From 8c3c6dcae99c7ce9da7d54adbf7171c8ed8515e9 Mon Sep 17 00:00:00 2001 From: Claire Date: Tue, 15 Nov 2022 02:09:58 +0100 Subject: [PATCH 1/6] Fix filters from other users being used in the streaming service (#20719) --- streaming/index.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/streaming/index.js b/streaming/index.js index f8857ae53..34bf1d1fc 100644 --- a/streaming/index.js +++ b/streaming/index.js @@ -682,7 +682,7 @@ const startWorker = async (workerId) => { } if (!unpackedPayload.filtered && !req.cachedFilters) { - queries.push(client.query('SELECT filter.id AS id, filter.phrase AS title, filter.context AS context, filter.expires_at AS expires_at, filter.action AS filter_action, keyword.keyword AS keyword, keyword.whole_word AS whole_word FROM custom_filter_keywords keyword JOIN custom_filters filter ON keyword.custom_filter_id = filter.id WHERE filter.account_id = $1 AND filter.expires_at IS NULL OR filter.expires_at > NOW()', [req.accountId])); + queries.push(client.query('SELECT filter.id AS id, filter.phrase AS title, filter.context AS context, filter.expires_at AS expires_at, filter.action AS filter_action, keyword.keyword AS keyword, keyword.whole_word AS whole_word FROM custom_filter_keywords keyword JOIN custom_filters filter ON keyword.custom_filter_id = filter.id WHERE filter.account_id = $1 AND (filter.expires_at IS NULL OR filter.expires_at > NOW())', [req.accountId])); } Promise.all(queries).then(values => { -- 2.43.0 From 17bd9a87b900fb4fa02326a9a2cddc51195c68c1 Mon Sep 17 00:00:00 2001 From: Eugen Rochko Date: Tue, 15 Nov 2022 02:58:00 +0100 Subject: [PATCH 2/6] Fix wrong color on mentions hidden behind content warning in web UI (#20724) --- app/javascript/mastodon/components/status_content.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/javascript/mastodon/components/status_content.js b/app/javascript/mastodon/components/status_content.js index fbc66eabf..6f3093d63 100644 --- a/app/javascript/mastodon/components/status_content.js +++ b/app/javascript/mastodon/components/status_content.js @@ -249,7 +249,7 @@ class StatusContent extends React.PureComponent { let mentionsPlaceholder = ''; const mentionLinks = status.get('mentions').map(item => ( - + @{item.get('username')} )).reduce((aggregate, item) => [...aggregate, item, ' '], []); -- 2.43.0 From b59683c1561cfa66ed6ac4379bac0b82aea81e2e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 15 Nov 2022 03:19:56 +0100 Subject: [PATCH 3/6] Bump nokogiri from 1.13.8 to 1.13.9 (#20041) Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.13.8 to 1.13.9. - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.13.8...v1.13.9) --- updated-dependencies: - dependency-name: nokogiri dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- Gemfile.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile.lock b/Gemfile.lock index 87d07b631..b6e09e5df 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -412,7 +412,7 @@ GEM net-ssh (>= 2.6.5, < 8.0.0) net-ssh (7.0.1) nio4r (2.5.8) - nokogiri (1.13.8) + nokogiri (1.13.9) mini_portile2 (~> 2.8.0) racc (~> 1.4) nsa (0.2.8) -- 2.43.0 From b46b7c3d5e4e932d61d74418957c824ce7c5f9f7 Mon Sep 17 00:00:00 2001 From: prplecake Date: Mon, 14 Nov 2022 20:22:38 -0600 Subject: [PATCH 4/6] Use "unsafe-wasm-eval" instead of "unsafe-eval" in script-src CSP (#20606) * Add "unsafe-eval" to script-src CSP * Use 'unsafe-wasm-eval' instead of 'unsafe-eval' --- config/initializers/content_security_policy.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb index be4ef50fc..0212b9d95 100644 --- a/config/initializers/content_security_policy.rb +++ b/config/initializers/content_security_policy.rb @@ -36,7 +36,7 @@ Rails.application.config.content_security_policy do |p| p.worker_src :self, :blob, assets_host else p.connect_src :self, :data, :blob, assets_host, media_host, Rails.configuration.x.streaming_api_base_url - p.script_src :self, assets_host, :unsafe_eval + p.script_src :self, assets_host, "'unsafe-wasm-eval'" p.child_src :self, :blob, assets_host p.worker_src :self, :blob, assets_host end -- 2.43.0 From 43b0b2f3f477e5eac9e135ea28af95484ecc63f0 Mon Sep 17 00:00:00 2001 From: Eugen Rochko Date: Tue, 15 Nov 2022 03:39:06 +0100 Subject: [PATCH 5/6] Fix wrong directive `unsafe-wasm-eval` to `wasm-unsafe-eval` (#20729) --- config/initializers/content_security_policy.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb index 0212b9d95..6b62e6f33 100644 --- a/config/initializers/content_security_policy.rb +++ b/config/initializers/content_security_policy.rb @@ -36,7 +36,7 @@ Rails.application.config.content_security_policy do |p| p.worker_src :self, :blob, assets_host else p.connect_src :self, :data, :blob, assets_host, media_host, Rails.configuration.x.streaming_api_base_url - p.script_src :self, assets_host, "'unsafe-wasm-eval'" + p.script_src :self, assets_host, "'wasm-unsafe-eval'" p.child_src :self, :blob, assets_host p.worker_src :self, :blob, assets_host end -- 2.43.0 From 03b0f3ac83edfc46d304bfca1539ca6000e36fc3 Mon Sep 17 00:00:00 2001 From: Eugen Rochko Date: Tue, 15 Nov 2022 03:57:18 +0100 Subject: [PATCH 6/6] Bump version to 4.0.2 (#20725) --- CHANGELOG.md | 7 +++++++ lib/mastodon/version.rb | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4392cc658..b1ad9e5fd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,13 @@ Changelog All notable changes to this project will be documented in this file. +## [4.0.2] - 2022-11-15 +### Fixed + +- Fix wrong color on mentions hidden behind content warning in web UI ([Gargron](https://github.com/mastodon/mastodon/pull/20724)) +- Fix filters from other users being used in the streaming service ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/20719)) +- Fix `unsafe-eval` being used when `wasm-unsafe-eval` is enough in Content Security Policy ([Gargron](https://github.com/mastodon/mastodon/pull/20729), [prplecake](https://github.com/mastodon/mastodon/pull/20606)) + ## [4.0.1] - 2022-11-14 ### Fixed diff --git a/lib/mastodon/version.rb b/lib/mastodon/version.rb index 0ccf7d714..dc3cbab66 100644 --- a/lib/mastodon/version.rb +++ b/lib/mastodon/version.rb @@ -13,7 +13,7 @@ module Mastodon end def patch - 1 + 2 end def flags -- 2.43.0