mastodon

Commit Graph

Author	SHA1	Message	Date
Yamagishi Kazutoshi	afb398b583	Change to always returns html document in error pages (#12214 )	5 years ago
Yamagishi Kazutoshi	d7268befa8	Add healthcheck endpoint for web (#11770 )	6 years ago
Eugen Rochko	22ce4778eb	Fix uncaught parameter missing exceptions and missing error templates (#11702 )	6 years ago
Eugen Rochko	a8b0bb355d	Fix uncaught 422 and 500 errors (#11590 )	6 years ago
Eugen Rochko	6e872c6dab	Fix 422 being returned instead of 404 when POSTing (#11574 )	6 years ago
Eugen Rochko	24552b5160	Add whitelist mode (#11291 )	6 years ago
Eugen Rochko	964ae8eee5	Change unconfirmed user login behaviour (#11375 ) Allow access to account settings, 2FA, authorized applications, and account deletions to unconfirmed and pending users, as well as users who had their accounts disabled. Suspended users cannot update their e-mail or password or delete their account. Display account status on account settings page, for example, when an account is frozen, limited, unconfirmed or pending review. After sign up, login users straight away and show a simple page that tells them the status of their account with links to account settings and logout, to reduce onboarding friction and allow users to correct wrongly typed e-mail addresses. Move the final sign-up step of SSO integrations to be the same as above to reduce code duplication.	6 years ago
Eugen Rochko	c669bb42ba	Add (back) rails-level JSON caching (#11333 )	6 years ago
Eugen Rochko	bd1545de5e	Change locale detection to run once per session (#8657 ) Fix #6462	6 years ago
ThibG	730c4053d6	Add ActivityPub actor representing the entire server (#11321 ) * Add support for an instance actor * Skip username validation for local Application accounts * Add migration script to create instance actor * Make Codeclimate happy * Switch to id -99 for instance actor * Remove unused `icon` and `image` attributes from instance actor * Use if/elsif/else instead of return + ternary operator * Add instance actor to fresh installs * Use instance actor as instance representative Use instance actor for forwarding reports, relay operations, and spam auto-reporting. * Seed database in test environment * Fix single-user mode * Fix tests * Fix specs to accomodate for an extra `Account` * Auto-reject follows on instance actor Following an instance actor might make sense, but we are not handling that right now, so auto-reject. * Fix webfinger lookup and serialization for instance actor * Rename instance actor * Make it clear in the HTML view that the instance actor should not be blocked * Raise cache time for instance actor as there's no dynamic content * Re-use /about/more with a flash message for instance actor profile	6 years ago
ThibG	15ddabf95a	Fix caching headers in ActivityPub endpoints (#11331 ) * Fix reverse-proxy caching in public fetch mode * Fix caching in ActivityPub-specific controllers	6 years ago
Eugen Rochko	5bf67ca913	Add ActivityPub secure mode (#11269 ) * Add HTTP signature requirement for served ActivityPub resources * Change `SECURE_MODE` to `AUTHORIZED_FETCH` * Add 'Signature' to 'Vary' header and improve code style * Improve code style by adding `public_fetch_mode?` method	6 years ago
Eugen Rochko	63c7fe8e48	Refactor controllers for statuses, accounts, and more (#11249 )	6 years ago
Eugen Rochko	6836587117	Fix unnecessary SQL query performed on unauthenticated requests (#11179 )	6 years ago
ThibG	cac9110533	Cleanup various controllers (#10972 ) * Remove skip_session! as it is not supported in Rails 5 * Minor cleanup in StreamEntriesController * Remove redundant mark_cacheable! calls	6 years ago
Ben Lubar	c3d1594576	Reduce server load caused by anonymous viewing. (#9059 ) Do not start a session if the current user is not logged in for public-facing pages. Mark pages that don't care about sessions as publicly cacheable. Keep the max age as 0 so proxies and browsers will still try to retrieve an updated version but can still fall back to the stale version if the site is down or too slow. Fixes #9035.	6 years ago
Eugen Rochko	8069fd636b	Remove intermediary arrays when creating hash maps from results (#9291 )	6 years ago
Eugen Rochko	795f0107d2	Include preview cards in status entity in REST API (#9120 ) * Include preview cards in status entity in REST API * Display preview card in-stream * Improve in-stream display of preview cards	6 years ago
Eugen Rochko	2288d50a7b	Add force_login option to OAuth authorize page (#8655 ) * Add force_login option to OAuth authorize page For when a user needs to sign into an app from multiple accounts on the same server * When logging out from modal header, redirect back after re-login	7 years ago
Eugen Rochko	2f34b747b3	Allow mods to disable login, improve message when login disabled (#8329 ) * Allow moderators to disable/enable login * Instead of rejecting login, show forbidden error when login disabled Avoid confusion because when login is rejected, the message is that the account is not activated, which is wrong. * Fix tests	7 years ago
Jakub Mendyk	6cb3514d64	Add ability to change an instance default theme from the administration panel (#7092 ) (#8381 ) * Add default_settings class method to ScopedSettings ScopedSettings was extended to use value of unscoped setting instead of only using defaults set in config/settings.yml for selected settings. This adds possibility for admins to set default values of users' settings, for example default theme (as requested in #7092). * Add ability to change an instance default theme Closes #7092	7 years ago
abcang	9e75aa30cd	Unuse ActiveRecord::Base#cache_key (#8185 ) * Unuse ActiveRecord::Base#cache_key * Enable cache_versioning * Call cache_collection	7 years ago
Eugen Rochko	ebf2fef029	Catch ActionController::UnknownFormat and return HTTP 406 (#7621 ) An error like that should not appear in production error log.	7 years ago
ThibG	352bae8c3e	Update session activation time (fixes #5605 ) (#7408 )	7 years ago
Emelia Smith	2e59751823	Improve require_admin! and require_staff! filters (#7018 ) Previously these returns 302 redirects instead of 403s, which meant posting links to admin pages in slack caused them to unfurl, rather than stay as a link. Additionally, require_admin! doesn't appear to be actively used, on require_staff!	7 years ago
Eugen Rochko	47bdb9b33b	Fix #942 : Seamless LDAP login (#6556 )	7 years ago
Eugen Rochko	d8bc64bb09	Fix #6526 : Only store redirect location if not in JSON format (#6528 )	7 years ago
Alexander	04fef7b888	pam authentication (#5303 ) * add pam support, without extra column * bugfixes for pam login * document options * fix code style * fix codestyle * fix tests * don't call remember_me without password * fix codestyle * improve checks for pam usage (should fix tests) * fix remember_me part 1 * add remember_token column because :rememberable requires either a password or this column. * migrate db for remember_token * move pam_authentication to the right place, fix logic bug in edit.html.haml * fix tests * fix pam authentication, improve username lookup, add comment * valid? is sometimes not honored, return nil instead trying to authenticate with pam * update devise_pam_authenticatable2 and adjust code. Fixes sideeffects observed in tests * update devise_pam_authenticatable gem, fixes for codeconventions, fix finding user * codeconvention fixes * code convention fixes * fix idention * update dependency, explicit conflict check * fix disabled password updates if in pam mode * fix check password if password is present, fix templates * block registration if account is maintained by pam * Revert "block registration if account is maintained by pam" This reverts commit 8e7a083d650240b6fac414926744b4b90b435f20. * fix identation error introduced by rebase * block usernames maintained by pam * document pam settings better * fix code style	7 years ago
Yamagishi Kazutoshi	1d92b90be9	Fix force_ssl conditional (#6201 )	7 years ago
Yamagishi Kazutoshi	da809f9eec	Fix unintended cache (#6214 )	7 years ago
ThibG	3bee0996c5	Make sure private toots remain private and do not end up in HTTP caches (#6175 )	7 years ago
Eugen Rochko	c10f4bdb03	Cache JSON of immutable ActivityPub representations (#6171 )	7 years ago
Eugen Rochko	38fc1b498d	Add more instance stats APIs (#6125 ) * Add GET /api/v1/instance/peers API to reveal known domains * Add GET /api/v1/instance/activity API * Make new APIs disableable, exclude private statuses from activity stats * Fix code style issue * Fix week timestamps	7 years ago
Eugen Rochko	3e90987c8b	Fix some rubocop style issues (#5730 )	7 years ago
Eugen Rochko	7bb8b0b2fc	Add moderator role and add pundit policies for admin actions (#5635 ) * Add moderator role and add pundit policies for admin actions * Add rake task for turning user into mod and revoking it again * Fix handling of unauthorized exception * Deliver new report e-mails to staff, not just admins * Add promote/demote to admin UI, hide some actions conditionally * Fix unused i18n	7 years ago
Andrew	0401a24558	Add support for multiple themes (#4959 ) * Add support for selecting a theme * Fix codeclimate issues * Look up site default style if current user is not available due to e.g. not being logged in * Remove outdated comment in common.js * Address requested changes in themes PR * Fix codeclimate issues * Explicitly check current_account in application controller and only check theme availability if non-nil * codeclimate * explicit precedence with && * Fix code style in application_controller according to @nightpool's suggestion, use default style in embedded.html.haml * codeclimate: indentation + return	7 years ago
Eugen Rochko	df605f0f8b	Add "signed in as" header to some pages (#4523 )	8 years ago
Eugen Rochko	00df69bc89	Fix #4058 - Use a long-lived cookie to keep track of user-level sessions (#4091 ) * Fix #4058 - Use a long-lived cookie to keep track of user-level sessions * Fix tests, smooth migrate from previous session-based identifier	8 years ago
Eugen Rochko	ed7dc1704d	Bind web UI access tokens to sessions (#3940 ) * Add overview of active sessions * Better display of browser/platform name * Improve how browser information is stored and displayed for sessions overview * Fix test * Fix #2347 - Bind web UI access token to session When you logout, session also destroys the access token, so it's no longer valid. If access token is destroyed some other way, the session is also destroyed, requiring a re-login. Fix #1681 - Add scheduler to remove revoked access tokens and grants * Fix test	8 years ago
Yamagishi Kazutoshi	676ba50601	Show error message to suspended user (#3281 )	8 years ago
Yamagishi Kazutoshi	73e4468ff3	Change "Account.any?" to "Account.exists?" (#3217 )	8 years ago
Akihiko Odaki	aa662cecad	single_user_mode? always returns boolean (#3215 ) This change also adds a specification for the method.	8 years ago
Matt Jankowski	7bffd16024	Error responses cleanup (#2692 ) * Use respond_with_error for forbidden errors * Wrap up common error code into single method	8 years ago
Matt Jankowski	fdcf884cf7	Extract user tracking into concern (#2600 )	8 years ago
alpaca-tc	9317ec8eb1	Localize with i18n for Devise::FailureApp (#2309 ) This PR fixes I18n.locale for rake middlewares. Mastodon uses Devise that depends on Warden. Warden::Manager can be found in rake middleware. It is outside of the controller. In the case of authentication failed, warden calls throw(:warden). At the time Warden::Manager delegates request to failure_app to generate response and flash[:alert] after catching it. Unfortunately, I18n.locale is already reset then because I18n.with_locale is enabled only inside the controller. If we used I18n.locale=, Devise::FailureApp could get the current locale.	8 years ago
Matt Jankowski	a0dd90a397	Return force_ssl to the controller (#2380 )	8 years ago
Evan Minto	66fd8e7821	ActivityPub: Add basic, read-only support for Outboxes, Notes, and Create/Announce Activities (#2197 ) * Clean up collapsible components * Expose user Outboxes and AS2 representations of statuses * Save work thus far. * Fix bad merge. * Save my work * Clean up pagination. * First test working. * Add tests. * Add Forbidden error template. * Revert yarn.lock changes. * Fix code style deviations and use localized instead of hardcoded English text.	8 years ago
Matt Jankowski	ee82d8a876	Move force_ssl check to production config (#2165 ) The force_ssl method from controllers does not add all of the options that the sitewide configuration in a config block does. For example, HSTS enforcement is not added by the controller method, but is added by this style.	8 years ago
Takayoshi Nishida	5e33ad29d4	Fix #2195 - Set locale to error pages (#2255 ) * Fix #2195 - Set locale to error pages * Fix #2195 - Cut duplicate process into one method	8 years ago
Eugen	5d710b1139	Make file attachment on MediaAttachment optional (#1865 ) Create MediaAttachment but without actual file download when domain is blocked with reject_media set to true Clean up old media files when creating a new domain block with reject_media set to true Return remote_url in media attachments API if local file is not present Undo domain block action in admin UI Ability to enable reject_media from admin UI	8 years ago

1 2

90 Commits (df15a2cd375da328f16537655aca15c8dd3030e5)