mastodon

Commit Graph

Author	SHA1	Message	Date
Eugen Rochko	974b1b79ce	Add option to be notified when a followed user posts (#13546 ) * Add bell button Fix #4890 * Remove duplicate type from post-deployment migration * Fix legacy class type mappings * Improve query performance with better index * Fix validation * Remove redundant index from notifications	4 years ago
kawaguchi	5d3c8baa9a	Fix validates :sign_count of WebauthnCredential (#14806 )	4 years ago
Eugen Rochko	ed099d8bdc	Change account suspensions to be reversible by default (#14726 )	4 years ago
ThibG	cd4ec7cd74	Do not serve account actors at all in limited federation mode (#14800 ) * Do not serve account actors at all in limited federation mode When an account is fetched without a signature from an allowed instance, return an error. This isn't really an improvement in security, as the only information that was previously returned was required protocol-level info, and the only personal bit was the existence of the account. The existence of the account can still be checked by issuing a webfinger query, as those are accepted without signatures. However, this change makes it so that unallowed instances won't create account records on their end when they find a reference to an unknown account. The previous behavior of rendering a limited list of fields, instead of not rendering the actor at all, was in order to prevent situations in which two instances in Authorized Fetch mode or Limited Federation mode would fail to reach each other because resolving an account would require a signed query… from an account which can only be fetched with a signed query itself. However, this should now be fine as fetching accounts is done by signing on behalf of the special instance actor, which does not require any kind of valid signature to be fetched. * Fix tests	4 years ago
Eugen Rochko	4e4b3a0c8e	Refactor settings controllers (#14767 ) - Disallow suspended accounts from revoking sessions and apps - Allow suspended accounts to access exports	4 years ago
Eugen Rochko	65760f59df	Refactor feed manager (#14761 )	4 years ago
ThibG	517af45e32	Fix multiple boosts of a same toot erroneously appearing in TL (#14759 ) * Check for and record reblog info atomically Instead of using ZREVRANK to determine whether a reblog is a new reblog or not, use ZADD's NX option to perform the check/addition option atomically. * Replace ZREVRANK call with ZSCORE key which is more efficient * Make tests a bit stricter * Fix off-by-one	5 years ago
Eugen Rochko	e8bc187845	Refactor how public and tag timelines are queried (#14728 )	5 years ago
Eugen Rochko	68d3b160de	Fix various warnings in rspec (#14729 )	5 years ago
ThibG	79305428a7	Add configuration option to filter replies in lists (#9205 ) * Add database support for list show-reply preferences * Add backend support to read and update list-specific show_replies settings * Add basic UI to set list replies setting * Add specs for list replies policy * Switch "cycling" reply policy link to a set of radio inputs * Capitalize replies_policy strings * Change radio button design to be consistent with that of the directory explorer	5 years ago
Eugen Rochko	52157fdcba	Add support for dereferencing objects through bearcaps (#14683 )	5 years ago
santiagorodriguez96	9cadd40cf4	refactor: add email previews for WebAuthn emails (#14658 ) This is a leftover for the work done in #14466.	5 years ago
santiagorodriguez96	e8d41bc2fe	Add WebAuthn as an alternative 2FA method (#14466 ) * feat: add possibility of adding WebAuthn security keys to use as 2FA This adds a basic UI for enabling WebAuthn 2FA. We did a little refactor to the Settings page for editing the 2FA methods – now it will list the methods that are available to the user (TOTP and WebAuthn) and from there they'll be able to add or remove any of them. Also, it's worth mentioning that for enabling WebAuthn it's required to have TOTP enabled, so the first time that you go to the 2FA Settings page, you'll be asked to set it up. This work was inspired by the one donde by Github in their platform, and despite it could be approached in different ways, we decided to go with this one given that we feel that this gives a great UX. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add request for WebAuthn as second factor at login if enabled This commits adds the feature for using WebAuthn as a second factor for login when enabled. If users have WebAuthn enabled, now a page requesting for the use of a WebAuthn credential for log in will appear, although a link redirecting to the old page for logging in using a two-factor code will also be present. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add possibility of deleting WebAuthn Credentials Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: disable WebAuthn when an Admin disables 2FA for a user Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: remove ability to disable TOTP leaving only WebAuthn as 2FA Following examples form other platforms like Github, we decided to make Webauthn 2FA secondary to 2FA with TOTP, so that we removed the possibility of removing TOTP authentication only, leaving users with just WEbAuthn as 2FA. Instead, users will have to click on 'Disable 2FA' in order to remove second factor auth. The reason for WebAuthn being secondary to TOPT is that in that way, users will still be able to log in using their code from their phone's application if they don't have their security keys with them – or maybe even lost them. * We had to change a little the flow for setting up TOTP, given that now it's possible to setting up again if you already had TOTP, in order to let users modify their authenticator app – given that now it's not possible for them to disable TOTP and set it up again with another authenticator app. So, basically, now instead of storing the new `otp_secret` in the user, we store it in the session until the process of set up is finished. This was because, as it was before, when users clicked on 'Edit' in the new two-factor methods lists page, but then went back without finishing the flow, their `otp_secret` had been changed therefore invalidating their previous authenticator app, making them unable to log in again using TOTP. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * refactor: fix eslint errors The PR build was failing given that linting returning some errors. This commit attempts to fix them. * refactor: normalize i18n translations The build was failing given that i18n translations files were not normalized. This commits fixes that. * refactor: avoid having the webauthn gem locked to a specific version * refactor: use symbols for routes without '/' * refactor: avoid sending webauthn disabled email when 2FA is disabled When an admins disable 2FA for users, we were sending two mails to them, one notifying that 2FA was disabled and the other to notify that WebAuthn was disabled. As the second one is redundant since the first email includes it, we can remove it and send just one email to users. * refactor: avoid creating new env variable for webauthn_origin config * refactor: improve flash error messages for webauthn pages Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>	5 years ago
ThibG	720214feb0	Add support for inlined objects in activity audience (#14514 ) * Add support for inlined objects in activity audience * Add tests	5 years ago
ThibG	f6a82cb2cd	Fix not being able to unbookmark toots when blocked by their author (#14604 ) * Fix not being able to unbookmark toots when blocked by their author * Add tests	5 years ago
ThibG	8d217d7231	Improve email address validation (#14565 ) * Increase DNS timeout from 1 second to 5 seconds for MX check 1 seconds is rather short when using a recursive DNS resolver which hasn't got a cached result already available. Use 5 seconds instead, which is the timeout value we use for outgoing HTTP queries. * Add more precise error messages for invalid e-mail addresses	5 years ago
ThibG	a1412491b7	Change content-type to be always computed from file data (#14452 ) * Change content-type to be always computed from file data Restore previous behavior, detecting the content-type isn't very expensive, and some instances may serve files as application/octet-stream regardless of their true type, making fetching media from them fail, while it used to work pre-3.2.0. * Add test	5 years ago
ThibG	bfd5aea206	Fix handling of Reject Follow when a matching follow relationship exists (#14479 ) * Add tests * Fix handling of Reject Follow when a matching follow relationship exists Regression from #12199	5 years ago
ThibG	5d9acc0ce4	Fix not handling Undo on some activity types when they aren't inlined (#14346 ) * Fix not handling Undo on some activity types when they aren't inlined When receiving an Undo for a non-inlined activity, try looking it up in database using the URI. The queries are ad-hoc because we don't have a global index of object URIs, and not all activity types are stored in database with an index on their URI. Announces are just statuses, and have an index on URIs, so this check can be done efficiently. Accepts cannot be handled at all because we don't record their URI at any point. Follows don't have an index on URI, but they have an index on the issuing account, which should make such queries largely manageable. Likes don't have an index on URI, they have an index on the issuing account, but the number of favs per account may be very high, so I decided not to handle that. Blocks don't have an index on URI, but they have an index on the issuing account, which should make such queries largely manageable. In all cases, if an Undo could not be handled properly, we call `delete_later!` because that does not require us to know more than the URI of the undone property. * Add tests * Make newer blocks overwrite older ones Allows re-synchronizing block info by re-blocking and un-blocking again when the original Undo Block has been lost.	5 years ago
ThibG	f55dd193f9	Fix RSS feeds not being cachable (#14368 ) * Add tests for some cachable responses This only covers responses that we should have managed to make cachable so far. It's not the case of all responses that should be cachable in the end. * Fix RSS feeds not being cachable	5 years ago
ThibG	322d74fc2a	Fix boosted toots from blocked account not being retroactively removed from TL (#14339 ) * Fix boosted toots from blocked account not being retroactively removed from TL Fixes #14301 * Add test for clear_from_timeline	5 years ago
ThibG	d658af7ff8	Fix removing allowed domains being done synchronously (#14302 ) * Fix removing allowed domains being done synchronously * Add tests	5 years ago
ThibG	0a8a3fe595	Fix being unable to unboost when blocked by their author (#14308 ) Fixes #14307	5 years ago
Eugen Rochko	6e25574ce5	Fix media attachments enumeration (#14254 ) * Fix media attachment enumeration * Switch media_attachments id to snowflake ids Co-authored-by: Thibaut Girka <thib@sitedethib.com>	5 years ago
ThibG	e96e9cae62	Add test for removing endorsed accounts on account deletion/suspension (#14241 )	5 years ago
ThibG	35cedc922c	Change move handler to carry blocks over (#14144 ) * Change move handler to carry blocks and mutes over When user A blocks user B and B moves to a new account C, make A block C accordingly. Note that it only works if A's instance is aware of the Move, that is, if B is on A's instance or has followers there. * Also notify instances with known people blocking you when moving * Add automatic account notes when blocking/muting an account that had no note	5 years ago
Eugen Rochko	7aaf2b44ec	Fix remote files not using Content-Type header, streaming (#14184 )	5 years ago
ThibG	65506bac3f	Add user notes on accounts (#14148 ) * Add UserNote model * Add UI for user notes * Put comment in relationships entity * Add API to create user notes * Copy user notes to new account when receiving a Move activity * Address some of the review remarks * Replace modal by inline edition * Please CodeClimate * Button design changes * Change design again * Cancel note edition when pressing Escape * Fixes * Tweak design again * Move “Add note” item, and allow users to add notes to themselves * Rename UserNote into AccountNote, rename “comment” Relationship attribute to “note”	5 years ago
Eugen Rochko	1b198d6489	Fix trying to write non-existent image remote URL attribute on preview cards (#14181 ) Regression from #14145	5 years ago
Eugen Rochko	64aac30733	Add customizable thumbnails for audio and video attachments (#14145 ) - Change audio files to not be stripped of metadata - Automatically extract cover art from audio if it exists - Add `thumbnail` parameter to `POST /api/v1/media`, `POST /api/v2/media` and `PUT /api/v1/media/:id` - Add `icon` to represent it in attachments in ActivityPub - Fix `preview_url` containing URL of missing missing image when there is no thumbnail instead of null - Fix duration of audio not being displayed on public pages until the file is loaded	5 years ago
ThibG	89f40b6c3e	Make domain block/silence/reject-media code more robust (#13424 ) * Split media cleanup from reject-media domain blocks to its own service * Slightly improve ClearDomainMediaService error handling * Lower DomainClearMediaWorker to lowest-priority queue * Do not catch ActiveRecord::RecordNotFound in domain block workers * Fix DomainBlockWorker spec labels * Add some specs * Change domain blocks to immediately mark accounts as suspended Rather than doing so sequentially, account after account, while cleaning their data. This doesn't change much about the time the block takes to complete, but it immediately prevents interaction with the blocked domain, while up to now, it would only be guaranteed when the process ends.	5 years ago
Eugen Rochko	72a7cfaa39	Add e-mail-based sign in challenge for users with disabled 2FA (#14013 )	5 years ago
ThibG	aed3a436a2	Fix serialization of replies when some of them are URIs (#13957 ) * Fix serialization of replies when some of them are URIs Fixes #13956 * Add test	5 years ago
Eugen Rochko	5d8398c8b8	Add E2EE API (#13820 )	5 years ago
ThibG	a319c1e60f	Add support for `summary` field for media description (#13763 )	5 years ago
ThibG	27ea7c13a5	Fix hashtag search performing account search as well (#13758 )	5 years ago
ThibG	71fce71c94	Fix webfinger returning wrong status code on malformed or missing param (#13759 ) Fixes #13757	5 years ago
dependabot-preview[bot]	78202e9138	Bump doorkeeper from 5.3.3 to 5.4.0 (#13733 ) * Bump doorkeeper from 5.3.3 to 5.4.0 Bumps [doorkeeper](https://github.com/doorkeeper-gem/doorkeeper) from 5.3.3 to 5.4.0. - [Release notes](https://github.com/doorkeeper-gem/doorkeeper/releases) - [Changelog](https://github.com/doorkeeper-gem/doorkeeper/blob/master/CHANGELOG.md) - [Commits](https://github.com/doorkeeper-gem/doorkeeper/compare/v5.3.3...v5.4.0) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> * Fix tests * Fix use of Doorkeeper::AccessToken.find_or_create_for * Fix tests? Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com> Co-authored-by: Thibaut Girka <thib@sitedethib.com>	5 years ago
ThibG	4bcef12bad	Fix sr locale being selected over sr-Latn (#13693 ) * Fix sr locale being selected over sr-Latn * Update tests	5 years ago
Eugen Rochko	4b766f9846	Refactor monkey-patching of Goldfinger (#12561 )	5 years ago
Eugen Rochko	8be4c2ba21	Add ability to remove identity proofs from account (#13682 ) Fix #12613	5 years ago
Takeshi Umeda	26b08a3c54	Add remote only to public timeline (#13504 ) * Add remote only to public timeline * Fix code style	5 years ago
ThibG	a4240fd027	Improve RSS entries for statuses (#13592 ) * Improve RSS entries for statuses - Render polls in both accounts and tags serializers - Refactor RSS serializers - Change title preview to include ellipsis when truncated - Change title preview to show CW instead of toot text - Add tests * Remove title from OEmbed serialization Twitter doesn't serialize title either, and tihs allows us to move the title formatting code to the RSS serializers.	5 years ago
ThibG	f1e0fa80f6	Fix own following/followers not showing muted users (#13614 ) Fixes #13612	5 years ago
Taras Gogol	6748a5acb1	Fix followings list order \| Issue #13538 (#13676 )	5 years ago
Eugen Rochko	5cff7910c2	Add more ActivityPub controller tests (#13590 )	5 years ago
Yamagishi Kazutoshi	e223fd8c61	Revert "improve status title (#8596 )" (#13591 ) This reverts commit `05756c9a14`.	5 years ago
Eugen Rochko	988b0493fe	Add more tests for ActivityPub controllers (#13585 )	5 years ago
Eugen Rochko	2744f61696	Fix not being able to resolve public resources in development environment (#13505 )	5 years ago
Eugen Rochko	5edff32733	Change delivery failure tracking to work with hostnames instead of URLs (#13437 )	5 years ago

1 2 3 4 5 ...

1167 Commits (f7183a237d72176778226e62c0b0d3c88635c8d4)