mastodon

Commit Graph

Author	SHA1	Message	Date
Claire	07a4059901	Add support for invite codes in the registration API (#27805 )	1 year ago
Claire	49b8433c56	Fix confusing screen when visiting a confirmation link for an already-confirmed email (#27368 )	1 year ago
Claire	379115e601	Add SELF_DESTRUCT env variable to process self-destructions in the background (#26439 )	1 year ago
Matt Jankowski	340f1a68be	Simplify instance presenter view access (#26046 )	1 year ago
Matt Jankowski	50ff3d3342	Coverage for `Auth::OmniauthCallbacks` controller (#26147 )	2 years ago
Claire	b629e21515	Fix unexpected redirection to /explore after sign-in (#26143 )	2 years ago
Matt Jankowski	5134fc65e2	Fix `Naming/AccessorMethodName` cop (#25924 )	2 years ago
Claire	e6a8faae81	Add users index on unconfirmed_email (#25672 )	2 years ago
Claire	180f0e6715	Fix inefficient query when requesting a new confirmation email from a logged-in account (#25669 )	2 years ago
Eugen Rochko	f20698000f	Fix always redirecting to onboarding in web UI (#25396 )	2 years ago
Frankie Roberto	36a77748b4	Order sessions by most-recent to least-recently updated (#25005 )	2 years ago
Claire	bec6a1cad4	Add hCaptcha support (#25019 )	2 years ago
Matt Jankowski	6e226f5a32	Fix Rails/ActionOrder cop (#24692 )	2 years ago
Eugen Rochko	e98c86050a	Refactor `Cache-Control` and `Vary` definitions (#24347 )	2 years ago
Eugen Rochko	e5c0b16735	Add progress indicator to sign-up flow (#24545 )	2 years ago
Claire	280fa3b2c0	Fix invalid/expired invites being processed on sign-up (#24337 )	2 years ago
CSDUMMI	d258ec8e3b	Prefer the stored location as after_sign_in_path in Omniauth Callback Controller (#24073 )	2 years ago
Nick Schonning	aef0051fd0	Enable Rubocop HTTP status rules (#23717 )	2 years ago
Nick Schonning	e2a3ebb271	Autofix Rubocop Style/IfUnlessModifier (#23697 )	2 years ago
David Vega	1b5d207131	Fix single name variables on controller folder (#20092 ) Co-authored-by: petrokoriakin1 <116151189+petrokoriakin1@users.noreply.github.com> Co-authored-by: petrokoriakin1 <116151189+petrokoriakin1@users.noreply.github.com> Co-authored-by: Effy Elden <effy@effy.space>	2 years ago
Francis Murillo	5fb1c3e934	Revoke all authorized applications on password reset (#21325 ) * Clear sessions on password change * Rename User::clear_sessions to revoke_access for a clearer meaning * Add reset paassword controller test * Use User.find instead of User.find_for_authentication for reset password test * Use redirect and render for better test meaning in reset password Co-authored-by: Effy Elden <effy@effy.space>	2 years ago
Claire	48e136605a	Fix form-action CSP directive for external login (#20962 )	2 years ago
Daniel Axtens	4d85c27d1a	Add 'private' to Cache-Control, match Rails expectations (#20608 ) Several controlers set quite intricate Cache-Control headers in order to hopefully not be cached by any intermediate proxies or local caches. Unfortunately, these headers are processed by ActionDispatch::HTTP::Cache in a way that squashes and discards any values set alongside no-store other than private: `8015c2c2cf/actionpack/lib/action_dispatch/http/cache.rb (L207-L209)` We want to preserve no-store on these responses, but we might as well remove parts that are going to be dropped anyway. As many of the endpoints in these controllers are private to a particular user, we should also add "private", which will be preserved alongside no-store.	2 years ago
Claire	1e1289b024	Fix crash when external auth provider has no display_name set (#19962 ) Fixes #19913	2 years ago
Claire	a529d6d93e	Fix invites (#19560 ) Fixes #19507 Fix regression from #19296	2 years ago
Eugen Rochko	679274465b	Add server rules to sign-up flow (#19296 )	2 years ago
Eugen Rochko	d83faa1a89	Add ability to block sign-ups from IP (#19037 )	3 years ago
Claire	327eed0076	Fix suspicious sign-in mails never being sent (#18599 ) * Add tests * Fix suspicious sign-in mails never being sent	3 years ago
Eugen Rochko	96129c2f10	Fix confirmation redirect to app without `Location` header (#18523 )	3 years ago
Eugen Rochko	6221b36b27	Remove sign-in token authentication, instead send e-mail about new sign-in (#17970 )	3 years ago
chandrn7	a6ed6845c9	Allow login through OpenID Connect (#16221 ) * added OpenID Connect as an SSO option * minor fixes * added comments, removed an option that shouldn't be set * fixed Gemfile.lock * added newline to end of Gemfile.lock * removed tab from Gemfile.lock * remove chomp * codeclimate changes and small name change to make function's purpose clearer * codeclimate fix * added SSO buttons to /about page * minor refactor * minor style change * removed spurious change * removed unecessary conditional from ensure_valid_username and added support for auth.info.name in user_params_from_auth * minor changes	3 years ago
Claire	14919fe11e	Change old moderation strikes to be displayed in a separate page (#17566 ) * Change old moderation strikes to be displayed in a separate page Fixes #17552 This changes the moderation strikes displayed on `/auth/edit` to be those from the past 3 months, and make all moderation strikes targeting the current user available in `/disputes`. * Add short description of what the strikes page is for * Move link to list of strikes to “Account status” instead of navigation item * Normalize i18n file * Fix layout and styling of strikes link * Revert highlights_on regexp * Reintroduce account status summary - this way, “Account status” is never empty - account status is not necessarily bound to strikes, or recent strikes	3 years ago
Eugen Rochko	564efd0651	Add appeals (#17364 ) * Add appeals * Add ability to reject appeals and ability to browse pending appeals in admin UI * Add strikes to account page in settings * Various fixes and improvements - Add separate notification setting for appeals, separate from reports - Fix style of links in report/strike header - Change approving an appeal to not restore statuses (due to federation complexities) - Change style of successfully appealed strikes on account settings page - Change account settings page to only show unappealed or recently appealed strikes * Change appealed_at to overruled_at * Fix missing method error	3 years ago
Claire	bddd9ba36d	Add OMNIAUTH_ONLY environment variable to enforce externa log-in (#17288 ) * Remove support for OAUTH_REDIRECT_AT_SIGN_IN Fixes #15959 Introduced in #6540, OAUTH_REDIRECT_AT_SIGN_IN allowed skipping the log-in form to instead redirect to the external OmniAuth login provider. However, it did not prevent the log-in form on /about introduced by #10232 from appearing, and completely broke with the introduction of #15228. As I restoring that previous log-in flow without introducing a security vulnerability may require extensive care and knowledge of how OmniAuth works, this commit removes support for OAUTH_REDIRECT_AT_SIGN_IN instead for the time being. * Add OMNIAUTH_ONLY environment variable to enforce external log-in only * Disable user registration when OMNIAUTH_ONLY is set to true * Replace log-in links When OMNIAUTH_ONLY is set with exactly one OmniAuth provider	3 years ago
Claire	cfa583fa71	Remove support for OAUTH_REDIRECT_AT_SIGN_IN (#17287 ) Fixes #15959 Introduced in #6540, OAUTH_REDIRECT_AT_SIGN_IN allowed skipping the log-in form to instead redirect to the external OmniAuth login provider. However, it did not prevent the log-in form on /about introduced by #10232 from appearing, and completely broke with the introduction of #15228. As I restoring that previous log-in flow without introducing a security vulnerability may require extensive care and knowledge of how OmniAuth works, this commit removes support for OAUTH_REDIRECT_AT_SIGN_IN instead for the time being.	3 years ago
Eugen Rochko	8e84ebf0cb	Remove IP tracking columns from users table (#16409 )	3 years ago
Claire	6da135a493	Fix reviving revoked sessions and invalidating login (#16943 ) Up until now, we have used Devise's Rememberable mechanism to re-log users after the end of their browser sessions. This mechanism relies on a signed cookie containing a token. That token was stored on the user's record, meaning it was shared across all logged in browsers, meaning truly revoking a browser's ability to auto-log-in involves revoking the token itself, and revoking access from all logged-in browsers. We had a session mechanism that dynamically checks whether a user's session has been disabled, and would log out the user if so. However, this would only clear a session being actively used, and a new one could be respawned with the `remember_user_token` cookie. In practice, this caused two issues: - sessions could be revived after being closed from /auth/edit (security issue) - auto-log-in would be disabled for all browsers after logging out from one of them This PR removes the `remember_token` mechanism and treats the `_session_id` cookie/token as a browser-specific `remember_token`, fixing both issues.	3 years ago
Claire	24f9ea7818	Fix webauthn secure key authentication (#16792 ) * Add tests * Fix webauthn secure key authentication Fixes #16769	3 years ago
Truong Nguyen	7283a5d3b9	Explicitly set userVerification to discoraged (#16545 )	4 years ago
Claire	94bcf45321	Fix authentication failures after going halfway through a sign-in attempt (#16607 ) * Add tests * Add security-related tests My first (unpublished) attempt at fixing the issues introduced (extremely hard-to-exploit) security vulnerabilities, addressing them in a test. * Fix authentication failures after going halfway through a sign-in attempt * Refactor `authenticate_with_sign_in_token` and `authenticate_with_two_factor` to make the two authentication steps more obvious	4 years ago
Daniel	5c21021176	Fix undefined variable for Auth::OmniauthCallbacksController (#16654 ) The addition of authentication history broke the omniauth login with the following error: method=GET path=/auth/auth/cas/callback format=html controller=Auth::OmniauthCallbacksController action=cas status=500 error='NameError: undefined local variable or method `user' for #<Auth::OmniauthCallbacksController:0x00000000036290> Did you mean? @user' duration=435.93 view=0.00 db=36.19 * app/controllers/auth/omniauth_callbacks_controller.rb: fix variable name to `@user`	4 years ago
Eugen Rochko	d174d12c83	Add authentication history (#16408 )	4 years ago
Claire	8c44b723bb	Change confirmations controller to redirect to / for approved users (#16151 ) Clicking the confirmation link multiple times currently leads to entering account settings, which can be confusing. This commit changes that so that it redirects to the root path, so it behaves the same way as clicking only once in most cases.	4 years ago
ThibG	49eb4d4ddf	Add honeypot fields and minimum fill-out time for sign-up form (#15276 ) * Add honeypot fields to limit non-specialized spam Add two honeypot fields: a fake website input and a fake password confirmation one. The label/placeholder/aria-label tells not to fill them, and they are hidden in CSS, so legitimate users should not fall into these. This should cut down on some non-Mastodon-specific spambots. * Require a 3 seconds delay before submitting the registration form * Fix tests * Move registration form time check to model validation * Give people a chance to clear the honeypot fields * Refactor honeypot translation strings Co-authored-by: Claire <claire.github-309c@sitedethib.com>	4 years ago
Eugen Rochko	8532429af7	Fix 2FA/sign-in token sessions being valid after password change (#14802 ) If someone tries logging in to an account and is prompted for a 2FA code or sign-in token, even if the account's password or e-mail is updated in the meantime, the session will show the prompt and allow the login process to complete with a valid 2FA code or sign-in token	4 years ago
Eugen Rochko	5e1364c448	Add IP-based rules (#14963 )	4 years ago
santiagorodriguez96	e8d41bc2fe	Add WebAuthn as an alternative 2FA method (#14466 ) * feat: add possibility of adding WebAuthn security keys to use as 2FA This adds a basic UI for enabling WebAuthn 2FA. We did a little refactor to the Settings page for editing the 2FA methods – now it will list the methods that are available to the user (TOTP and WebAuthn) and from there they'll be able to add or remove any of them. Also, it's worth mentioning that for enabling WebAuthn it's required to have TOTP enabled, so the first time that you go to the 2FA Settings page, you'll be asked to set it up. This work was inspired by the one donde by Github in their platform, and despite it could be approached in different ways, we decided to go with this one given that we feel that this gives a great UX. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add request for WebAuthn as second factor at login if enabled This commits adds the feature for using WebAuthn as a second factor for login when enabled. If users have WebAuthn enabled, now a page requesting for the use of a WebAuthn credential for log in will appear, although a link redirecting to the old page for logging in using a two-factor code will also be present. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add possibility of deleting WebAuthn Credentials Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: disable WebAuthn when an Admin disables 2FA for a user Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: remove ability to disable TOTP leaving only WebAuthn as 2FA Following examples form other platforms like Github, we decided to make Webauthn 2FA secondary to 2FA with TOTP, so that we removed the possibility of removing TOTP authentication only, leaving users with just WEbAuthn as 2FA. Instead, users will have to click on 'Disable 2FA' in order to remove second factor auth. The reason for WebAuthn being secondary to TOPT is that in that way, users will still be able to log in using their code from their phone's application if they don't have their security keys with them – or maybe even lost them. * We had to change a little the flow for setting up TOTP, given that now it's possible to setting up again if you already had TOTP, in order to let users modify their authenticator app – given that now it's not possible for them to disable TOTP and set it up again with another authenticator app. So, basically, now instead of storing the new `otp_secret` in the user, we store it in the session until the process of set up is finished. This was because, as it was before, when users clicked on 'Edit' in the new two-factor methods lists page, but then went back without finishing the flow, their `otp_secret` had been changed therefore invalidating their previous authenticator app, making them unable to log in again using TOTP. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * refactor: fix eslint errors The PR build was failing given that linting returning some errors. This commit attempts to fix them. * refactor: normalize i18n translations The build was failing given that i18n translations files were not normalized. This commits fixes that. * refactor: avoid having the webauthn gem locked to a specific version * refactor: use symbols for routes without '/' * refactor: avoid sending webauthn disabled email when 2FA is disabled When an admins disable 2FA for users, we were sending two mails to them, one notifying that 2FA was disabled and the other to notify that WebAuthn was disabled. As the second one is redundant since the first email includes it, we can remove it and send just one email to users. * refactor: avoid creating new env variable for webauthn_origin config * refactor: improve flash error messages for webauthn pages Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>	5 years ago
abcang	6a96af4d20	Fix rubocop warning (#14288 ) * Fix rubocop warning * use limit variable * use ContextCreatingMethods option	5 years ago
Eugen Rochko	844870273f	Fix other sessions not being logged out on password change (#14252 ) While OAuth tokens were immediately revoked, accessing the home controller immediately generated new OAuth tokens and "revived" the session due to a combination of using remember_me tokens and overwriting the `authenticate_user!` method	5 years ago
Eugen Rochko	72a7cfaa39	Add e-mail-based sign in challenge for users with disabled 2FA (#14013 )	5 years ago

1 2 3

119 Commits (b8fe77353eb41a5c1ad993a83c1d3715ae2b439e)