2017 Commits (b279638218fa0aeab3caa7088f4220c31c2d2fbe)

Author	SHA1	Message	Date
Daniel Supernault	8f1e475407	Fix typo	4 weeks ago
Daniel Supernault	7937d91c37	Update ApiV1Controller, add is_suggestable to update_credentials endpoint	4 weeks ago
Daniel Supernault	4e2e49f843	Update ApiV1Controller, add show_atom support to update_credentials endpoint	4 weeks ago
Your Name	79541afaa0	Merge origin/staging, resolve conflicts keeping matomo/device-detector over jenssegers/agent	4 weeks ago
Shlee	80738385ba	Merge pull request #6777 from pixelfed/fix/pat-creation-500-6630 ... Fix: Bounce error on PAT when OAUTH_PAT_ENABLED is false	4 weeks ago
Shlee	06e3351e92	Merge pull request #6778 from pixelfed/fix/prevent-pat-client-deletion-6630 ... Fix: Improve the web UX for deleting the OAuth Client and PAT	4 weeks ago
Shlee	fb655f1308	Merge pull request #6782 from ashleyhull-versent/shift-179490 ... Laravel Shift Preshift	4 weeks ago
Ashley Hull	ab07a705e6	Merge branch 'dev' into shift-179490	4 weeks ago
Shlee	68dca50973	Merge pull request #6774 from pixelfed/fix/oauth-scope-bypass-remove-follower-6643 ... Fix: OAuth accountRemoveFollowById to check token.	4 weeks ago
Shlee	20123ff5ba	Merge pull request #6773 from pixelfed/fix/first-follower-pagination-6695 ... Fix: Show first follower/following record excluded from previous API responses	4 weeks ago
Your Name	552a55c2d2	Upgrade images to v4	4 weeks ago
Daniel Supernault	91645faeee	Lint	4 weeks ago
Daniel Supernault	e1235dfd75	Fix ApiV1Controller, ensure follow notifications have an account	4 weeks ago
Your Name	53759e3ad6	Prevent deletion of personal access OAuth client ... Fixes #6630 (partial — deletion causing broken PAT) If a user deletes the OAuth client that serves as the personal access client, all PAT creation breaks for the entire instance with a 500 error. Changes: - Add custom OAuthClientController@destroy that checks if the client has the personal_access grant type before allowing deletion - Returns 403 with a clear error message if deletion is blocked - Add confirmation dialog before client deletion in the frontend - Add error handling to show server error messages to the user This prevents accidental destruction of the PAT infrastructure.	1 month ago
Your Name	1ab677a526	Handle PAT creation gracefully when not configured ... Fixes #6630 (partial — PAT 500 error) Previously, POST /oauth/personal-access-tokens would throw an unhandled RuntimeException (HTTP 500) when: - OAUTH_PAT_ENABLED is false (the default), or - No personal access client exists in the database Now the endpoint: 1. Returns 403 with a clear message if PAT is disabled in config 2. Catches RuntimeException from the token factory and returns 500 with an actionable error message instead of a stack trace	1 month ago
Your Name	822e9c98cb	Fix OAuth scope bypass on remove_from_followers endpoint ... Fixes #6643 The POST /api/v1/accounts/{id}/remove_from_followers endpoint was missing the token existence check (! $request->user()->token()). While the tokenCan('follow') scope check was already present, the missing token guard meant unauthenticated token-less requests could potentially bypass the scope enforcement. Added the standard guard pattern consistent with accountFollowById and accountUnfollowById endpoints. Also adds tests verifying: - Read-only tokens are denied (403) - Follow-scoped tokens succeed (200) - Unauthenticated requests are denied (403)	1 month ago
Your Name	396cf2d861	Fix first follower/following record excluded from API responses ... Fixes #6695 When no pagination params are provided, the default min_id was set to 1 and the query used 'id > 1', which excluded the very first follower row (id=1) on fresh instances. Changed default min_id from 1 to 0 and switched the direction check from truthy evaluation to !== null, so the query becomes 'id > 0' which correctly includes all records.	1 month ago
Shift	19880c2ffb	Convert string references to `::class` ... PHP 5.5.9 adds the new static `class` property which provides the fully qualified class name. This is preferred over using strings for class names since the `class` property references are checked by PHP.	1 month ago
Your Name	651f0de74f	Replace jenssegers/agent with matomo/device-detector ... - Remove unmaintained jenssegers/agent package (no releases since 2021) - Add matomo/device-detector v6.5 as actively maintained replacement - Create App\Services\UserAgentService wrapper for drop-in compatibility - Update UserDevice model and ApiV1Dot1Controller to use new service	1 month ago
dansup	268ab6dba0	Merge branch 'staging' into remove-exp-pue	1 month ago
dansup	7354f63563	Merge branch 'staging' into remove-exp-rec	1 month ago
Daniel Supernault	26ee049d07	Update AppRegisterController	1 month ago
Daniel Supernault	fbff6ed307	Update trustedproxy config	1 month ago
Daniel Supernault	a2be0cb47d	Update CommentController	1 month ago
Daniel Supernault	40aef7a212	Update GroupsFeedController	1 month ago
Daniel Supernault	5f397f9135	Update StoryController	1 month ago
dansup	f568804426	Merge pull request #6680 from pixelfed/shleeable-patch-15 ... Update FollowerObserver.php	1 month ago
dansup	d6cd65463d	Merge pull request #6676 from pixelfed/shleeable-patch-10 ... Stories API: PostgreSQL story carousel endpoints crash due to calling collection methods on query builder	1 month ago
dansup	668653039f	Merge pull request #6663 from vinzgreg/fix/api-status-edit-auth-guard ... Fix API status editing: use auth:api guard	1 month ago
dansup	ca5f83d2d1	Merge pull request #6655 from TowyTowy/fix/timeline-home-nullable-max-id ... Fix home timeline rejecting empty max_id/min_id pagination params	1 month ago
dansup	5aae3f46c7	Merge pull request #6691 from pixelfed/shleeable-patch-26 ... Improve validation	1 month ago
dansup	219297d0e3	Merge pull request #6690 from pixelfed/shleeable-patch-25 ... Typo: change pid to id for FollowerService::remove	1 month ago
dansup	6910115166	Merge pull request #6686 from pixelfed/shleeable-patch-20 ... Update type on abort.	1 month ago
dansup	77831e7640	Merge pull request #6688 from pixelfed/shleeable-patch-22 ... Clear oauth material on permanent delete	1 month ago
dansup	5115e5c960	Merge pull request #6677 from pixelfed/shleeable-patch-12 ... Typo in abort	1 month ago
dansup	179dfffafe	Merge pull request #6672 from pixelfed/shleeable-patch-5 ... Places directory crashes on PostgreSQL for multi-word country URLs (case-sensitive mismatch)	1 month ago
Shlee	c2044f77cf	Update AdminUserController.php	1 month ago
Shlee	1d72f1b437	Update ApiV1Controller.php	1 month ago
Shlee	fbe98ea4de	Update AccountController.php	1 month ago
Shlee	9966eb50b8	Update ApiV1Controller.php	1 month ago
Shlee	87d866f58d	Update SettingsController.php	1 month ago
Shlee	baf21797f0	Update RemoteOidcController.php	1 month ago
Shlee	0f79861f1d	Update PrivacySettings.php	1 month ago
Shlee	4e6b341532	Update StoryController.php	1 month ago
Shlee	8ce4b5d409	Update StoryApiV1Controller.php	1 month ago
Shlee	f99ee65676	Update PlaceController.php	1 month ago
Shlee	6f5f6e3368	Update ReportController.php	1 month ago
vinzgreg	d19671a92c	Fix API status editing: use auth:api guard ... StatusEditController's constructor applies the web `auth` guard, which Bearer/OAuth clients cannot satisfy. PUT /api/v1/statuses/{id} and GET /api/v1/statuses/{id}/history therefore fail for every third-party API client, while status create/delete keep working because ApiV1Controller has no controller-level web auth. The controller is routed only from routes/api.php, where the route group already applies ['auth:api', 'validemail'], so no web/session route depends on the old guard. Switch the constructor to match.	2 months ago
TowyTowy	795473be55	Fix home timeline rejecting empty max_id/min_id pagination params ... `GET /api/v1/timelines/home?max_id=` (empty value) fails validation because `min_id`/`max_id` use the `sometimes|integer` rule. The global `ConvertEmptyStringsToNull` middleware turns `?max_id=` into `null`, and since the field is present, `sometimes` does not skip it while `null` fails the `integer` rule — returning HTTP 422. Every other timeline/listing endpoint in this controller (timelinePublic, accountStatusesById, etc.) uses `nullable|integer` for these params, so `timelineHome` was the lone outlier. Mastodon-API clients such as Pixelfed for iOS send `max_id=` on first page load and could not paginate the home timeline. Switch `min_id`/`max_id` to `nullable|integer` to match the rest of the controller. Fixes #6610 Co-Authored-By: Claude <noreply@anthropic.com>	2 months ago
Daniel Supernault	0f781cba34	Update Personal Access Tokens	3 months ago