1268 Commits (bc7a8ae6d6d2c2118e5c49add83539498b9d543b)

Author	SHA1	Message	Date
Eugen Rochko	b3ceb3dcc4	Add canonical e-mail blocks for suspended accounts (#16049) ... Prevent new accounts from being created using the same underlying e-mail as a suspended account using extensions and period permutations. Stores e-mails as a SHA256 hash	5 years ago
Eugen Rochko	3b8d085436	Fix app name, website and redirect URIs not having a maximum length (#16042) ... Fix app scopes not being validated	5 years ago
Eugen Rochko	ce2148c571	Add `policy` param to `POST /api/v1/push/subscriptions` (#16040) ... With possible values `all`, `followed`, `follower`, and `none`, control from whom notifications will generate a Web Push alert	5 years ago
Eugen Rochko	120965eb0b	Change Web Push API deliveries to use request pooling (#16014)	5 years ago
Eugen Rochko	f7117646af	Add cold-start follow recommendations (#15945)	5 years ago
Eugen Rochko	619fad6cf8	Remove spam check and dependency on nilsimsa gem (#16011)	5 years ago
Eugen Rochko	7183d9a113	Change multiple mentions with same username to render with domain (#15718) ... Fix #15506	5 years ago
Claire	a650a1157d	Fix /admin/tags/:id crashing since Rails 6.1 update (#15953) ... Raw SQL passed to `pluck` now has to be explicitly marked as SQL via Arel.sql, see https://github.com/rails/rails/pull/27947	5 years ago
Claire	cbd0ee1d07	Update Mastodon to Rails 6.1 (#15910) ... * Update devise-two-factor to unreleased fork for Rails 6 support Update tests to match new `rotp` version. * Update nsa gem to unreleased fork for Rails 6 support * Update rails to 6.1.3 and rails-i18n to 6.0 * Update to unreleased fork of pluck_each for Ruby 6 support * Run "rails app:update" * Add missing ActiveStorage config file * Use config.ssl_options instead of removed ApplicationController#force_ssl Disabled force_ssl-related tests as they do not seem to be easily testable anymore. * Fix nonce directives by removing Rails 5 specific monkey-patching * Fix fixture_file_upload deprecation warning * Fix yield-based test failing with Rails 6 * Use Rails 6's index_with when possible * Use ActiveRecord::Cache::Store#delete_multi from Rails 6 This will yield better performances when deleting an account * Disable Rails 6.1's automatic preload link headers Since Rails 6.1, ActionView adds preload links for javascript files in the Links header per default. In our case, that will bloat headers too much and potentially cause issues with reverse proxies. Furhermore, we don't need those links, as we already output them as HTML link tags. * Switch to Rails 6.0 default config * Switch to Rails 6.1 default config * Do not include autoload paths in the load path	5 years ago
Claire	1c4dee4554	Fix Mastodon not understanding as:Public and Public (#15948) ... Fixes #5551	5 years ago
Claire	051efed5ed	Bypass MX validation for explicitly allowed domains (#15930) ... * Bypass MX validation for explicitly allowed domains This spares some lookups and prevent issues in some edge cases with local domains. * Add tests * Fix test	5 years ago
Claire	741d0952b1	Improve account counters handling (#15913) ... * Improve account counters handling * Use ActiveRecord::Base::sanitize_sql to pass values instead of interpolating them Keep using string interpolation for `key` as it is safe and using “ActiveRecord::Base::sanitize_sql_hash_for_assignment” would require stitching bits of SQL in a way that is not more easily checked for safety. * Add migration hook to catch PostgreSQL versions earlier than 9.5	5 years ago
Claire	b358229834	Further preparation for Rails 6 (#15916) ... * Use ActiveRecord::Result#to_ary instead of deprecated to_hash They do the same thing, and to_hash has been removed from Rails 6.1 * Explicitly name polymorphic indexes to workaround a bug in Rails 6.1 cf. https://github.com/rails/rails/issues/41693 * Fix incorrect usage of “foreign_key” in migration script * Use `ActiveModel::Errors#delete` instead of deprecated clear method * Fix link headers tests on Rails 6.1 Rails 6.1 adds values to the Link header by default, thus it is not a LinkHeader object anymore. Fix the test to parse the Link header instead of assuming it is a LinkHeader.	5 years ago
Claire	a4dcaef53b	Prepare Mastodon for zeitwerk autoloader (#15917) ... * Prepare Mastodon for zeitwerk autoloader (Rails 6) Add inflections and rename/move a few classes. In particular, app/lib/exceptions.rb and app/lib/sanitize_config.rb were manually loaded while still in autoload paths. * Add inflection for Url → URL	5 years ago
Claire	5027abecd1	Fix cache_collection crashing when given an empty collection (#15921) ... * Fix cache_collection crashing when given an empty collection * Add tests	5 years ago
Claire	43eff898a0	Prepare Mastodon for Rails 6 (#15911) ... * Fix misuse of foreign_type * Fix use of removed "add_template_helper" * Use response.media_type instead of response.content_type in tests * Fix CSV export controller test on Rails 6 Rails 6 sets a "filename*" field in the Content-Disposition header to explicitly encode the filename as UTF-8. This changes checks the first part of the Content-Disposition header so it matches in both Rails 5 and Rails 6. * Fix emoji formatting with Rails 6 * Make emoji output more idiomatic and robust * Switch from redis-rails gem to built-in Rails redis cache storage	5 years ago
Claire	5cc45d22d3	Remove subscription_expires_at leftover from OStatus (#15857)	5 years ago
Claire	5614e6724e	Fix URL scanning in note length validator and preview card fetching (#15827) ... * Add tests * Fix URL scanning in note length validator and preview card fetching	5 years ago
Claire	65db262550	Update twitter-text from 1.14 to 3.1.0 and fix toot character counting (#15382) ... * Update twitter-text from 1.14 to 3.1.0 * Disable emoji parsing * Properly depend on twitter-text for url detection * Fix some URLs being wrongly detected client-side * Add test for server-side validation of non-autolinkable URLs * Fix server-side status length counting	5 years ago
Eugen Rochko	9aa37b32c3	Add `details` to error response for `POST /api/v1/accounts` in REST API (#15803)	5 years ago
Claire	5f4c0b79c2	Change ResolveAccountService's handling of skip_webfinger (#15750) ... * Change ResolveAccountService's handling of skip_webfinger Change it so it never makes any webfinger query, as the name would imply. * Add tests * Change FollowService to not take an URI for target_account * Restore domain-block check in FollowService * Fix tests	5 years ago
Eugen Rochko	8331fdf7e0	Add server rules (#15769)	5 years ago
Claire	be3b9f8151	Fix URI of repeat follow requests not being recorded (#15662) ... * Fix URI of repeat follow requests not being recorded In case we receive a “repeat” or “duplicate” follow request, we automatically fast-forward the accept with the latest received Activity `id`, but we don't record it. In general, a “repeat” or “duplicate” follow request may happen if for some reason (e.g. inconsistent handling of Block or Undo Accept activities, an instance being brought back up from the dead, etc.) the local instance thought the remote actor were following them while the remote actor thought otherwise. In those cases, the remote instance does not know about the older Follow activity `id`, so keeping that record serves no purpose, but knowing the most recent one is useful if the remote implementation at some point refers to it by `id` without inlining it. * Add tests	5 years ago
ThibG	a044ddac5b	Fix race conditions on account migration creation (#15597) ... * Atomically check for processing lock in Move handler * Prevent race condition when creating account migrations Fixes #15595 * Add tests Co-authored-by: Claire <claire.github-309c@sitedethib.com>	5 years ago
Shubhendra Singh Chauhan	c8d11b8bdb	Fixed code quality issues (#15541) ... * Added .deepsource.toml * Removed bad use of `alias` * Fixed operand order in the binary expression * Prefixed unused method arguments with an underscore * Replaced the old OpenSSL algorithmic constants with the newer strings initializers. * Removed unnecessary UTF-8 encoding comment	5 years ago
abcang	7ab53f221a	Improved performance of notification preloading (#15640) ... * Improved performance of notification preloading * Remove Cacheable from Notification * Fix test	5 years ago
ThibG	54d4e5252b	Use Rails' index_by where it makes sense (#15542) ... * Use Rails' index_by where it makes sense * Fix tests Co-authored-by: Claire <claire.github-309c@sitedethib.com>	5 years ago
Levi Bard	11d603101a	Fix muting users with duration via the REST api (#15516)	5 years ago
ThibG	f1f96ebf02	Fix being able to import more than allowed number of follows (#15384) ... * Fix being able to import more than allowed number of follows Without this commit, if someone tries importing a second list of accounts to follow before the first one has been processed, this will queue imports for the two whole lists, even if they exceed the account's allowed number of outgoing follows. This commit changes it so the individual queued imports aren't exempt from the follow limit check (they remain exempt from the rate-limiting check though). * Catch validation errors to not re-queue failed follows Co-authored-by: Claire <claire.github-309c@sitedethib.com>	5 years ago
ThibG	3249d35bdc	Improve account deletion performances further (#15407) ... * Delete status records by batches of 50 * Do not precompute values that are only used once * Do not generate redis events for removal of public toots older than two weeks * Filter reported toots a priori for polls and status deletion * Do not process reblogs when cleaning up public timelines As in Mastodon proper, reblogs don't appear in public TLs * Clean the deleted account's own feed in one go * Refactor Account#clean_feed_manager and List#clean_feed_manager * Delete instead of destroy a few more associations * Fix preloading Co-authored-by: Claire <claire.github-309c@sitedethib.com>	5 years ago
ThibG	1cf2c3a810	Fix external user creation failing when invite request text is required (#15405) ... * Fix external user creation failing when invite request text is required Also fixes tootctl-based user creation. * Add test about invites when invite request text is otherwise required Co-authored-by: Claire <claire.github-309c@sitedethib.com>	5 years ago
Eugen Rochko	9915d11c0d	Fix unnecessary queries when batch-removing statuses, 100x faster (#15387)	5 years ago
ThibG	43961035a9	Fix some notifications not being deleted on poll/status deletion (#15402) ... * Fix deleting polls not deleting notifications * Fix fav notification deletion when deleting a toot * Refactor DeleteAccountService spec * Add DeleteAccountService tests for other associations and notifications * Add favourite handling spec in status removal Co-authored-by: Claire <claire.github-309c@sitedethib.com>	5 years ago
ThibG	a60d9335d8	Fix resolving accounts sometimes creating duplicate records for a given AP id (#15364) ... * Fix ResolveAccountService accepting mismatching acct: URI * Set attributes that should be updated regardless of suspension * Fix key fetching * Automatically merge remote accounts with duplicate `uri` * Add tests * Add "tootctl accounts fix-duplicates" Finds duplicate accounts sharing a same ActivityPub `id`, re-fetch them and merge them under the canonical `acct:` URI. Co-authored-by: Claire <claire.github-309c@sitedethib.com>	5 years ago
Eugen Rochko	eb35be0431	Fix follow limit preventing re-following of a moved account (#14207)	5 years ago
ThibG	b1feb47055	Improve searching for private toots from URL (#14856) ... * Improve searching for private toots from URL Most of the time, when sharing toots, people use the toot URL rather than the toot URI, which makes sense since it is the user-facing URL. In Mastodon's case, the URL and URI are different, and Mastodon does not have an index on URL, which means searching a private toot by URL is done with a slow query that will only succeed for very recent toots. This change gets rid of the slow query, and attempts to guess the URI from URL instead, as Mastodon's are predictable. * Add tests * Only return status with guessed uri if url matches Co-authored-by: Claire <claire.github-309c@sitedethib.com>	5 years ago
ThibG	8357969559	Fix admins being able to suspend their instance actor (#14567) ... * Fix admin being able to suspend their own instance account * Add text about the instance's own actor in admin view * Change instance actor notice from flash message to template * Do not list local instance actor in account moderation list	5 years ago
Eugen Rochko	1f564051b6	Change RTL detection to rely on unicode-bidi paragraph by paragraph (#14573)	5 years ago
Eugen Rochko	216b85b053	Fix performance on instances list in admin UI (#15282) ... - Reduce duplicate queries - Remove n+1 queries - Add accounts count to detailed view - Add separate action log entry for updating existing domain blocks	5 years ago
ThibG	49eb4d4ddf	Add honeypot fields and minimum fill-out time for sign-up form (#15276) ... * Add honeypot fields to limit non-specialized spam Add two honeypot fields: a fake website input and a fake password confirmation one. The label/placeholder/aria-label tells not to fill them, and they are hidden in CSS, so legitimate users should not fall into these. This should cut down on some non-Mastodon-specific spambots. * Require a 3 seconds delay before submitting the registration form * Fix tests * Move registration form time check to model validation * Give people a chance to clear the honeypot fields * Refactor honeypot translation strings Co-authored-by: Claire <claire.github-309c@sitedethib.com>	5 years ago
trwnh	127c543a6e	rename replies_policy enumerables (#15304)	5 years ago
ThibG	c43f4cd3bb	Fix not being able to unfavorite toots one has lost access to (#15192) ... Fixes #15191	5 years ago
ThibG	8b8004a962	Fix webfinger redirect handling in ResolveAccountService (#15187) ... * Fix webfinger redirect handling in ResolveAccountService ResolveAccountService#process_webfinger! handled a one-step webfinger redirection, but only accepting the result if it matched the exact URI passed as input, defeating the point of a redirection check. Instead, use the same logic as in `ActivityPub::FetchRemoteAccountService`, updating the resulting `acct:` URI with the result of the first webfinger query. * Add tests	5 years ago
ThibG	96c1e71329	Add import/export feature for bookmarks (#14956) ... * Add ability to export bookmarks * Add support for importing bookmarks * Add bookmark import tests * Add bookmarks export test	5 years ago
Eugen Rochko	8532429af7	Fix 2FA/sign-in token sessions being valid after password change (#14802) ... If someone tries logging in to an account and is prompted for a 2FA code or sign-in token, even if the account's password or e-mail is updated in the meantime, the session will show the prompt and allow the login process to complete with a valid 2FA code or sign-in token	5 years ago
Eugen Rochko	337dc6e0ad	Fix updating account counters when account_stat is not yet created (#15108)	5 years ago
Eugen Rochko	3134691948	Add support for reversible suspensions through ActivityPub (#14989)	5 years ago
Takeshi Umeda	d6fe0c94ca	Add account sensitized (#14361) ... * Add account sensitized * Fix i18n normalize * Fix description and spec * Fix spec * Fix wording	5 years ago
ThibG	ca56527140	Add follower synchronization mechanism (#14510) ... * Add support for followers synchronization on the receiving end Check the `collectionSynchronization` attribute on `Create` and `Announce` activities and synchronize followers from provided collection if possible. * Add tests for followers synchronization on the receiving end * Add support for follower synchronization on the sender's end * Add tests for the sending end * Switch from AS attributes to HTTP header Replace the custom `collectionSynchronization` ActivityStreams attribute by an HTTP header (`X-AS-Collection-Synchronization`) with the same syntax as the `Signature` header and the following fields: - `collectionId` to specify which collection to synchronize - `digest` for the SHA256 hex-digest of the list of followers known on the receiving instance (where “receiving instance” is determined by accounts sharing the same host name for their ActivityPub actor `id`) - `url` of a collection that should be fetched by the instance actor Internally, move away from the webfinger-based `domain` attribute and use account `uri` prefix to group accounts. * Add environment variable to disable followers synchronization Since the whole mechanism relies on some new preconditions that, in some extremely rare cases, might not be met, add an environment variable (DISABLE_FOLLOWERS_SYNCHRONIZATION) to disable the mechanism altogether and avoid followers being incorrectly removed. The current conditions are: 1. all managed accounts' actor `id` and inbox URL have the same URI scheme and netloc. 2. all accounts whose actor `id` or inbox URL share the same URI scheme and netloc as a managed account must be managed by the same Mastodon instance as well. As far as Mastodon is concerned, breaking those preconditions require extensive configuration changes in the reverse proxy and might also cause other issues. Therefore, this environment variable provides a way out for people with highly unusual configurations, and can be safely ignored for the overwhelming majority of Mastodon administrators. * Only set follower synchronization header on non-public statuses This is to avoid unnecessary computations and allow Follow-related activities to be handled by the usual codepath instead of going through the synchronization mechanism (otherwise, any Follow/Undo/Accept activity would trigger the synchronization mechanism even if processing the activity itself would be enough to re-introduce synchronization) * Change how ActivityPub::SynchronizeFollowersService handles follow requests If the remote lists a local follower which we only know has sent a follow request, consider the follow request as accepted instead of sending an Undo. * Integrate review feeback - rename X-AS-Collection-Synchronization to Collection-Synchronization - various minor refactoring and code style changes * Only select required fields when computing followers_hash * Use actor URI rather than webfinger domain in synchronization endpoint * Change hash computation to be a XOR of individual hashes Makes it much easier to be memory-efficient, and avoid sorting discrepancy issues. * Marginally improve followers_hash computation speed * Further improve hash computation performances by using pluck_each	5 years ago
Eugen Rochko	5e1364c448	Add IP-based rules (#14963)	5 years ago
Eugen Rochko	7d985f2aac	Remove dependency on goldfinger gem (#14919) ... There are edge cases where requests to certain hosts timeout when using the vanilla HTTP.rb gem, which the goldfinger gem uses. Now that we no longer need to support OStatus servers, webfinger logic is so simple that there is no point encapsulating it in a gem, so we can just use our own Request class. With that, we benefit from more robust timeout code and IPv4/IPv6 resolution. Fix #14091	5 years ago
Eugen Rochko	974b1b79ce	Add option to be notified when a followed user posts (#13546) ... * Add bell button Fix #4890 * Remove duplicate type from post-deployment migration * Fix legacy class type mappings * Improve query performance with better index * Fix validation * Remove redundant index from notifications	5 years ago
kawaguchi	5d3c8baa9a	Fix validates :sign_count of WebauthnCredential (#14806)	5 years ago
Eugen Rochko	ed099d8bdc	Change account suspensions to be reversible by default (#14726)	5 years ago
ThibG	cd4ec7cd74	Do not serve account actors at all in limited federation mode (#14800) ... * Do not serve account actors at all in limited federation mode When an account is fetched without a signature from an allowed instance, return an error. This isn't really an improvement in security, as the only information that was previously returned was required protocol-level info, and the only personal bit was the existence of the account. The existence of the account can still be checked by issuing a webfinger query, as those are accepted without signatures. However, this change makes it so that unallowed instances won't create account records on their end when they find a reference to an unknown account. The previous behavior of rendering a limited list of fields, instead of not rendering the actor at all, was in order to prevent situations in which two instances in Authorized Fetch mode or Limited Federation mode would fail to reach each other because resolving an account would require a signed query… from an account which can only be fetched with a signed query itself. However, this should now be fine as fetching accounts is done by signing on behalf of the special instance actor, which does not require any kind of valid signature to be fetched. * Fix tests	5 years ago
Eugen Rochko	4e4b3a0c8e	Refactor settings controllers (#14767) ... - Disallow suspended accounts from revoking sessions and apps - Allow suspended accounts to access exports	5 years ago
Eugen Rochko	65760f59df	Refactor feed manager (#14761)	5 years ago
ThibG	517af45e32	Fix multiple boosts of a same toot erroneously appearing in TL (#14759) ... * Check for and record reblog info atomically Instead of using ZREVRANK to determine whether a reblog is a new reblog or not, use ZADD's NX option to perform the check/addition option atomically. * Replace ZREVRANK call with ZSCORE key which is more efficient * Make tests a bit stricter * Fix off-by-one	5 years ago
Eugen Rochko	e8bc187845	Refactor how public and tag timelines are queried (#14728)	5 years ago
Eugen Rochko	68d3b160de	Fix various warnings in rspec (#14729)	5 years ago
ThibG	79305428a7	Add configuration option to filter replies in lists (#9205) ... * Add database support for list show-reply preferences * Add backend support to read and update list-specific show_replies settings * Add basic UI to set list replies setting * Add specs for list replies policy * Switch "cycling" reply policy link to a set of radio inputs * Capitalize replies_policy strings * Change radio button design to be consistent with that of the directory explorer	5 years ago
Eugen Rochko	52157fdcba	Add support for dereferencing objects through bearcaps (#14683)	5 years ago
santiagorodriguez96	9cadd40cf4	refactor: add email previews for WebAuthn emails (#14658) ... This is a leftover for the work done in #14466.	5 years ago
santiagorodriguez96	e8d41bc2fe	Add WebAuthn as an alternative 2FA method (#14466) ... * feat: add possibility of adding WebAuthn security keys to use as 2FA This adds a basic UI for enabling WebAuthn 2FA. We did a little refactor to the Settings page for editing the 2FA methods – now it will list the methods that are available to the user (TOTP and WebAuthn) and from there they'll be able to add or remove any of them. Also, it's worth mentioning that for enabling WebAuthn it's required to have TOTP enabled, so the first time that you go to the 2FA Settings page, you'll be asked to set it up. This work was inspired by the one donde by Github in their platform, and despite it could be approached in different ways, we decided to go with this one given that we feel that this gives a great UX. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add request for WebAuthn as second factor at login if enabled This commits adds the feature for using WebAuthn as a second factor for login when enabled. If users have WebAuthn enabled, now a page requesting for the use of a WebAuthn credential for log in will appear, although a link redirecting to the old page for logging in using a two-factor code will also be present. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add possibility of deleting WebAuthn Credentials Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: disable WebAuthn when an Admin disables 2FA for a user Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: remove ability to disable TOTP leaving only WebAuthn as 2FA Following examples form other platforms like Github, we decided to make Webauthn 2FA secondary to 2FA with TOTP, so that we removed the possibility of removing TOTP authentication only, leaving users with just WEbAuthn as 2FA. Instead, users will have to click on 'Disable 2FA' in order to remove second factor auth. The reason for WebAuthn being secondary to TOPT is that in that way, users will still be able to log in using their code from their phone's application if they don't have their security keys with them – or maybe even lost them. * We had to change a little the flow for setting up TOTP, given that now it's possible to setting up again if you already had TOTP, in order to let users modify their authenticator app – given that now it's not possible for them to disable TOTP and set it up again with another authenticator app. So, basically, now instead of storing the new `otp_secret` in the user, we store it in the session until the process of set up is finished. This was because, as it was before, when users clicked on 'Edit' in the new two-factor methods lists page, but then went back without finishing the flow, their `otp_secret` had been changed therefore invalidating their previous authenticator app, making them unable to log in again using TOTP. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * refactor: fix eslint errors The PR build was failing given that linting returning some errors. This commit attempts to fix them. * refactor: normalize i18n translations The build was failing given that i18n translations files were not normalized. This commits fixes that. * refactor: avoid having the webauthn gem locked to a specific version * refactor: use symbols for routes without '/' * refactor: avoid sending webauthn disabled email when 2FA is disabled When an admins disable 2FA for users, we were sending two mails to them, one notifying that 2FA was disabled and the other to notify that WebAuthn was disabled. As the second one is redundant since the first email includes it, we can remove it and send just one email to users. * refactor: avoid creating new env variable for webauthn_origin config * refactor: improve flash error messages for webauthn pages Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>	5 years ago
ThibG	720214feb0	Add support for inlined objects in activity audience (#14514) ... * Add support for inlined objects in activity audience * Add tests	5 years ago
ThibG	f6a82cb2cd	Fix not being able to unbookmark toots when blocked by their author (#14604) ... * Fix not being able to unbookmark toots when blocked by their author * Add tests	5 years ago
ThibG	8d217d7231	Improve email address validation (#14565) ... * Increase DNS timeout from 1 second to 5 seconds for MX check 1 seconds is rather short when using a recursive DNS resolver which hasn't got a cached result already available. Use 5 seconds instead, which is the timeout value we use for outgoing HTTP queries. * Add more precise error messages for invalid e-mail addresses	5 years ago
ThibG	a1412491b7	Change content-type to be always computed from file data (#14452) ... * Change content-type to be always computed from file data Restore previous behavior, detecting the content-type isn't very expensive, and some instances may serve files as application/octet-stream regardless of their true type, making fetching media from them fail, while it used to work pre-3.2.0. * Add test	5 years ago
ThibG	bfd5aea206	Fix handling of Reject Follow when a matching follow relationship exists (#14479) ... * Add tests * Fix handling of Reject Follow when a matching follow relationship exists Regression from #12199	5 years ago
ThibG	5d9acc0ce4	Fix not handling Undo on some activity types when they aren't inlined (#14346) ... * Fix not handling Undo on some activity types when they aren't inlined When receiving an Undo for a non-inlined activity, try looking it up in database using the URI. The queries are ad-hoc because we don't have a global index of object URIs, and not all activity types are stored in database with an index on their URI. Announces are just statuses, and have an index on URIs, so this check can be done efficiently. Accepts cannot be handled at all because we don't record their URI at any point. Follows don't have an index on URI, but they have an index on the issuing account, which should make such queries largely manageable. Likes don't have an index on URI, they have an index on the issuing account, but the number of favs per account may be very high, so I decided not to handle that. Blocks don't have an index on URI, but they have an index on the issuing account, which should make such queries largely manageable. In all cases, if an Undo could not be handled properly, we call `delete_later!` because that does not require us to know more than the URI of the undone property. * Add tests * Make newer blocks overwrite older ones Allows re-synchronizing block info by re-blocking and un-blocking again when the original Undo Block has been lost.	5 years ago
ThibG	f55dd193f9	Fix RSS feeds not being cachable (#14368) ... * Add tests for some cachable responses This only covers responses that we should have managed to make cachable so far. It's not the case of all responses that should be cachable in the end. * Fix RSS feeds not being cachable	5 years ago
ThibG	322d74fc2a	Fix boosted toots from blocked account not being retroactively removed from TL (#14339) ... * Fix boosted toots from blocked account not being retroactively removed from TL Fixes #14301 * Add test for clear_from_timeline	5 years ago
ThibG	d658af7ff8	Fix removing allowed domains being done synchronously (#14302) ... * Fix removing allowed domains being done synchronously * Add tests	5 years ago
ThibG	0a8a3fe595	Fix being unable to unboost when blocked by their author (#14308) ... Fixes #14307	5 years ago
Eugen Rochko	6e25574ce5	Fix media attachments enumeration (#14254) ... * Fix media attachment enumeration * Switch media_attachments id to snowflake ids Co-authored-by: Thibaut Girka <thib@sitedethib.com>	5 years ago
ThibG	e96e9cae62	Add test for removing endorsed accounts on account deletion/suspension (#14241)	5 years ago
ThibG	35cedc922c	Change move handler to carry blocks over (#14144) ... * Change move handler to carry blocks and mutes over When user A blocks user B and B moves to a new account C, make A block C accordingly. Note that it only works if A's instance is aware of the Move, that is, if B is on A's instance or has followers there. * Also notify instances with known people blocking you when moving * Add automatic account notes when blocking/muting an account that had no note	5 years ago
Eugen Rochko	7aaf2b44ec	Fix remote files not using Content-Type header, streaming (#14184)	5 years ago
ThibG	65506bac3f	Add user notes on accounts (#14148) ... * Add UserNote model * Add UI for user notes * Put comment in relationships entity * Add API to create user notes * Copy user notes to new account when receiving a Move activity * Address some of the review remarks * Replace modal by inline edition * Please CodeClimate * Button design changes * Change design again * Cancel note edition when pressing Escape * Fixes * Tweak design again * Move “Add note” item, and allow users to add notes to themselves * Rename UserNote into AccountNote, rename “comment” Relationship attribute to “note”	5 years ago
Eugen Rochko	1b198d6489	Fix trying to write non-existent image remote URL attribute on preview cards (#14181) ... Regression from #14145	5 years ago
Eugen Rochko	64aac30733	Add customizable thumbnails for audio and video attachments (#14145) ... - Change audio files to not be stripped of metadata - Automatically extract cover art from audio if it exists - Add `thumbnail` parameter to `POST /api/v1/media`, `POST /api/v2/media` and `PUT /api/v1/media/:id` - Add `icon` to represent it in attachments in ActivityPub - Fix `preview_url` containing URL of missing missing image when there is no thumbnail instead of null - Fix duration of audio not being displayed on public pages until the file is loaded	5 years ago
ThibG	89f40b6c3e	Make domain block/silence/reject-media code more robust (#13424) ... * Split media cleanup from reject-media domain blocks to its own service * Slightly improve ClearDomainMediaService error handling * Lower DomainClearMediaWorker to lowest-priority queue * Do not catch ActiveRecord::RecordNotFound in domain block workers * Fix DomainBlockWorker spec labels * Add some specs * Change domain blocks to immediately mark accounts as suspended Rather than doing so sequentially, account after account, while cleaning their data. This doesn't change much about the time the block takes to complete, but it immediately prevents interaction with the blocked domain, while up to now, it would only be guaranteed when the process ends.	6 years ago
Eugen Rochko	72a7cfaa39	Add e-mail-based sign in challenge for users with disabled 2FA (#14013)	6 years ago
ThibG	aed3a436a2	Fix serialization of replies when some of them are URIs (#13957) ... * Fix serialization of replies when some of them are URIs Fixes #13956 * Add test	6 years ago
Eugen Rochko	5d8398c8b8	Add E2EE API (#13820)	6 years ago
ThibG	a319c1e60f	Add support for `summary` field for media description (#13763)	6 years ago
ThibG	27ea7c13a5	Fix hashtag search performing account search as well (#13758)	6 years ago
ThibG	71fce71c94	Fix webfinger returning wrong status code on malformed or missing param (#13759) ... Fixes #13757	6 years ago
dependabot-preview[bot]	78202e9138	Bump doorkeeper from 5.3.3 to 5.4.0 (#13733) ... * Bump doorkeeper from 5.3.3 to 5.4.0 Bumps [doorkeeper](https://github.com/doorkeeper-gem/doorkeeper) from 5.3.3 to 5.4.0. - [Release notes](https://github.com/doorkeeper-gem/doorkeeper/releases) - [Changelog](https://github.com/doorkeeper-gem/doorkeeper/blob/master/CHANGELOG.md) - [Commits](https://github.com/doorkeeper-gem/doorkeeper/compare/v5.3.3...v5.4.0) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> * Fix tests * Fix use of Doorkeeper::AccessToken.find_or_create_for * Fix tests? Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com> Co-authored-by: Thibaut Girka <thib@sitedethib.com>	6 years ago
ThibG	4bcef12bad	Fix sr locale being selected over sr-Latn (#13693) ... * Fix sr locale being selected over sr-Latn * Update tests	6 years ago
Eugen Rochko	4b766f9846	Refactor monkey-patching of Goldfinger (#12561)	6 years ago
Eugen Rochko	8be4c2ba21	Add ability to remove identity proofs from account (#13682) ... Fix #12613	6 years ago
Takeshi Umeda	26b08a3c54	Add remote only to public timeline (#13504) ... * Add remote only to public timeline * Fix code style	6 years ago
ThibG	a4240fd027	Improve RSS entries for statuses (#13592) ... * Improve RSS entries for statuses - Render polls in both accounts and tags serializers - Refactor RSS serializers - Change title preview to include ellipsis when truncated - Change title preview to show CW instead of toot text - Add tests * Remove title from OEmbed serialization Twitter doesn't serialize title either, and tihs allows us to move the title formatting code to the RSS serializers.	6 years ago
ThibG	f1e0fa80f6	Fix own following/followers not showing muted users (#13614) ... Fixes #13612	6 years ago
Taras Gogol	6748a5acb1	Fix followings list order | Issue #13538 (#13676)	6 years ago
Eugen Rochko	5cff7910c2	Add more ActivityPub controller tests (#13590)	6 years ago
Yamagishi Kazutoshi	e223fd8c61	Revert "improve status title (#8596)" (#13591) ... This reverts commit 05756c9a14.	6 years ago
Eugen Rochko	988b0493fe	Add more tests for ActivityPub controllers (#13585)	6 years ago
Eugen Rochko	2744f61696	Fix not being able to resolve public resources in development environment (#13505)	6 years ago