- terms/privacy/community-guidelines views accessed the cached page as an
object ($page->title), but cachedPage() returns an array, causing a 500
whenever a custom Page row existed. Switch to array access.
- PublicRouteSmokeTest: enable open_registration before hitting /register,
which 404s by default when registration is disabled.
- Api/AccountTest: derive sanctum.stateful domain from app.url instead of
hardcoding pixelfed.test, so the first-party auth test is environment
independent.
locale_get_display_language reads only the language subtag and ignores
the region, so zh-cn and zh-tw both rendered as 'Chinese - 中文'.
Switching to locale_get_display_name disambiguates region variants
(Chinese (China) / Chinese (Taiwan)) while leaving all region-less
locales unchanged.
Updated the settings language dropdown and the /i/lang picker.
Swap the custom 'rt' register token anti-spam mechanism for
spatie/laravel-honeypot on the registration and parental-controls
invite flows.
- Add spatie/laravel-honeypot and publish config/honeypot.php
- Remove getRegisterToken() and the rt validation rule from RegisterController
- Replace the rt hidden field with the @honeypot directive in both forms
- Attach ProtectAgainstSpam middleware to POST /register and the
parental-controls invite register route
- Update RegisterTest to disable honeypot for the valid registration case
- Relocate translation files from resources/lang to lang/ via git mv
- Update PHP references to use the lang_path() helper
- Update crowdin.yml source/translation paths
- Update phpstan.neon translationDirectories
Back out all emoji cloud-storage work from staging so it can be reworked and
re-landed separately (the URL resolution flips to cloud on a global config
flag, which created a broken-URL window, and the migration approach needs
revisiting).
Reverts to pre-emoji state:
- CustomEmoji model URL/storage helpers (urlForPath, storageTarget, storeMedia,
storeMediaFromFile, deleteMedia, url) and callers in ImportEmojis,
CustomEmojiService, AdminController
- admin custom-emoji blade views back to local /storage URLs
- Remove admin:EmojiMoveStorageLocalToCloud command
- Remove the deploy migration and its scheduler entry
Media (and the already-reverted story) scheduler entries are untouched.
Two issues prevented emoji from serving/migrating correctly on cloud:
- Admin custom-emoji views hardcoded url('storage/'.media_path), so they
always showed local URLs and bypassed cloud resolution. Use $emoji->url().
- The migration/command guard relied solely on config_cache('pixelfed.cloud_storage'),
which is DB/12h-cached and can read stale-false right after cloud is
enabled, causing the migration to silently no-op. Treat cloud as enabled
when either live config() or config_cache() is true.
The <intersect> in sections/Notifications.vue wrapped four <placeholder>
elements directly. vue-intersect requires exactly one child (it checks
$slots.default.length and observes $slots.default[0]), so it logged
'[VueIntersect] You may only wrap one element in a <intersect> component.'
and only observed the first placeholder. Wrap the placeholders in a single
<div> so the slot has one root element.
These guest layouts also load app.js, which reads the csrf-token meta
tag to set the axios X-CSRF-TOKEN header. Without it, they logged the
same 'CSRF token not found' console error and had no CSRF header for
AJAX requests. Adds the meta tag to match the other layouts.
The app layout renders separate head blocks for auth vs guest users.
The guest block was missing the <meta name="csrf-token"> tag that
app.js reads to set the axios X-CSRF-TOKEN header, causing a console
error on the login and register pages. Add the meta tag to the guest
head to match the authenticated head block.
Caching an Eloquent model in a Cache::remember closure could deserialize
into a __PHP_Incomplete_Class on read, throwing 'attempt to access a
property on an incomplete object' and returning a 500. This surfaced on
guest profile pages (ProfileController::buildProfile reading
$user->user->settings) and affected several other latent call sites.
Changes:
- ProfileController: cache a plain settings array instead of the
UserSetting model; fall back to defaults when the settings row is missing
- StoryService::getById: fetch a live model instead of caching it
- InstanceService::getByDomain, CustomEmoji::scan: cache arrays
- Site/MobileController: cache Page data as an array via a shared
ManagesCachedPages trait; update blade views to array access
- Add public-route smoke/regression tests covering the cache-read path
- Remove Passport::personalAccessClientId() (removed in Passport v13, auto-discovers now)
- Remove Passport::enableImplicitGrant() (legacy grant, no clients use it)
- Flatten config instance.oauth.pat to pat_enabled (remove dead pat.id key)
- Add OAUTH_PAT_ENABLED=false to .env.example and .env.docker.example
- Show swal alert when PATs disabled instead of hidden API error
- Improve store() error handling to surface 403 messages in the UI
- Remove OAUTH_PAT_ID row from admin diagnostics blade
These deprecated helpers will throw 'undefined function' errors at
runtime since laravel/helpers was removed. Replace with Str::random(),
Str::limit(), and Str::slug() respectively.
Fixes#6630 (partial — deletion causing broken PAT)
If a user deletes the OAuth client that serves as the personal access
client, all PAT creation breaks for the entire instance with a 500 error.
Changes:
- Add custom OAuthClientController@destroy that checks if the client
has the personal_access grant type before allowing deletion
- Returns 403 with a clear error message if deletion is blocked
- Add confirmation dialog before client deletion in the frontend
- Add error handling to show server error messages to the user
This prevents accidental destruction of the PAT infrastructure.
Fixes#6630 (partial — client secret issue)
In Passport v13, client secrets are hashed at the model level and only
available as plain_secret on the response from the creation endpoint.
The previous code immediately re-fetched the client list after creation,
losing the plain secret since it's not stored or returned on GET.
Changes:
- Capture plain_secret from the POST response
- Show a dedicated modal with the client ID and secret after creation
- Warn users to copy the secret immediately (it won't be shown again)
- Add a Copy button for convenience
- Show 'Hidden (only shown at creation)' in the table for existing clients
Your Name
Daniel Supernault
Arnaud
Shlee
Shift