e8d41bc2fe	Add WebAuthn as an alternative 2FA method (#14466 ) * feat: add possibility of adding WebAuthn security keys to use as 2FA This adds a basic UI for enabling WebAuthn 2FA. We did a little refactor to the Settings page for editing the 2FA methods – now it will list the methods that are available to the user (TOTP and WebAuthn) and from there they'll be able to add or remove any of them. Also, it's worth mentioning that for enabling WebAuthn it's required to have TOTP enabled, so the first time that you go to the 2FA Settings page, you'll be asked to set it up. This work was inspired by the one donde by Github in their platform, and despite it could be approached in different ways, we decided to go with this one given that we feel that this gives a great UX. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add request for WebAuthn as second factor at login if enabled This commits adds the feature for using WebAuthn as a second factor for login when enabled. If users have WebAuthn enabled, now a page requesting for the use of a WebAuthn credential for log in will appear, although a link redirecting to the old page for logging in using a two-factor code will also be present. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add possibility of deleting WebAuthn Credentials Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: disable WebAuthn when an Admin disables 2FA for a user Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: remove ability to disable TOTP leaving only WebAuthn as 2FA Following examples form other platforms like Github, we decided to make Webauthn 2FA secondary to 2FA with TOTP, so that we removed the possibility of removing TOTP authentication only, leaving users with just WEbAuthn as 2FA. Instead, users will have to click on 'Disable 2FA' in order to remove second factor auth. The reason for WebAuthn being secondary to TOPT is that in that way, users will still be able to log in using their code from their phone's application if they don't have their security keys with them – or maybe even lost them. * We had to change a little the flow for setting up TOTP, given that now it's possible to setting up again if you already had TOTP, in order to let users modify their authenticator app – given that now it's not possible for them to disable TOTP and set it up again with another authenticator app. So, basically, now instead of storing the new `otp_secret` in the user, we store it in the session until the process of set up is finished. This was because, as it was before, when users clicked on 'Edit' in the new two-factor methods lists page, but then went back without finishing the flow, their `otp_secret` had been changed therefore invalidating their previous authenticator app, making them unable to log in again using TOTP. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * refactor: fix eslint errors The PR build was failing given that linting returning some errors. This commit attempts to fix them. * refactor: normalize i18n translations The build was failing given that i18n translations files were not normalized. This commits fixes that. * refactor: avoid having the webauthn gem locked to a specific version * refactor: use symbols for routes without '/' * refactor: avoid sending webauthn disabled email when 2FA is disabled When an admins disable 2FA for users, we were sending two mails to them, one notifying that 2FA was disabled and the other to notify that WebAuthn was disabled. As the second one is redundant since the first email includes it, we can remove it and send just one email to users. * refactor: avoid creating new env variable for webauthn_origin config * refactor: improve flash error messages for webauthn pages Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>	5 years ago
niwatori24	1326c57506	Use default :edit routing (#14535 )	5 years ago
Eugen Rochko	da3978c48e	Disable E2EE API routes for the next release (#14283 )	5 years ago
ThibG	65506bac3f	Add user notes on accounts (#14148 ) * Add UserNote model * Add UI for user notes * Put comment in relationships entity * Add API to create user notes * Copy user notes to new account when receiving a Move activity * Address some of the review remarks * Replace modal by inline edition * Please CodeClimate * Button design changes * Change design again * Cancel note edition when pressing Escape * Fixes * Tweak design again * Move “Add note” item, and allow users to add notes to themselves * Rename UserNote into AccountNote, rename “comment” Relationship attribute to “note”	5 years ago
Eugen Rochko	5d8398c8b8	Add E2EE API (#13820 )	5 years ago
Eugen Rochko	8be4c2ba21	Add ability to remove identity proofs from account (#13682 ) Fix #12613	5 years ago
sternenseemann	679980f77c	Allow users to delete their header and avatar (#13234 ) This is achieved by sending a DELETE request to /settings/profile/pictures/{avatar,header} via a link that is part of the upload form's hint of the respective picture.	5 years ago
Eugen Rochko	9014367bd8	Fix background jobs not using locks like they are supposed to (#13361 ) Also: - Fix locks not being removed when jobs go to the dead job queue - Add UI for managing locks to the Sidekiq dashboard - Remove unused Sidekiq workers Fix #13349	5 years ago
Eugen Rochko	9660aa4543	Change local media attachments to perform heavy processing asynchronously (#13210 ) Fix #9106	5 years ago
ThibG	2423d2f677	Add ability to delete files uploaded for settings in admin UI (#13192 ) * Allow deleting site uploads * Refactor and move links into hints * Fix i18n tests * Fix HTML output of site_upload_delete_hint	5 years ago
Eugen Rochko	663ea84b08	Add publish/unpublish controls to announcements in admin UI (#12967 )	5 years ago
Eugen Rochko	f52c988e12	Add announcements (#12662 ) * Add announcements Fix #11006 * Add reactions to announcements * Add admin UI for announcements * Add unit tests * Fix issues - Add `with_dismissed` param to announcements API - Fix end date not being formatted when time range is given - Fix announcement delete causing reactions to send streaming updates - Fix announcements container growing too wide and mascot too small - Fix `all_day` being settable when no time range is given - Change text "Update" to "Announcement" * Fix scheduler unpublishing announcements before they are due * Fix filter params not being passed to announcements filter	5 years ago
Eugen Rochko	c0006a004d	Change followers page to relationships page in admin UI (#12927 ) Allow browsing and filtering all relationships instead of just followers, unify the codebase with the user-facing relationship manager, add ability to see who the user invited	5 years ago

1 2 3 4 5 ...

311 Commits (ab54d91fe32bb2aaf6cb68ed478cd32090d8f8ad)