mastodon

Commit Graph

Author	SHA1	Message	Date
Claire	7396a254c1	Fix empty batch statuses selection causing a 500 error (#17532 ) * Fix empty batch statuses selection causing a 500 error * Simplify current_params	4 years ago
Eugen Rochko	8f03b7a2fb	Add notifications when a reblogged status has been updated (#17404 ) * Add notifications when a reblogged status has been updated * Change wording to say "edit" instead of "update" and add missing controls * Replace previous update notifications with the most up-to-date one	4 years ago
Eugen Rochko	d0fcf07436	Change actions in reports to require only one click (#17487 )	4 years ago
Eugen Rochko	63002cde03	Add editing for published statuses (#17320 ) * Add editing for published statuses * Fix change of multiple-choice boolean in poll not resetting votes * Remove the ability to update existing media attachments for now	4 years ago
Eugen Rochko	2f8159baad	Add `category` and `rule_ids` params to `POST /api/v1/reports` (#17492 )	4 years ago
Eugen Rochko	fd3a45e348	Add edit history to web UI (#17390 ) * Add edit history to web UI * Change history reducer to store items per status * Fix missing loading prop	4 years ago
Eugen Rochko	85b86fe28c	Add global `locale` param (#17464 ) - Remove the session-based locale stickyness	4 years ago
Claire	73a782391c	Fix replies collection incorrectly looping (#17462 ) * Refactor tests * Add tests * Fix replies collection incorrectly looping	4 years ago
Claire	92658f0fb0	Fix instance actor not being dereferenceable (#17457 ) * Add tests * Fix instance actor not being dereferenceable * Fix tests * Fix tests for real	4 years ago
Eugen Rochko	e03e7ac290	Fix error on account relationships page in admin UI (#17444 )	4 years ago
Claire	f5639e1cbe	Change public profile pages to be disabled for unconfirmed users (#17385 ) Fixes #17382 Note that unconfirmed and unapproved accounts can still be searched for and their (empty) account retrieved using the REST API.	4 years ago
Claire	03d59340da	Fix Sidekiq warnings about JSON serialization (#17381 ) * Fix Sidekiq warnings about JSON serialization This occurs on every symbol argument we pass, and every symbol key in hashes, because Sidekiq expects strings instead. See https://github.com/mperham/sidekiq/pull/5071 We do not need to change how workers parse their arguments because this has not changed and we were already converting to symbols adequately or using `with_indifferent_access`. * Set Sidekiq to raise on unsafe arguments in test mode In order to more easily catch issues that would produce warnings in production code.	4 years ago
Claire	bddd9ba36d	Add OMNIAUTH_ONLY environment variable to enforce externa log-in (#17288 ) * Remove support for OAUTH_REDIRECT_AT_SIGN_IN Fixes #15959 Introduced in #6540, OAUTH_REDIRECT_AT_SIGN_IN allowed skipping the log-in form to instead redirect to the external OmniAuth login provider. However, it did not prevent the log-in form on /about introduced by #10232 from appearing, and completely broke with the introduction of #15228. As I restoring that previous log-in flow without introducing a security vulnerability may require extensive care and knowledge of how OmniAuth works, this commit removes support for OAUTH_REDIRECT_AT_SIGN_IN instead for the time being. * Add OMNIAUTH_ONLY environment variable to enforce external log-in only * Disable user registration when OMNIAUTH_ONLY is set to true * Replace log-in links When OMNIAUTH_ONLY is set with exactly one OmniAuth provider	4 years ago
Claire	cfa583fa71	Remove support for OAUTH_REDIRECT_AT_SIGN_IN (#17287 ) Fixes #15959 Introduced in #6540, OAUTH_REDIRECT_AT_SIGN_IN allowed skipping the log-in form to instead redirect to the external OmniAuth login provider. However, it did not prevent the log-in form on /about introduced by #10232 from appearing, and completely broke with the introduction of #15228. As I restoring that previous log-in flow without introducing a security vulnerability may require extensive care and knowledge of how OmniAuth works, this commit removes support for OAUTH_REDIRECT_AT_SIGN_IN instead for the time being.	4 years ago
Eugen Rochko	1060666c58	Add support for editing for published statuses (#16697 ) * Add support for editing for published statuses * Fix references to stripped-out code * Various fixes and improvements * Further fixes and improvements * Fix updates being potentially sent to unauthorized recipients * Various fixes and improvements * Fix wrong words in test * Fix notifying accounts that were tagged but were not in the audience * Fix mistake	4 years ago
Eugen Rochko	14f436c457	Add notifications for statuses deleted by moderators (#17204 )	4 years ago
Claire	d5c9feb7b7	Add support for private pinned posts (#16954 ) * Add support for private pinned toots * Allow local user to pin private toots * Change wording to avoid "direct message"	4 years ago
Eugen Rochko	8e84ebf0cb	Remove IP tracking columns from users table (#16409 )	4 years ago
Claire	76761d5fc0	Add ability for admins to delete canonical email blocks (#16644 ) * Add admin option to remove canonical email blocks from a deleted account * Add tootctl canonical_email_blocks to inspect and remove canonical email blocks	4 years ago
Claire	7f803c41e2	Add ability to purge undeliverable domains from admin interface (#16686 ) * Add ability to purge undeliverable domains from admin interface * Add tests	4 years ago
heguro	41503507ec	Fix redirection when succeeded WebAuthn (#17098 )	4 years ago
Eugen Rochko	0fb9536d38	Add batch suspend for accounts in admin UI (#17009 )	4 years ago
Jeong Arm	1c826471e7	Fix admin statuses order(#16937 ) (#16969 ) * Fix #16937 * Add test for statuses order	4 years ago
Eugen Rochko	7de0ee7aba	Remove Keybase integration (#17045 )	4 years ago
Eugen Rochko	6e50134a42	Add trending links (#16917 ) * Add trending links * Add overriding specific links trendability * Add link type to preview cards and only trend articles Change trends review notifications from being sent every 5 minutes to being sent every 2 hours Change threshold from 5 unique accounts to 15 unique accounts * Fix tests	4 years ago
Claire	6da135a493	Fix reviving revoked sessions and invalidating login (#16943 ) Up until now, we have used Devise's Rememberable mechanism to re-log users after the end of their browser sessions. This mechanism relies on a signed cookie containing a token. That token was stored on the user's record, meaning it was shared across all logged in browsers, meaning truly revoking a browser's ability to auto-log-in involves revoking the token itself, and revoking access from all logged-in browsers. We had a session mechanism that dynamically checks whether a user's session has been disabled, and would log out the user if so. However, this would only clear a session being actively used, and a new one could be respawned with the `remember_user_token` cookie. In practice, this caused two issues: - sessions could be revived after being closed from /auth/edit (security issue) - auto-log-in would be disabled for all browsers after logging out from one of them This PR removes the `remember_token` mechanism and treats the `_session_id` cookie/token as a browser-specific `remember_token`, fixing both issues.	4 years ago
Jeong Arm	458830ee7c	Fix statuses order in account's statuses admin page (#16937 )	4 years ago
Takeshi Umeda	17f4e457b3	Add remove from followers api (#16864 ) * Add followed_by? to account_interactions * Add RemoveFromFollowersService * Fix AccountBatch to use RemoveFromFollowersService * Add remove from followers API	4 years ago
Eugen Rochko	07341e7aa6	Add graphs and retention metrics to admin dashboard (#16829 )	4 years ago
Claire	5159ba26e4	Fix error when rendering public pages with media attachments (#16763 ) * Add tests * Fix error when rendering public pages with media attachments * Add tests * Fix tests * Please CodeClimate	4 years ago
Claire	24f9ea7818	Fix webauthn secure key authentication (#16792 ) * Add tests * Fix webauthn secure key authentication Fixes #16769	4 years ago
Eugen Rochko	52e5c07948	Change routing paths to use usernames in web UI (#16171 )	4 years ago
Claire	e0af97164a	Fix followers synchronization mechanism not working when URI has empty path (#16744 ) Follow-up to #16510, forgot the controller exposing the actual followers…	4 years ago
Truong Nguyen	7283a5d3b9	Explicitly set userVerification to discoraged (#16545 )	4 years ago
Claire	94bcf45321	Fix authentication failures after going halfway through a sign-in attempt (#16607 ) * Add tests * Add security-related tests My first (unpublished) attempt at fixing the issues introduced (extremely hard-to-exploit) security vulnerabilities, addressing them in a test. * Fix authentication failures after going halfway through a sign-in attempt * Refactor `authenticate_with_sign_in_token` and `authenticate_with_two_factor` to make the two authentication steps more obvious	4 years ago
Daniel	5c21021176	Fix undefined variable for Auth::OmniauthCallbacksController (#16654 ) The addition of authentication history broke the omniauth login with the following error: method=GET path=/auth/auth/cas/callback format=html controller=Auth::OmniauthCallbacksController action=cas status=500 error='NameError: undefined local variable or method `user' for #<Auth::OmniauthCallbacksController:0x00000000036290> Did you mean? @user' duration=435.93 view=0.00 db=36.19 * app/controllers/auth/omniauth_callbacks_controller.rb: fix variable name to `@user`	4 years ago
Claire	4ac78e2a06	Add feature to automatically delete old toots (#16529 ) * Add account statuses cleanup policy model * Record last inspected toot to delete to speed up successive calls to statuses_to_delete * Add service to cleanup a given account's statuses within a budget * Add worker to go through account policies and delete old toots * Fix last inspected status id logic All existing statuses older or equal to last inspected status id must be kept by the current policy. This is an invariant that must be kept so that resuming deletion from the last inspected status remains sound. * Add tests * Refactor scheduler and add tests * Add user interface * Add support for discriminating based on boosts/favs * Add UI support for min_reblogs and min_favs, rework UI * Address first round of review comments * Replace Snowflake#id_at_start with with_random parameter * Add tests * Add tests for StatusesCleanupController * Rework settings page * Adjust load-avoiding mechanisms * Please CodeClimate	4 years ago
Claire	d8629e7b86	Add logging of S3-related errors (#16381 )	4 years ago
Claire	30ce6e395c	Fix user email address being banned on self-deletion (#16503 ) * Add tests * Fix user email address being banned on self-deletion Fixes #16498	4 years ago
Eugen Rochko	771c9d4ba8	Add ability to skip sign-in token authentication for specific users (#16427 ) Remove "active within last two weeks" exception for sign in token requirement Change admin reset password to lock access until the password is reset	4 years ago
Claire	49219508bc	Fix anonymous access to outbox not being cached by the reverse proxy (#16458 ) * Fix anonymous access to outbox not being cached by the reverse proxy Up until now, anonymous access to outbox was marked as public, but with a 0 duration for caching, which means remote proxies would only serve from cache when the server was completely overwhelmed. Changed that cache duration to one minute, so that repeated anonymous access to one account's outbox can be appropriately cached. Also added `Signature` to the `Vary` header in case a page is requested, so that authenticated fetches are never served from cache (which only contains public toots). * Remove Vary: Accept header from webfinger controller Indeed, we have stopped returning xrd, and only ever return jrd, so the Accept request header does not matter anymore. * Cache negative webfinger hits for 3 minutes	4 years ago
Claire	63b807cffc	Fix serialization of followers/following counts when user hides their network (#16418 ) * Add tests * Fix serialization of followers/following counts when user hides their network Fixes #16382 Signed-off-by: Claire <claire.github-309c@sitedethib.com>	4 years ago
Eugen Rochko	d174d12c83	Add authentication history (#16408 )	4 years ago
Eugen Rochko	1410dffdf4	Fix e-mail confirmations API not working correctly (#16348 ) * Fix e-mail confirmations API not working correctly * Fix typo	4 years ago
Claire	3b27b09acb	Fix some IDs in instance actor outbox (#16343 )	4 years ago
Jeong Arm	5ef216d032	Remove set-cookie header on custom.css (#16314 ) * Remove set-cookie header on custom.css * Additional fix for set-cookie	4 years ago
Claire	12f8f39e25	Fix media proxy RedisLocks auto-releasing too fast (#16291 ) Follow-up to #16276	5 years ago
Eugen Rochko	74081433d0	Change trending hashtags to be affected be reblogs (#16164 ) If a status with a hashtag becomes very popular, it stands to reason that the hashtag should have a chance at trending Fix no stats being recorded for hashtags that are not allowed to trend, and stop ignoring bots Remove references to hashtags in profile directory from the code and the admin UI	5 years ago
Claire	566fc90913	Add Ruby 3.0 support (#16046 ) * Fix issues with POSIX::Spawn, Terrapin and Ruby 3.0 Also improve the Terrapin monkey-patch for the stderr/stdout issue. * Fix keyword argument handling throughout the codebase * Monkey-patch Paperclip to fix keyword arguments handling in validators * Change validation_extensions to please CodeClimate * Bump microformats from 4.2.1 to 4.3.1 * Allow Ruby 3.0 * Add Ruby 3.0 test target to CircleCI * Add test for admin dashboard warnings * Fix admin dashboard warnings on Ruby 3.0	5 years ago
Takeshi Umeda	7cb34b32f8	Add management of delivery availability in Federation settings (#15771 ) * Add management of delivery availavility in Federation settings * fix translate * Remove useless object creation * Fix DeepSource issue * Add shortcut for all * Fix DeepSource(skipcq) * Change 'remove' to 'clear' * Fix style * Change class method name (exhausted_deliveries_key_by)	5 years ago
Eugen Rochko	351c744590	Fix error when trying to render component for media without meta (#16112 )	5 years ago
Eugen Rochko	059df83d1d	Fix database serialization failure returning HTTP 500 (#16101 ) Database serialization failure occurs when a read-replica is used and a query takes long enough that rows on the primary database become unavailable. It should return HTTP 503 as it is temporary. Re-order rescue definitions according to their status codes	5 years ago
Claire	8c44b723bb	Change confirmations controller to redirect to / for approved users (#16151 ) Clicking the confirmation link multiple times currently leads to entering account settings, which can be confusing. This commit changes that so that it redirects to the root path, so it behaves the same way as clicking only once in most cases.	5 years ago
abcang	d0fc69d721	Further improve the media attached status query for accounts (#16106 )	5 years ago
abcang	1f47511023	Improve media attached status query (#16105 )	5 years ago
Eugen Rochko	daccc07dc1	Change auto-following admin-selected accounts, show in recommendations (#16078 )	5 years ago
Eugen Rochko	ce2148c571	Add `policy` param to `POST /api/v1/push/subscriptions` (#16040 ) With possible values `all`, `followed`, `follower`, and `none`, control from whom notifications will generate a Web Push alert	5 years ago
Eugen Rochko	f7117646af	Add cold-start follow recommendations (#15945 )	5 years ago
Eugen Rochko	619fad6cf8	Remove spam check and dependency on nilsimsa gem (#16011 )	5 years ago
Eugen Rochko	487e37d6d4	Add system checks to dashboard in admin UI (#15989 )	5 years ago
Eugen Rochko	82cce18227	Change health check (#15988 )	5 years ago
Claire	a650a1157d	Fix /admin/tags/:id crashing since Rails 6.1 update (#15953 ) Raw SQL passed to `pluck` now has to be explicitly marked as SQL via Arel.sql, see https://github.com/rails/rails/pull/27947	5 years ago
Claire	59f94593d0	Add warning in admin dashboard if some required queues are not handled (#15954 )	5 years ago
Eugen Rochko	dd1eb9918a	Add `email` param to `POST /api/v1/emails/confirmations` (#15949 ) Allow changing e-mail as long as the account is unconfirmed	5 years ago
Claire	cbd0ee1d07	Update Mastodon to Rails 6.1 (#15910 ) * Update devise-two-factor to unreleased fork for Rails 6 support Update tests to match new `rotp` version. * Update nsa gem to unreleased fork for Rails 6 support * Update rails to 6.1.3 and rails-i18n to 6.0 * Update to unreleased fork of pluck_each for Ruby 6 support * Run "rails app:update" * Add missing ActiveStorage config file * Use config.ssl_options instead of removed ApplicationController#force_ssl Disabled force_ssl-related tests as they do not seem to be easily testable anymore. * Fix nonce directives by removing Rails 5 specific monkey-patching * Fix fixture_file_upload deprecation warning * Fix yield-based test failing with Rails 6 * Use Rails 6's index_with when possible * Use ActiveRecord::Cache::Store#delete_multi from Rails 6 This will yield better performances when deleting an account * Disable Rails 6.1's automatic preload link headers Since Rails 6.1, ActionView adds preload links for javascript files in the Links header per default. In our case, that will bloat headers too much and potentially cause issues with reverse proxies. Furhermore, we don't need those links, as we already output them as HTML link tags. * Switch to Rails 6.0 default config * Switch to Rails 6.1 default config * Do not include autoload paths in the load path	5 years ago
Claire	b358229834	Further preparation for Rails 6 (#15916 ) * Use ActiveRecord::Result#to_ary instead of deprecated to_hash They do the same thing, and to_hash has been removed from Rails 6.1 * Explicitly name polymorphic indexes to workaround a bug in Rails 6.1 cf. https://github.com/rails/rails/issues/41693 * Fix incorrect usage of “foreign_key” in migration script * Use `ActiveModel::Errors#delete` instead of deprecated clear method * Fix link headers tests on Rails 6.1 Rails 6.1 adds values to the Link header by default, thus it is not a LinkHeader object anymore. Fix the test to parse the Link header instead of assuming it is a LinkHeader.	5 years ago
Claire	5027abecd1	Fix cache_collection crashing when given an empty collection (#15921 ) * Fix cache_collection crashing when given an empty collection * Add tests	5 years ago
Eugen Rochko	ee1119208c	Add `POST /api/v1/emails/confirmations` to REST API (#15816 ) Only available to the application the user originally signed-up with	5 years ago
Eugen Rochko	9aa37b32c3	Add `details` to error response for `POST /api/v1/accounts` in REST API (#15803 )	5 years ago
Claire	75189af528	Fix crash on receiving requests with missing Digest header (#15782 ) * Fix crash on receiving requests with missing Digest header Return an error pointing out that Digest is missing, instead of crashing. Fixes #15743 * Fix from review feedback	5 years ago
Eugen Rochko	8331fdf7e0	Add server rules (#15769 )	5 years ago
Justin Tracey	c9e8e1739c	replace all instances of "ends_with?" with "end_with?" (#15745 ) The "ends_with?" method is just a Rails alias of Ruby's "end_with?" method. Using the latter makes the code less brittle.	5 years ago
Eugen Rochko	e31ed27485	Add `GET /api/v1/accounts/lookup` REST API (#15740 )	5 years ago
Eugen Rochko	15ced8728f	Refactor Api::Web::SettingsController (#15717 )	5 years ago
Cecylia Bocovich	e79f8dd85c	Onion service related changes to HTTPS handling (#15560 ) * Enable secure cookie flag for https only * Disable force_ssl for .onion hosts only Co-authored-by: Aiden McClelland <me@drbonez.dev>	5 years ago
Claire	acdeb162b8	Create instance actor if it hasn't been properly seeded (#15693 ) An uncommon but somewhat difficult to digagnose issue is dealing with improperly-seeded databases. In such cases, instance-signed fetches will fail with a ActiveRecord::RecordNotFound error, usually caught and handled as generic 404, leading people to think the remote resource itself has not been found, while it's the local instance actor that does not exist. This commit changes the code so that failure to find the instance actor automatically creates a new one, so that improperly-seeded databases do not cause any issue.	5 years ago
abcang	7ab53f221a	Improved performance of notification preloading (#15640 ) * Improved performance of notification preloading * Remove Cacheable from Notification * Fix test	5 years ago
ThibG	2ff01f78f7	Fix /activity endpoint not require signature in authorized fetch mode (#15592 ) Fixes #15589 Co-authored-by: Claire <claire.github-309c@sitedethib.com>	5 years ago
ThibG	54d4e5252b	Use Rails' index_by where it makes sense (#15542 ) * Use Rails' index_by where it makes sense * Fix tests Co-authored-by: Claire <claire.github-309c@sitedethib.com>	5 years ago
Levi Bard	11d603101a	Fix muting users with duration via the REST api (#15516 )	5 years ago
luigi	087ed84367	Optimize map { ... }.compact calls (#15513 ) * Optimize map { ... }.compact using Enumerable#filter_map, supported since Ruby 2.7 * Add poyfill for Enumerable#filter_map	5 years ago
ThibG	a1a8aa4a08	Skip processing Update activities on unknown accounts (#15514 ) This also skips fetching the actor completely. This will be useful if we end up distributing Update activities linked to account suspensions more widely (they are currently only delivered to the suspended account's followers), as currently, instances not knowing about the suspended account would fetch it to then process the suspension. Co-authored-by: Claire <claire.github-309c@sitedethib.com>	5 years ago
ThibG	4552449c26	Fix profile update not being sent on profile/header picture deletion (#15461 ) Fixes #15460 Co-authored-by: Claire <claire.github-309c@sitedethib.com>	5 years ago
trwnh	4950e59cdc	Use existing FeaturedTag serializer and delete AccountFeaturedTag serializer (#15415 ) * Update featured_tags_controller.rb * Update featured_tag_serializer.rb * Update featured_tag_serializer.rb * Delete account_featured_tag_serializer.rb * please codeclimate * please codeclimate	5 years ago
Eugen Rochko	8a95867693	Add option to obfuscate domain name in public list of domain blocks (#15355 ) - Replace the middle of the domain with * characters (except for periods) - Add SHA-256 digest of the domain name in tooltip	5 years ago
Eugen Rochko	1045549f85	Add stoplight for object storage failures, return HTTP 503 (#13043 )	5 years ago
Eugen Rochko	216b85b053	Fix performance on instances list in admin UI (#15282 ) - Reduce duplicate queries - Remove n+1 queries - Add accounts count to detailed view - Add separate action log entry for updating existing domain blocks	5 years ago
ThibG	49eb4d4ddf	Add honeypot fields and minimum fill-out time for sign-up form (#15276 ) * Add honeypot fields to limit non-specialized spam Add two honeypot fields: a fake website input and a fake password confirmation one. The label/placeholder/aria-label tells not to fill them, and they are hidden in CSS, so legitimate users should not fall into these. This should cut down on some non-Mastodon-specific spambots. * Require a 3 seconds delay before submitting the registration form * Fix tests * Move registration form time check to model validation * Give people a chance to clear the honeypot fields * Refactor honeypot translation strings Co-authored-by: Claire <claire.github-309c@sitedethib.com>	5 years ago
Eugen Rochko	48bef17cc9	Fix slow distinct queries where grouped queries are faster (#15287 ) About 2x speed-up on inboxes query	5 years ago
Takeshi Umeda	44d5c6bc8f	Fix incorrect conditions for suspended accounts in Get API for account featured tags (#15270 )	5 years ago
ThibG	c43f4cd3bb	Fix not being able to unfavorite toots one has lost access to (#15192 ) Fixes #15191	5 years ago
ThibG	96c1e71329	Add import/export feature for bookmarks (#14956 ) * Add ability to export bookmarks * Add support for importing bookmarks * Add bookmark import tests * Add bookmarks export test	5 years ago
Eugen Rochko	8532429af7	Fix 2FA/sign-in token sessions being valid after password change (#14802 ) If someone tries logging in to an account and is prompted for a 2FA code or sign-in token, even if the account's password or e-mail is updated in the meantime, the session will show the prompt and allow the login process to complete with a valid 2FA code or sign-in token	5 years ago
Takeshi Umeda	148ce97e21	Add interrelationship icon (#15149 ) * Add interrelationship icon * Fix arrow for rtl * Fix to predefined color	5 years ago
Takeshi Umeda	2b1a6e734f	Add follow selected followers button (#15148 ) * Add follow selected followers button * Fix unused variable * Fix i18n normalize	5 years ago
Eugen Rochko	3134691948	Add support for reversible suspensions through ActivityPub (#14989 )	5 years ago
ThibG	b29defb851	Change order of announcements in admin page to sort them newest-first (#15091 ) * Change order of announcements in admin page to sort show newly-created first Fixes #15090 * Use reverse-chronological rather than creation date only	5 years ago
Takeshi Umeda	d6fe0c94ca	Add account sensitized (#14361 ) * Add account sensitized * Fix i18n normalize * Fix description and spec * Fix spec * Fix wording	5 years ago
ThibG	fa929d8b81	Tweak signature verification (#15069 ) * Add more specific error message when request body digest is invalid This may help other implementors debug their implementation. * Relax Host parameter requirement to GET requests The only POST requests processed by Mastodon need objects/actors (including their host) to be explicitly mentioned in the request's body, so replaying a legitimate request to another host should not be a security issue. * Support Digest headers using multiple algorithms or lowercase alogirthm names	5 years ago
Mélanie Chauvel	0a8ab822e2	Sort filters by “keyword or phrase” in Settings (#15050 )	5 years ago

1 2 3 4 5 ...

1201 Commits (df27953f964d4f41c36dd8f99da5d62244e6fdc1)