2227 Commits (a28d3df4c42df5cd169a461f01d5e1596854f059)

Author	SHA1	Message	Date
Daniel Supernault	d2a45ee4d3	Update ApiV1Controller	2 weeks ago
Daniel Supernault	22108f8f11	Lint PostImportController	2 weeks ago
Daniel Supernault	914ab1196a	Update StoryComposeController	2 weeks ago
Daniel Supernault	b0ca632026	Update unbookmark endpoint	2 weeks ago
Daniel Supernault	1cead5cf60	Update in-app registration	2 weeks ago
Your Name	b13c374f21	Guard home timeline filter against null account	2 weeks ago
Daniel Supernault	e0550c441c	Fix AdminApiController profiles endpoint, dont include deleted accounts	2 weeks ago
Daniel Supernault	b2deebb72b	Update AdminApiController, fix typo	2 weeks ago
Daniel Supernault	6232d35d90	Update AccountService and AdminApiController	2 weeks ago
Daniel Supernault	96229868ff	Update AdminApiController, fix missing resource	2 weeks ago
Daniel Supernault	27bc6e792a	Update AdminApiController and PublicTimelineService	2 weeks ago
Your Name	9d839f7b5a	Fix missing email verification dispatch on settings email change	2 weeks ago
Daniel Supernault	fbd52dd8fc	Improve federation handling	2 weeks ago
Daniel Supernault	a3160cdd23	Update PublicApiController, fix getStatus to use database check	2 weeks ago
Daniel Supernault	1e6ce226e0	Refactor StatusController	2 weeks ago
Your Name	7a420112bf	Normalize cropped story images to the 1080x1920 canvas (#7215) ... cropPhoto() used coverDown(1080, 1920), which only downscales, so an undersized crop was stored at its original size (e.g. 110x196). Remote servers then dropped the image story for not matching expected story dimensions while videos federated. Use cover() so small crops are scaled up to fill the canvas. Note: the complementary remote-side validator relaxation (StoryFetch validateImageFile) is tracked separately and not included here.	2 weeks ago
Your Name	8aa3144745	Fix story video upload probe path (#7203) ... apiV1Add passed an absolute path to FFMpeg::open(), which laravel-ffmpeg resolves relative to the local disk root, producing a doubled path and an ffprobe 'Unable to probe / No such file or directory' failure. Open the file via the disk instead: FFMpeg::fromDisk('local')->open($path) for local storage, and an on-demand local disk rooted at the temp dir for cloud storage. Adds feature tests that pin the disk-relative path resolution.	2 weeks ago
Shlee	caffc40a45	Fix URL construction for API timeline request	2 weeks ago
Shlee	289251985a	Merge pull request #7199 from pixelfed/fix/story-publish-validation-exception ... Laravel 13 Prep: Stop swallowing overlay ValidationException into a generic 500	2 weeks ago
Your Name	62d3bc8406	Stop swallowing overlay ValidationException into a generic 500 ... publishNext() throws ValidationException::withMessages() for invalid story overlays (bad text/hashtag/mention/url/type), but the enclosing catch (\Exception $e) caught it too, since ValidationException extends Exception. Clients got a generic 500 "Failed to create story" instead of the intended 422 with field-level errors, and the log was flooded with ordinary user-input validation failures logged as server errors. Catch ValidationException separately, roll back, and rethrow it so Laravel's exception handler renders the normal 422 response.	2 weeks ago
Your Name	8fa18ff8c6	Fix dangling DB transactions in CustomFilterController ... store() and update() open a manual DB::beginTransaction() but had early return paths (duplicate keyword, keyword not found, per-filter keyword limit) that hit neither DB::commit() nor the catch block's rollback, leaving the transaction open past the end of the request. Add the missing DB::rollBack() call on each early-exit branch, matching the manual-transaction pattern used elsewhere in the app.	2 weeks ago
Shlee	140221fe90	Merge pull request #7192 from pixelfed/refactor/str-of-to-native ... Laravel 13 Prep: Replace Str::of() fluent chains with static Str::/native calls	2 weeks ago
Your Name	a424493420	Replace Str::of() fluent chains with static Str::/native calls ... Aligns with the app's dominant convention (171 static Str:: calls vs 24 Str::of() chains). Uses Str::afterLast() for the repeated "segment after last slash" pattern, Str::matchAll() where a Collection return is needed, and native explode()/substr() where a plain array/string suffices. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2 weeks ago
Your Name	277b8aa970	Use now() helper instead of Carbon::now() for current-time access ... Aligns with the app's dominant convention (413 now()/today() call sites vs 12 Carbon::now()). Carbon::parse() calls are untouched since they parse arbitrary date strings, not current-time access. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2 weeks ago
Daniel Supernault	7975ba9c75	Fix StoryCarousel cache invalidation	2 weeks ago
Daniel Supernault	915879ff57	Update account suggestions	2 weeks ago
Daniel Supernault	9aafa37364	Update ApiV1Controller.php	2 weeks ago
Daniel Supernault	6a33716870	Update ApiV1Controller, fix account suggestions	2 weeks ago
Your Name	ce073ffc92	Merge remote-tracking branch 'origin/staging' into feature/honeypot-spam-protection ... # Conflicts: # routes/web.php	2 weeks ago
Your Name	10559c23e3	Fix larastan noAuthFacadeInRequestScope in LoginController ... Replace Auth::check() with $request->user() !== null in confirmEmail(), which already has the request in scope, and drop the now-unused Auth facade import. Resolves the 2 remaining project-wide larastan errors.	3 weeks ago
Your Name	6496904293	Fix account storage limit not freeing on media deletion (#7169) ... users.storage_used only ever grew: uploads incremented it but no deletion path decremented it, so users hit the account size limit even when their real media usage was well below it. - Decrement storage_used in MediaDeletePipeline when media is removed - Add UserStorageService::increaseStorageUsed / decrementStorageUsed as the fast, symmetric hot-path counter updates (floor-based, clamped at zero) - Refactor the 6 upload call sites to use increaseStorageUsed instead of duplicated inline writes (also fixes ceil/floor drift vs the reconciler) - Add (user_id, size) covering index so per-user SUM(size) is not a full table scan (INPLACE/LOCK=NONE, skipped on sqlite) - Add user:storage:recalculate command to repair affected accounts, with a daily --stale=168 scheduled reconciler to correct any drift - Add regression tests for the pipeline and UserStorageService	3 weeks ago
Daniel Supernault	194c881cb2	Update ResetPasswordController	3 weeks ago
Daniel Supernault	1d96c94054	Refactor Auth, remove expensive middleware	3 weeks ago
Daniel Supernault	13aa36efb4	Update ApiV1Controller.php	3 weeks ago
Your Name	742c1a6bc8	Require dangerzone sudo mode on curated register, shadow filter and page admin controllers	3 weeks ago
Shlee	97b5d2f180	Merge pull request #7159 from shleeable/fix/directory-exclude-private-profiles ... Exclude private profiles from public directory and clear suggestable on going private	3 weeks ago
Your Name	1581863093	Exclude private profiles from public directory and clear suggestable on going private	3 weeks ago
Shlee	903c191f10	Merge pull request #7158 from shleeable/fix/2fa-logout-session-cleanup ... Clear 2FA session state on forced logout after failed attempts	3 weeks ago
Your Name	97f1a097ff	Clear 2FA session state on forced logout after failed attempts	3 weeks ago
Your Name	917a13d4a7	Filter null-account statuses from non-cached network timeline	3 weeks ago
Shlee	fc80bce460	Update StoryApiV1Controller.php	3 weeks ago
Your Name	0234a305ae	Use intended-redirect session for authorize_interaction guest login	3 weeks ago
Shlee	46fb9613e3	Merge pull request #7146 from shleeable/fix/2fa-checkpoint-throttle ... Rate limit and audit-log 2FA checkpoint verification	3 weeks ago
Your Name	8cebb24c04	Rate limit and audit-log 2FA checkpoint verification	3 weeks ago
Shlee	0ebe1f8fb1	Merge pull request #7145 from shleeable/fix/media-blocklist-check-before-store ... Check media blocklist before storing uploads to prevent orphaned files	3 weeks ago
Your Name	ec6827bae2	Check media blocklist before storing uploads to prevent orphaned files	3 weeks ago
Shlee	cecdad5b53	Merge pull request #7143 from shleeable/fix/search-controller-pgsql-ilike ... Use ILIKE for case-insensitive search on PostgreSQL	3 weeks ago
Your Name	613cf413de	Use ILIKE for case-insensitive search on PostgreSQL	3 weeks ago
Shlee	173abef5c5	Merge pull request #7142 from shleeable/fix/reblog-duplicate-dispatch ... Only dispatch SharePipeline for newly-created reblogs	3 weeks ago
Your Name	d190ba7b66	Only dispatch SharePipeline for newly-created reblogs	3 weeks ago
Shlee	a5cbea834f	Merge pull request #7138 from shleeable/fix/oob-authorize-omitted-redirect-uri ... Detect OOB oauth client when redirect_uri omitted on authorize	3 weeks ago
Shlee	ae31ed8e66	Merge pull request #7137 from shleeable/fix/story-remote-expiry-cache ... Invalidate latest-story cache on remote story expiry and null-guard l…	3 weeks ago
Your Name	53ad34b321	Ignore own row when validating email update uniqueness	3 weeks ago
Your Name	462b4bc0da	Detect OOB oauth client when redirect_uri omitted on authorize	3 weeks ago
Your Name	9850aac676	Invalidate latest-story cache on remote story expiry and null-guard latest()	3 weeks ago
Shlee	9c5be0e271	Merge pull request #7136 from shleeable/fix/custom-filter-rate-limit-ttl ... Fix custom filter rate-limit counter never expiring	3 weeks ago
Your Name	63e3c95fae	Fix custom filter rate-limit counter never expiring	3 weeks ago
Your Name	afcb68c183	Fix registration form redirecting when max_users is falsy	3 weeks ago
Shlee	daf83fd564	Merge pull request #7132 from shleeable/fix/pat-renew-kill-switch ... Enforce pat_enabled kill-switch on personal access token renew	3 weeks ago
Your Name	d2b11a71b3	Enforce pat_enabled kill-switch on personal access token renew	3 weeks ago
Shlee	13a441af93	Merge pull request #7131 from shleeable/fix/login-activity-groupby ... Fix login activity groupBy returning stale rows and 500 on strict DBs	3 weeks ago
Your Name	3cb5b6e1ff	Fix login activity groupBy returning stale rows and 500 on strict DBs	3 weeks ago
Your Name	fe70cd1155	Fix directory listing reporting oauth and activitypub flags always true	3 weeks ago
Shlee	18ba2dc932	Merge pull request #7119 from shleeable/fix/hashtag-follow-null-profile ... Guard hashtag follow against null profile for soft-deleted accounts	3 weeks ago
Shlee	3b8d7b8d1f	Merge pull request #7123 from shleeable/fix/poll-vote-scope-authz ... Enforce poll scope authorization on vote endpoint	3 weeks ago
Shlee	0900509c27	Merge pull request #7124 from shleeable/fix/collection-store-visibility-required ... Require visibility on collection store to match NOT NULL schema	3 weeks ago
Shlee	3f63b245bc	Merge pull request #7126 from shleeable/fix/admin-instance-stats-postgres-guard ... Fix admin instance stats endpoint 404 on Postgres via strict is_admin boolean check	3 weeks ago
Shlee	fe8c53ddd7	Merge pull request #7127 from shleeable/fix/favourites-pagination-off-by-one ... Fix favourites pagination skipping one favourite per page	3 weeks ago
Shlee	602e498f0a	Update ApiV1Controller.php	3 weeks ago
Your Name	a286509622	Require visibility on collection store to match NOT NULL schema	3 weeks ago
Your Name	a8a7a430d7	Enforce poll scope authorization on vote endpoint	3 weeks ago
Your Name	e79135a771	Fix favourites pagination skipping one favourite per page boundary	3 weeks ago
Your Name	8258a5a5f8	Guard hashtag follow against null profile for soft-deleted accounts	3 weeks ago
Your Name	df1e771f93	Fix admin instance stats endpoint 404 on Postgres via strict is_admin check	3 weeks ago
Your Name	3b951d41d8	Fix accounts statuses max_id pagination returning duplicate boundary status	3 weeks ago
Daniel Supernault	7376a007a5	Update ApiV1Controller.php	3 weeks ago
Daniel Supernault	085eabccf9	Update account statuses endpoint	3 weeks ago
Daniel Supernault	c558724e47	Update AP Helpers	3 weeks ago
Your Name	ce4343e3e2	Replace custom register token with spatie/laravel-honeypot ... Swap the custom 'rt' register token anti-spam mechanism for spatie/laravel-honeypot on the registration and parental-controls invite flows. - Add spatie/laravel-honeypot and publish config/honeypot.php - Remove getRegisterToken() and the rt validation rule from RegisterController - Replace the rt hidden field with the @honeypot directive in both forms - Attach ProtectAgainstSpam middleware to POST /register and the parental-controls invite register route - Update RegisterTest to disable honeypot for the valid registration case	3 weeks ago
Your Name	8b4a7d4e3c	fix: correct SiteController view return types, drop ViewContract alias ... An automated return-type pass aliased the view contract as ViewContract to avoid clashing with the imported View facade, but left four methods (curatedOnboarding, language, redirectUrl, followIntent) typed against the facade instead of the contract. That threw a TypeError on /auth/sign_up. Convert the four View::make() calls to the view() helper, drop the facade import, and use a single Illuminate\Contracts\View\View import for all return types.	3 weeks ago
Shlee	3673cf30e4	Update SiteController.php	3 weeks ago
Shlee	99a013accc	Update SiteController.php	3 weeks ago
dansup	4c2ccc7ee7	Merge pull request #7088 from pixelfed/shleeable-patch-4 ... Change 2FA code validation to require 6 digits	3 weeks ago
dansup	bbe27e8de4	Merge pull request #7087 from pixelfed/shleeable-patch-3 ... Update password validation rule to include string and min length	3 weeks ago
Shlee	76d4e1ab23	Change 2FA code validation to require 6 digits	3 weeks ago
Shlee	c2a568a5cc	Update password validation rule to include string and min length	3 weeks ago
Shlee	0a39ccef98	Update redirect route for 2FA setup	3 weeks ago
Daniel Supernault	d7cfd07204	Fix PostEditModal. Closes #7084	3 weeks ago
Shlee	c86a82b857	Merge pull request #7059 from pixelfed/chore/convert-string-refs-to-class ... Laravel 13 Prep: Convert string class references to ::class	3 weeks ago
Your Name	042ab0a6e4	Convert optional() to nullsafe operator ... Applies patch 2/21 from pixelfed-staging PR #9: replaces optional($x)->y with $x?->y across 16 files. Pint-clean.	4 weeks ago
Your Name	6d8ad3885a	Convert string class references to ::class ... Applies the ::class conversion from pixelfed-staging PR #9 (patch 1/21), formatted with Pint (short imported ::class form). Excludes the ModelNamespaceMigrationTest namespace assertions, which intentionally compare against literal namespace strings.	4 weeks ago
Your Name	9db2218ca6	chore: move resources/lang to top-level lang/ per Laravel 9+ convention ... - Relocate translation files from resources/lang to lang/ via git mv - Update PHP references to use the lang_path() helper - Update crowdin.yml source/translation paths - Update phpstan.neon translationDirectories	4 weeks ago
Shlee	003953eb3e	Merge pull request #7045 from pixelfed/perf/follower-service-following-ids ... Deduplocation: add FollowerService::getFollowingIds for common function	4 weeks ago
Daniel Supernault	c9b0ee3bdd	Refactor NotificationService	4 weeks ago
Your Name	667f6e2fc9	Extract following-ids lookup into FollowerService::getFollowingIds ... The Cache::remember('profile:following:'.$pid, ...) block that plucks following_id and appends the caller's own id was copy-pasted across four call sites, with inconsistent TTLs (1440 minutes vs 1209600 seconds). Add FollowerService::getFollowingIds($pid), which owns the cache key that add()/remove() already invalidate, and use it from InternalApiController, PublicApiController, ApiV1Controller and HashtagUnfollowPipeline. Removes the now-unused Follower/Cache imports left behind. Adds a test covering the followed-ids-plus-self result and the follows-nobody case.	4 weeks ago
Your Name	661b841428	Remove dead debug methods that echoed the raw request ... CollectionController::index and StoryComposeController::createPoll had no route mapping and simply returned $request->all(). Both are unreachable debug leftovers; remove them. The live poll route maps to ComposeController::createPoll, which is unaffected.	4 weeks ago
Your Name	e4e12fad7c	Extract duplicated blocked-id and duplicate-shortcode query patterns ... Two query patterns were copy-pasted across several call sites: - The 'users who blocked me, plus myself' list used to filter profile search (UserFilter::whereFilterableId($pid)->pluck('user_id')->push($pid)) appeared in ComposeController (x2) and DirectMessageController. Extracted to UserFilterService::searchExcludedProfileIds(). Note this is the inverse of blocks() (who I blocked), so it is a distinct method. - CustomEmoji duplicate detection (groupBy('shortcode')->havingRaw( 'count(*) > 1')) appeared three times in AdminController. Extracted to a CustomEmoji::duplicateShortcodes() query scope. Adds tests for both. No behaviour change.	4 weeks ago
Shlee	7ad550d2f7	Merge pull request #7037 from pixelfed/perf/seasonal-sql-aggregation ... Compute Year-in-Review averages in SQL instead of in PHP	4 weeks ago
Your Name	cd873c8976	Compute Year-in-Review averages in SQL instead of in PHP ... SeasonalController::getData computed the average posts/likes per profile by grouping in SQL, then pulling every grouped row into a collection and calling ->pluck('count')->avg() in PHP. This loaded one row per profile into memory just to average. Wrap the grouped per-profile counts in a subquery and let the database compute AVG(count), returning a single value. Also drops the invalid SELECT * with GROUP BY (ONLY_FULL_GROUP_BY) by selecting count(*) only. Adds a test verifying the average-of-per-profile-counts and its exclusions (remote, wrong type, out-of-range date), plus the empty case.	4 weeks ago
Shlee	660880eac7	Merge pull request #7036 from pixelfed/fix/remote-auth-http-timeout ... Add timeout, retry and error handling to remote auth HTTP calls	4 weeks ago