Commit Graph

582 Commits (edb4368b08008c977ea618c1dff96c0e61a61ceb)

Author SHA1 Message Date
Your Name edb4368b08 refactor: replace deprecated laravel/helpers with native alternatives
Replace all deprecated helper function calls:
- str_slug() → Str::slug()
- starts_with() → str_starts_with()
- ends_with() → str_ends_with()
- array_first() → Arr::first()
- array_last() → Arr::last()
- array_flatten() → Arr::flatten()

Remove laravel/helpers package from composer.json as it is no longer
needed and will not be maintained for Laravel 13.
4 weeks ago
Daniel Supernault 8f1e475407
Fix typo 4 weeks ago
Daniel Supernault 7937d91c37
Update ApiV1Controller, add is_suggestable to update_credentials endpoint 4 weeks ago
Daniel Supernault 4e2e49f843
Update ApiV1Controller, add show_atom support to update_credentials endpoint 4 weeks ago
Your Name 79541afaa0 Merge origin/staging, resolve conflicts keeping matomo/device-detector over jenssegers/agent 4 weeks ago
Shlee fb655f1308
Merge pull request #6782 from ashleyhull-versent/shift-179490
Laravel Shift Preshift
4 weeks ago
Ashley Hull ab07a705e6
Merge branch 'dev' into shift-179490 4 weeks ago
Shlee 68dca50973
Merge pull request #6774 from pixelfed/fix/oauth-scope-bypass-remove-follower-6643
Fix: OAuth accountRemoveFollowById to check token.
4 weeks ago
Shlee 20123ff5ba
Merge pull request #6773 from pixelfed/fix/first-follower-pagination-6695
Fix: Show first follower/following record excluded from previous API responses
4 weeks ago
Daniel Supernault 91645faeee
Lint 1 month ago
Daniel Supernault e1235dfd75
Fix ApiV1Controller, ensure follow notifications have an account 1 month ago
Your Name 822e9c98cb Fix OAuth scope bypass on remove_from_followers endpoint
Fixes #6643

The POST /api/v1/accounts/{id}/remove_from_followers endpoint was missing
the token existence check (! $request->user()->token()). While the
tokenCan('follow') scope check was already present, the missing token
guard meant unauthenticated token-less requests could potentially bypass
the scope enforcement.

Added the standard guard pattern consistent with accountFollowById and
accountUnfollowById endpoints.

Also adds tests verifying:
- Read-only tokens are denied (403)
- Follow-scoped tokens succeed (200)
- Unauthenticated requests are denied (403)
1 month ago
Your Name 396cf2d861 Fix first follower/following record excluded from API responses
Fixes #6695

When no pagination params are provided, the default min_id was set to 1
and the query used 'id > 1', which excluded the very first follower row
(id=1) on fresh instances.

Changed default min_id from 1 to 0 and switched the direction check from
truthy evaluation to !== null, so the query becomes 'id > 0' which
correctly includes all records.
1 month ago
Shift 19880c2ffb
Convert string references to `::class`
PHP 5.5.9 adds the new static `class` property which provides the fully qualified class name. This is preferred over using strings for class names since the `class` property references are checked by PHP.
1 month ago
Your Name 651f0de74f Replace jenssegers/agent with matomo/device-detector
- Remove unmaintained jenssegers/agent package (no releases since 2021)
- Add matomo/device-detector v6.5 as actively maintained replacement
- Create App\Services\UserAgentService wrapper for drop-in compatibility
- Update UserDevice model and ApiV1Dot1Controller to use new service
1 month ago
Daniel Supernault a2be0cb47d
Update CommentController 1 month ago
Daniel Supernault 40aef7a212
Update GroupsFeedController 1 month ago
dansup ca5f83d2d1
Merge pull request #6655 from TowyTowy/fix/timeline-home-nullable-max-id
Fix home timeline rejecting empty max_id/min_id pagination params
1 month ago
dansup 5aae3f46c7
Merge pull request #6691 from pixelfed/shleeable-patch-26
Improve validation
1 month ago
Shlee 1d72f1b437
Update ApiV1Controller.php 1 month ago
Shlee 9966eb50b8
Update ApiV1Controller.php 1 month ago
TowyTowy 795473be55 Fix home timeline rejecting empty max_id/min_id pagination params
`GET /api/v1/timelines/home?max_id=` (empty value) fails validation
because `min_id`/`max_id` use the `sometimes|integer` rule. The global
`ConvertEmptyStringsToNull` middleware turns `?max_id=` into `null`, and
since the field is present, `sometimes` does not skip it while `null`
fails the `integer` rule — returning HTTP 422.

Every other timeline/listing endpoint in this controller (timelinePublic,
accountStatusesById, etc.) uses `nullable|integer` for these params, so
`timelineHome` was the lone outlier. Mastodon-API clients such as Pixelfed
for iOS send `max_id=` on first page load and could not paginate the home
timeline.

Switch `min_id`/`max_id` to `nullable|integer` to match the rest of the
controller.

Fixes #6610

Co-Authored-By: Claude <noreply@anthropic.com>
2 months ago
Your Name b329ee9edc API: Media uploads leak orphaned files when status creation validation fails 6 months ago
Daniel Supernault 695e851026
Fix oauth 7 months ago
Shlee 1b21f83132
Update BaseApiController.php 7 months ago
Daniel Supernault 3140404835
Update ApiV1Controller.php 8 months ago
Daniel Supernault 80a2f4f2b0
Add api/v1/accounts/lookup endpoint 8 months ago
Daniel Supernault f76567f67b
Improve reblog check 8 months ago
Severin 066f8ee309
Pulls user settings for reblogs 8 months ago
samir 9c3130a3c7 Added pagination to the followers/followings API endpoints 8 months ago
Daniel Supernault 374344754e
Lint 9 months ago
Daniel Supernault 4bc1e22121
Refactor LikePipeline and improve Undo Announce handling 10 months ago
Your Name 45a9a3b472 RemoveUnreachableStatementRector 11 months ago
dansup 7881b09c2f
Merge pull request #6304 from pixelfed/classV2
Larastan: Fix Missing classes 2 - Medium risk
11 months ago
dansup 99e89814b4
Merge pull request #6295 from pixelfed/shleeable-patch-20
Dead Code - Delete app/Http/Controllers/Api/InstanceApiController.php - Low Risk
11 months ago
Your Name 15cc07e602 Fix all class.notFound PHPStan issues - 31 fixes 11 months ago
Shlee e297cd0e94
Dead Code - Delete app/Http/Controllers/Api/InstanceApiController.php 11 months ago
Shlee 8d197107e8
Update BaseApiController.php 11 months ago
Daniel Supernault 3686c92122
Update Status storage, add SanitizerService to fix spacing in html stripped content 1 year ago
Daniel Supernault ec21eec508
Update ApiV1Dot1Controller, fix Story report follower check 1 year ago
Daniel Supernault f5dced0f7a
Update ApiV1Dot1Controller, add story report support 1 year ago
Daniel Supernault 4747266b04
Update ApiV1Controller, fix cache invalidation order 1 year ago
Daniel Supernault 4e938a8ffa
Fix heic, avif, webp support and add libvips driver 1 year ago
Daniel Supernault ab9c13fe0d
New supported formats, Preserve ICC Color Profiles, libvips support
Update image pipeline to handle avif, heic and webp and preserve ICC color profiles and added libvips support.
1 year ago
Daniel Supernault 5a3a1cf76c
Update remove_from_followers api endpoint 1 year ago
daniel 92482c24cd
Merge pull request #5895 from eufelipemateus/feat-remove-follow
[Improvement] Add button remove follow
1 year ago
Felipe Mateus fed800acfb
Merge branch 'dev-contrib-origin' into feat-remove-follow 1 year ago
Daniel Supernault 5a32bfe304
Update ApiV1Controller, add Custom Filters to home/public and hashtag feeds 1 year ago
Daniel Supernault b86102823b
Update CustomFilter model and CustomFilterController 1 year ago
Daniel Supernault 437d742ac4
Add custom filters
Add custom filters, compatible with Mastodon `/api/v2/filters`

Todo:
- [ ] fix routes
- [ ] finish other context filtering
1 year ago