mastodon

Commit Graph

Author	SHA1	Message	Date
Claire	dd63923c0a	Fix link_to_login argument handling when a block is passed (#17345 )	3 years ago
Claire	0a120d86d2	Fix error-prone SQL queries (#15828 ) * Fix error-prone SQL queries in Account search While this code seems to not present an actual vulnerability, one could easily be introduced by mistake due to how the query is built. This PR parameterises the `to_tsquery` input to make the query more robust. * Harden code for Status#tagged_with_all and Status#tagged_with_none Those two scopes aren't used in a way that could be vulnerable to an SQL injection, but keeping them unchanged might be a hazard. * Remove unneeded spaces surrounding tsquery term * Please CodeClimate * Move advanced_search_for SQL template to its own function This avoids one level of indentation while making clearer that the SQL template isn't build from all the dynamic parameters of advanced_search_for. * Add tests covering tagged_with, tagged_with_all and tagged_with_none * Rewrite tagged_with_none to avoid multiple joins and make it more robust * Remove obsolete brakeman warnings * Revert "Remove unneeded spaces surrounding tsquery term" The two queries are not strictly equivalent. This reverts commit `86f16c537e`.	3 years ago
Claire	a63495230a	Change `percent` to `rate` in retention metrics API (#16910 )	3 years ago
Claire	bddd9ba36d	Add OMNIAUTH_ONLY environment variable to enforce externa log-in (#17288 ) * Remove support for OAUTH_REDIRECT_AT_SIGN_IN Fixes #15959 Introduced in #6540, OAUTH_REDIRECT_AT_SIGN_IN allowed skipping the log-in form to instead redirect to the external OmniAuth login provider. However, it did not prevent the log-in form on /about introduced by #10232 from appearing, and completely broke with the introduction of #15228. As I restoring that previous log-in flow without introducing a security vulnerability may require extensive care and knowledge of how OmniAuth works, this commit removes support for OAUTH_REDIRECT_AT_SIGN_IN instead for the time being. * Add OMNIAUTH_ONLY environment variable to enforce external log-in only * Disable user registration when OMNIAUTH_ONLY is set to true * Replace log-in links When OMNIAUTH_ONLY is set with exactly one OmniAuth provider	3 years ago
Claire	cfa583fa71	Remove support for OAUTH_REDIRECT_AT_SIGN_IN (#17287 ) Fixes #15959 Introduced in #6540, OAUTH_REDIRECT_AT_SIGN_IN allowed skipping the log-in form to instead redirect to the external OmniAuth login provider. However, it did not prevent the log-in form on /about introduced by #10232 from appearing, and completely broke with the introduction of #15228. As I restoring that previous log-in flow without introducing a security vulnerability may require extensive care and knowledge of how OmniAuth works, this commit removes support for OAUTH_REDIRECT_AT_SIGN_IN instead for the time being.	3 years ago
Claire	8a07ecd377	Remove leftover database columns from Devise::Models::Rememberable (#17191 ) * Remove leftover database columns from Devise::Models::Rememberable * Update fix-duplication maintenance script * Improve errors/warnings in the fix-duplicates maintenance script	3 years ago
Claire	3a103cd317	Fix text being incorrectly pre-selected in composer textarea on /share (#17339 ) Fixes #17295	3 years ago
Claire	6eea3f8f9c	Add post edited notice in admin and public UIs (#17335 ) * Add edited toot flag on public pages * Add toot edit flag to admin pages	3 years ago
Eugen Rochko	9eb775a9d1	Fix error when using raw distribution worker (#17334 ) Regression from #16697	3 years ago
Eugen Rochko	d412a8d1f2	Fix error when processing poll updates (#17333 ) Regression from #16697	3 years ago
Eugen Rochko	1060666c58	Add support for editing for published statuses (#16697 ) * Add support for editing for published statuses * Fix references to stripped-out code * Various fixes and improvements * Further fixes and improvements * Fix updates being potentially sent to unauthorized recipients * Various fixes and improvements * Fix wrong words in test * Fix notifying accounts that were tagged but were not in the audience * Fix mistake	3 years ago
Jeong Arm	2d1f082bb6	Fix NameError on ActivityPub::FetchFeaturedCollectionService (#17326 ) Related: #16954	3 years ago
Claire	c60f8ce032	Fix `pinned` attribute not being set for private self-posts (#17304 )	3 years ago
Eugen Rochko	14f436c457	Add notifications for statuses deleted by moderators (#17204 )	3 years ago
Claire	d5c9feb7b7	Add support for private pinned posts (#16954 ) * Add support for private pinned toots * Allow local user to pin private toots * Change wording to avoid "direct message"	3 years ago
Claire	081e4426f8	Fix admin interface crash when displaying deleted user (#17301 )	3 years ago
Eugen Rochko	8e84ebf0cb	Remove IP tracking columns from users table (#16409 )	3 years ago
Jeong Arm	bc7a8ae6d6	Gradually increase retry waiting for media processing (#17271 )	3 years ago
Jeong Arm	d3db2eb7fb	Remove custom emojis on domain purge (#17210 )	3 years ago
Claire	37e80994f8	Fix media descriptions not being used for client-side filtering (#17206 ) Fix oversight in #13837	3 years ago
Eugen Rochko	fe71548844	Fix warnings on Rails boot (#16946 )	3 years ago
Rens Groothuijsen	e65080181a	Fix tag rendering error in hashtag column settings (#17184 ) * Flatten tags in configuration to regular array before converting to JSON * Render filter tags using toJS instead of toJSON	3 years ago
Jeong Arm	720e8ab0f5	Fix duplicate record on admin/accounts when searching with IP (#17150 )	3 years ago
Claire	76761d5fc0	Add ability for admins to delete canonical email blocks (#16644 ) * Add admin option to remove canonical email blocks from a deleted account * Add tootctl canonical_email_blocks to inspect and remove canonical email blocks	3 years ago
Claire	7f803c41e2	Add ability to purge undeliverable domains from admin interface (#16686 ) * Add ability to purge undeliverable domains from admin interface * Add tests	3 years ago
Claire	0c17fd9109	Change title of retention chart (#16909 ) Changes from “Retention” to “User retention rate by month after sign-up”. This should make it much clearer to people not familiar with retention charts what it actually means.	3 years ago
Claire	40f202c1e5	Change list title input styling (#17092 )	3 years ago
David Sterry	2aafa5b4e7	ignore hashtag suggestions if they vary only in case (#16460 ) * ignore hashtag suggestions if they vary only in case * remove console.logs and unused args * consistently add space when dismissing suggestions * linting	3 years ago
Takeshi Umeda	bda8e4f815	Fix follow recommendation biased towards older accounts (#17126 )	3 years ago
Eugen Rochko	fe45184b36	Change trending hashtags threshold back from 15 to 5 (#17122 )	3 years ago
heguro	41503507ec	Fix redirection when succeeded WebAuthn (#17098 )	3 years ago
Rens Groothuijsen	66baa629ea	Show correct error message if chosen password is too long (#17082 ) * Add correct error message for exceeding max length on password confirmation field * Code style fixes	3 years ago
Eugen Rochko	0fb9536d38	Add batch suspend for accounts in admin UI (#17009 )	3 years ago
Eugen Rochko	a458b74c7e	Fix error on trending mailer due to missing constant (#17072 )	3 years ago
Jeong Arm	4a109ec1ba	Fix server graph on admin/tags/:id (#17066 )	3 years ago
Jeong Arm	1c826471e7	Fix admin statuses order(#16937 ) (#16969 ) * Fix #16937 * Add test for statuses order	3 years ago
Claire	3f382e337d	Fix searching for additional hashtags in hashtag column (#17054 )	3 years ago
Claire	1630807ee2	Fix color of hashtag column settings inputs (#17058 ) Fixes #17057	3 years ago
Claire	ddcb9da74f	Fix opening wrong profile when clicking on username of boosting user in WebUI (#17060 ) Fixes #16799	3 years ago
Eugen Rochko	7de0ee7aba	Remove Keybase integration (#17045 )	3 years ago
Eugen Rochko	12b3ff6c6d	Fix error on trending hashtags/links pages in admin UI due to missing constant (#17044 )	3 years ago
Claire	b1fd6d4490	Fix handling of recursive toots in WebUI (#17041 )	3 years ago
Claire	013bee6afb	Fix filtering DMs from non-followed users (#17042 )	3 years ago
Eugen Rochko	6e50134a42	Add trending links (#16917 ) * Add trending links * Add overriding specific links trendability * Add link type to preview cards and only trend articles Change trends review notifications from being sent every 5 minutes to being sent every 2 hours Change threshold from 5 unique accounts to 15 unique accounts * Fix tests	3 years ago
Claire	02a87431cf	Fix error when suspending user with an already-existing canonical email block (#17036 ) * Fix error when suspending user with an already-existing canonical email block Fixes #17033 While attempting to create a `CanonicalEmailBlock` with an existing hash would raise an `ActiveRecord::RecordNotUnique` error, this being done within a transaction would cancel the whole transaction. For this reason, checking for uniqueness in Rails would query the database within the transaction and avoid invalidating the whole transaction for this reason. A race condition is still possible, where multiple accounts sharing a canonical email would be blocked in concurrent transactions, in which only one would succeed, but that is way less likely to happen that the current issue, and can always be retried after the first failure, unlike the current situation. * Add tests	3 years ago
Claire	db32835338	Fix overflow of long profile fields in admin view (#17010 )	3 years ago
Claire	6159020617	Fix background-color of emoji-mart selector (#17011 ) Reverts part of #16907 to fix hardcoded color	3 years ago
Takeshi Umeda	3419d3ec84	Bump chewy from 5.2.0 to 7.2.3 (supports Elasticsearch 7.x) (#16915 ) * Bump chewy from 5.2.0 to 7.2.2 * fix style (codeclimate) * fix style * fix style * Bump chewy from 7.2.2 to 7.2.3	3 years ago
Mashiro	2b6a25c609	Add lazy load to emoji-mart (#16907 ) * perf: lazyload emoji-mart! * Bump lazyload	3 years ago
Claire	3517867b76	Fix confusing error when webfinger request returns empty document (#16986 ) For some reason, some misconfigured servers return an empty document when queried over webfinger. Since an empty document does not lead to a parse error, the error is not caught properly and triggers uncaught exceptions later on. This PR fixes that by immediately erroring out with `Webfinger::Error` on getting an empty response.	3 years ago

1 2 3 4 5 ...

6232 Commits (dd63923c0ae3601de76dee5bcf3a83f875584326)