mastodon

Commit Graph

Author	SHA1	Message	Date
Eugen Rochko	6221b36b27	Remove sign-in token authentication, instead send e-mail about new sign-in (#17970 )	3 years ago
Claire	e38fc319dc	Refactor and improve tests (#17386 ) * Change account and user fabricators to simplify and improve tests - `Fabricate(:account)` implicitly fabricates an associated `user` if no `domain` attribute is given (an account with `domain: nil` is considered a local account, but no user record was created), unless `user: nil` is passed - `Fabricate(:account, user: Fabricate(:user))` should still be possible but is discouraged. * Fix and refactor tests - avoid passing unneeded attributes to `Fabricate(:user)` or `Fabricate(:account)` - avoid embedding `Fabricate(:user)` into a `Fabricate(:account)` or the other way around - prefer `Fabricate(:user, account_attributes: …)` to `Fabricate(:user, account: Fabricate(:account, …)` - also, some tests were using remote accounts with local user records, which is not representative of production code.	3 years ago
Eugen Rochko	8e84ebf0cb	Remove IP tracking columns from users table (#16409 )	3 years ago
Claire	24f9ea7818	Fix webauthn secure key authentication (#16792 ) * Add tests * Fix webauthn secure key authentication Fixes #16769	3 years ago
Claire	94bcf45321	Fix authentication failures after going halfway through a sign-in attempt (#16607 ) * Add tests * Add security-related tests My first (unpublished) attempt at fixing the issues introduced (extremely hard-to-exploit) security vulnerabilities, addressing them in a test. * Fix authentication failures after going halfway through a sign-in attempt * Refactor `authenticate_with_sign_in_token` and `authenticate_with_two_factor` to make the two authentication steps more obvious	4 years ago
Claire	8c44b723bb	Change confirmations controller to redirect to / for approved users (#16151 ) Clicking the confirmation link multiple times currently leads to entering account settings, which can be confusing. This commit changes that so that it redirects to the root path, so it behaves the same way as clicking only once in most cases.	4 years ago
Eugen Rochko	9aa37b32c3	Add `details` to error response for `POST /api/v1/accounts` in REST API (#15803 )	4 years ago
ThibG	1cf2c3a810	Fix external user creation failing when invite request text is required (#15405 ) * Fix external user creation failing when invite request text is required Also fixes tootctl-based user creation. * Add test about invites when invite request text is otherwise required Co-authored-by: Claire <claire.github-309c@sitedethib.com>	4 years ago
ThibG	49eb4d4ddf	Add honeypot fields and minimum fill-out time for sign-up form (#15276 ) * Add honeypot fields to limit non-specialized spam Add two honeypot fields: a fake website input and a fake password confirmation one. The label/placeholder/aria-label tells not to fill them, and they are hidden in CSS, so legitimate users should not fall into these. This should cut down on some non-Mastodon-specific spambots. * Require a 3 seconds delay before submitting the registration form * Fix tests * Move registration form time check to model validation * Give people a chance to clear the honeypot fields * Refactor honeypot translation strings Co-authored-by: Claire <claire.github-309c@sitedethib.com>	4 years ago
Eugen Rochko	8532429af7	Fix 2FA/sign-in token sessions being valid after password change (#14802 ) If someone tries logging in to an account and is prompted for a 2FA code or sign-in token, even if the account's password or e-mail is updated in the meantime, the session will show the prompt and allow the login process to complete with a valid 2FA code or sign-in token	4 years ago
Eugen Rochko	ed099d8bdc	Change account suspensions to be reversible by default (#14726 )	4 years ago
santiagorodriguez96	e8d41bc2fe	Add WebAuthn as an alternative 2FA method (#14466 ) * feat: add possibility of adding WebAuthn security keys to use as 2FA This adds a basic UI for enabling WebAuthn 2FA. We did a little refactor to the Settings page for editing the 2FA methods – now it will list the methods that are available to the user (TOTP and WebAuthn) and from there they'll be able to add or remove any of them. Also, it's worth mentioning that for enabling WebAuthn it's required to have TOTP enabled, so the first time that you go to the 2FA Settings page, you'll be asked to set it up. This work was inspired by the one donde by Github in their platform, and despite it could be approached in different ways, we decided to go with this one given that we feel that this gives a great UX. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add request for WebAuthn as second factor at login if enabled This commits adds the feature for using WebAuthn as a second factor for login when enabled. If users have WebAuthn enabled, now a page requesting for the use of a WebAuthn credential for log in will appear, although a link redirecting to the old page for logging in using a two-factor code will also be present. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add possibility of deleting WebAuthn Credentials Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: disable WebAuthn when an Admin disables 2FA for a user Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: remove ability to disable TOTP leaving only WebAuthn as 2FA Following examples form other platforms like Github, we decided to make Webauthn 2FA secondary to 2FA with TOTP, so that we removed the possibility of removing TOTP authentication only, leaving users with just WEbAuthn as 2FA. Instead, users will have to click on 'Disable 2FA' in order to remove second factor auth. The reason for WebAuthn being secondary to TOPT is that in that way, users will still be able to log in using their code from their phone's application if they don't have their security keys with them – or maybe even lost them. * We had to change a little the flow for setting up TOTP, given that now it's possible to setting up again if you already had TOTP, in order to let users modify their authenticator app – given that now it's not possible for them to disable TOTP and set it up again with another authenticator app. So, basically, now instead of storing the new `otp_secret` in the user, we store it in the session until the process of set up is finished. This was because, as it was before, when users clicked on 'Edit' in the new two-factor methods lists page, but then went back without finishing the flow, their `otp_secret` had been changed therefore invalidating their previous authenticator app, making them unable to log in again using TOTP. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * refactor: fix eslint errors The PR build was failing given that linting returning some errors. This commit attempts to fix them. * refactor: normalize i18n translations The build was failing given that i18n translations files were not normalized. This commits fixes that. * refactor: avoid having the webauthn gem locked to a specific version * refactor: use symbols for routes without '/' * refactor: avoid sending webauthn disabled email when 2FA is disabled When an admins disable 2FA for users, we were sending two mails to them, one notifying that 2FA was disabled and the other to notify that WebAuthn was disabled. As the second one is redundant since the first email includes it, we can remove it and send just one email to users. * refactor: avoid creating new env variable for webauthn_origin config * refactor: improve flash error messages for webauthn pages Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>	5 years ago
Eugen Rochko	72a7cfaa39	Add e-mail-based sign in challenge for users with disabled 2FA (#14013 )	5 years ago
ThibG	c48d895ea7	Fix sign-ups without checked user agreement being accepted through the web form (#13088 ) * Fix user agreement not being verified * Fix tests * Fix up agreement field being dismissed	5 years ago
Eugen Rochko	e1066cd431	Add password challenge to 2FA settings, e-mail notifications (#11878 ) Fix #3961	5 years ago
Eugen Rochko	c707ef49d9	Fix 2FA challenge and password challenge for non-database users (#11831 ) * Fix 2FA challenge not appearing for non-database users Fix #11685 * Fix account deletion not working when using external login Fix #11691	5 years ago
Eugen Rochko	964ae8eee5	Change unconfirmed user login behaviour (#11375 ) Allow access to account settings, 2FA, authorized applications, and account deletions to unconfirmed and pending users, as well as users who had their accounts disabled. Suspended users cannot update their e-mail or password or delete their account. Display account status on account settings page, for example, when an account is frozen, limited, unconfirmed or pending review. After sign up, login users straight away and show a simple page that tells them the status of their account with links to account settings and logout, to reduce onboarding friction and allow users to correct wrongly typed e-mail addresses. Move the final sign-up step of SSO integrations to be the same as above to reduce code duplication.	6 years ago
ThibG	21a73c52a7	Check that an invite link is valid before bypassing approval mode (#10657 ) * Check that an invite link is valid before bypassing approval mode Fixes #10656 * Add tests * Only consider valid invite links in registration controller * fixup	6 years ago
Eugen Rochko	51e154f5e8	Admission-based registrations mode (#10250 ) Fix #6856 Fix #6951	6 years ago
takayamaki	33976c8ecc	fix: Execute PAM authentication tests on CircleCI (#9029 ) and use 'if' option of context block	6 years ago
Eugen Rochko	d5bfba3262	Do not test PAM authentication by default (#9027 ) * Do not test PAM authentication by default * Disable PAM tests if PAM is not enabled	6 years ago
aus-social	1f98eae1cf	Lint pass (#8876 )	6 years ago
Eugen Rochko	2288d50a7b	Add force_login option to OAuth authorize page (#8655 ) * Add force_login option to OAuth authorize page For when a user needs to sign into an app from multiple accounts on the same server * When logging out from modal header, redirect back after re-login	7 years ago
Shuhei Kitagawa	459394a020	Add missing tests for confirmations controller (#7866 )	7 years ago
Yamagishi Kazutoshi	3f6893c641	Reset locale on registration tests (#7219 )	7 years ago
Yamagishi Kazutoshi	d10447c3a8	Use raw status code on have_http_status (#7214 )	7 years ago
Alexander	8e88a18316	update gem, test pam authentication (#7028 ) * update gem, test pam authentication * add description for test parameters * fix inclusion of optional group	7 years ago
Patrick Figel	5ec25ff3e1	Fix email confirmation link not updating email (#6187 ) A change introduced in #6125 prevents `Devise::Models::Confirmable#confirm` from being called for existing users, which in turn leads to `email` not being set to `unconfirmed_email`, breaking email updates. This also adds a test that would've caught this issue.	7 years ago
Eugen Rochko	7d7844a47f	Default follows for new users (#4871 ) When a new user confirms their e-mail, bootstrap their home timeline by automatically following a set of accounts. By default, all local admin accounts (that are unlocked). Can be customized by new admin setting (comma-separated usernames, local and unlocked only)	8 years ago
Eugen Rochko	df605f0f8b	Add "signed in as" header to some pages (#4523 )	8 years ago
nullkal	dfcd2834f9	Redirect to PasswordController#new when reset_password_token is invalid (#4506 )	8 years ago
Akihiko Odaki (@fn_aki@pawoo.net)	67243bda31	Cover Auth::RegistrationsController more (#3353 )	8 years ago
René Klačan	dcf0530218	Make sure email is case insensitive on all places (#3688 ) When case insensitivity is enabled via devise's `config.case_insensitive_keys` then `.find_for_authentication` method needs to be used instead of `.find_by` because second mentioned returns `nil` when valid email with different cases is passed. More info https://github.com/plataformatec/devise/wiki/How-To:-Use-case-insensitive-emails	8 years ago
Akihiko Odaki	7bf2d6cb06	Spec Auth::ConfirmationsController (#3348 )	8 years ago
Akihiko Odaki	a7f2961621	Spec Auth::PasswordsController (#3352 )	8 years ago
Akinori MUSHA	f6a93fc150	Go to root after login in single user mode (#3289 ) In single user mode, visitors are redirected to the single user's profile page. So, if you are the owner without a session, you start from that page, click the login button and authenticate yourself expecting you'll soon get started with the home page, but in reality you'll get redirected back to where you started from -- your own profile page. This fixes the behavior by redirecting you home after login if you have started from your own profile page.	8 years ago
Eugen Rochko	2ca1f0737a	Fix Devise destroy method being available to delete user record (#3266 ) (You may think that we need account deletions, but this way would've just orphaned the db records)	8 years ago
Matt Jankowski	268dd32d76	Auth sign out (#2511 ) * Add a spec for signing out * Add spec showing that suspended user gets a 403 forbidden on sign out * Allow suspended account users to sign out	8 years ago
Matt Jankowski	b48f2cbc8b	Catch error when server decryption fails on 2FA (#2512 )	8 years ago
alpaca-tc	9317ec8eb1	Localize with i18n for Devise::FailureApp (#2309 ) This PR fixes I18n.locale for rake middlewares. Mastodon uses Devise that depends on Warden. Warden::Manager can be found in rake middleware. It is outside of the controller. In the case of authentication failed, warden calls throw(:warden). At the time Warden::Manager delegates request to failure_app to generate response and flash[:alert] after catching it. Unfortunately, I18n.locale is already reset then because I18n.with_locale is enabled only inside the controller. If we used I18n.locale=, Devise::FailureApp could get the current locale.	8 years ago
saturday06	d87ee1167e	Assign user locale on signup (#1982 )	8 years ago
Patrick Figel	df4ff9a8e1	Add recovery code support for two-factor auth (#1773 ) * Add recovery code support for two-factor auth When users enable two-factor auth, the app now generates ten single-use recovery codes. Users are encouraged to print the codes and store them in a safe place. The two-factor prompt during login now accepts both OTP codes and recovery codes. The two-factor settings UI allows users to regenerated lost recovery codes. Users who have set up two-factor auth prior to this feature being added can use it to generate recovery codes for the first time. Fixes #563 and fixes #987 * Set OTP_SECRET in test enviroment * add missing .html to view file names	8 years ago
Eugen	15d442cf9d	Fix /api/v1/accounts/update_credentials tests (#1357 )	8 years ago
Eugen Rochko	1bbcd71cd4	Fix #390 - fix redirect after sign-up (to login page instead of homepage)	8 years ago
Eugen Rochko	7ac574d9a9	Fix #148 - Devise mailer fixed, test spec added so it won't slip past again	8 years ago
Eugen Rochko	7e14eefc81	Replace logo, fix #57 - delete/unreblog/unfavourite API, fix #45 - app registration API	9 years ago
Eugen Rochko	10ba09f546	Upgrade to Rails 5.0.0.1	9 years ago
Eugen Rochko	ff2cbc0753	Remember me enabled by default	9 years ago

48 Commits (b3496583e0d85be80b84657dcfed9c354e5aebe2)