Commit graph

6180 commits

Author SHA1 Message Date
Claire 6da135a493
Fix reviving revoked sessions and invalidating login (#16943)
Up until now, we have used Devise's Rememberable mechanism to re-log users
after the end of their browser sessions. This mechanism relies on a signed
cookie containing a token. That token was stored on the user's record,
meaning it was shared across all logged in browsers, meaning truly revoking
a browser's ability to auto-log-in involves revoking the token itself, and
revoking access from *all* logged-in browsers.

We had a session mechanism that dynamically checks whether a user's session
has been disabled, and would log out the user if so. However, this would only
clear a session being actively used, and a new one could be respawned with
the `remember_user_token` cookie.

In practice, this caused two issues:
- sessions could be revived after being closed from /auth/edit (security issue)
- auto-log-in would be disabled for *all* browsers after logging out from one
  of them

This PR removes the `remember_token` mechanism and treats the `_session_id`
cookie/token as a browser-specific `remember_token`, fixing both issues.
2021-11-06 00:13:58 +01:00
Claire 87085a5152
Fix AccountNote not having a maximum length (#16942) 2021-11-06 00:12:25 +01:00
Eugen Rochko 39cdf61ab7
Add support for structured data and more OpenGraph tags to link cards (#16938)
Save preview cards under their canonical URL

Increase max redirects to follow from 2 to 3
2021-11-05 23:23:05 +01:00
Claire 989c67d29d
Fix handling announcements with links (#16941)
Broken since #15827
2021-11-05 21:14:35 +01:00
Jeong Arm 458830ee7c
Fix statuses order in account's statuses admin page (#16937) 2021-11-04 15:49:35 +01:00
mayaeh 7ccbfb55dd
ran yarn manage:translations en (#16912) 2021-10-28 05:29:49 +02:00
Sasha Sorokin 11d4f9eefc
Split context for filter bar and unread markers (#16865)
On notifications page, in settings, "Show" for quick filter bar and
unread notifications markers use the same string, while being placed in
the separate contexts - under different settings categories.

This commit splits the contexts, creating new strings:

- "Show filter bar" in place of "Show" for filter bar;

- "Highlight unread notifications" in place of "Show" for unread
  notification markers, which are now simply called "Highlighting";

- There's also "Unread notifications" in place of "Unread notification
  markers" string to accompany the changes to "Show" string under that
  category.

All new strings have new IDs, which will cause previous strings to
invalidate on the next translation update and new strings to be created.
This will help Mastodon translators to know that there are changes and
improve translation in accordance to the source string update.
2021-10-25 16:32:28 +02:00
Claire ec059317fa
Fix some link previews being incorrectly generated from other prior links (#16885)
* Add tests

* Fix some link previews being incorrectly generated from different prior links

PR #12403 added a cache to avoid redundant queries when the OEmbed endpoint can
be guessed from the URL. This caching mechanism is not perfectly correct as
there is no guarantee that all pages from a given domain share the same
OEmbed provider endpoint.

This PR prevents the FetchOEmbedService from caching OEmbed endpoint that
cannot be generalized by replacing a fully-qualified URL from the endpoint's
parameters, greatly reducing the number of incorrect cached generalizations.
2021-10-21 20:39:35 +02:00
Mashiro b58d32cfe2
Enhance dashboard styles (#16884)
* Display sparkline graph on Chrome

* Heatmap auto overflow

* Change grid columns number on small screen

* Please codeclimate bot

* Remove graph height
2021-10-21 06:24:34 +02:00
Claire 3f9b28ce26
Add support for fetching Create and Announce activities by URI (#16383)
* Add support for fetching Create and Announce activities by URI

This should improve compatibility with ZAP and offer a way to fetch boosts,
which is currently not possible.

* Add tests
2021-10-21 01:14:04 +02:00
Takeshi Umeda 17f4e457b3
Add remove from followers api (#16864)
* Add followed_by? to account_interactions

* Add RemoveFromFollowersService

* Fix AccountBatch to use RemoveFromFollowersService

* Add remove from followers API
2021-10-18 12:02:35 +02:00
Eugen Rochko f00043dc4b
New Crowdin updates (#16354)
* New translations en.json (Latvian)
[ci skip]

* New translations en.json (Hebrew)
[ci skip]

* New translations en.json (Hebrew)
[ci skip]

* New translations simple_form.en.yml (Breton)
[ci skip]

* New translations simple_form.en.yml (Breton)
[ci skip]

* New translations simple_form.en.yml (Breton)
[ci skip]

* New translations simple_form.en.yml (Breton)
[ci skip]

* New translations en.json (Icelandic)
[ci skip]

* New translations en.json (Icelandic)
[ci skip]

* New translations en.json (Chinese Simplified)
[ci skip]

* New translations en.yml (Chinese Simplified)
[ci skip]

* New translations en.yml (Chinese Simplified)
[ci skip]

* New translations simple_form.en.yml (Chinese Simplified)
[ci skip]

* New translations devise.en.yml (Chinese Simplified)
[ci skip]

* New translations en.yml (Chinese Simplified)
[ci skip]

* New translations devise.en.yml (Chinese Simplified)
[ci skip]

* New translations en.json (Persian)
[ci skip]

* New translations en.json (Finnish)
[ci skip]

* New translations doorkeeper.en.yml (Finnish)
[ci skip]

* New translations doorkeeper.en.yml (Finnish)
[ci skip]

* New translations doorkeeper.en.yml (Finnish)
[ci skip]

* New translations doorkeeper.en.yml (Finnish)
[ci skip]

* New translations doorkeeper.en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (French)
[ci skip]

* New translations en.yml (French)
[ci skip]

* New translations en.json (Russian)
[ci skip]

* New translations en.json (Russian)
[ci skip]

* New translations en.json (Russian)
[ci skip]

* New translations activerecord.en.yml (Latvian)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations doorkeeper.en.yml (Latvian)
[ci skip]

* New translations en.yml (Slovak)
[ci skip]

* New translations doorkeeper.en.yml (Latvian)
[ci skip]

* New translations en.yml (Slovak)
[ci skip]

* New translations doorkeeper.en.yml (Latvian)
[ci skip]

* New translations doorkeeper.en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Esperanto)
[ci skip]

* New translations en.yml (Esperanto)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations doorkeeper.en.yml (Latvian)
[ci skip]

* New translations doorkeeper.en.yml (Latvian)
[ci skip]

* New translations doorkeeper.en.yml (Latvian)
[ci skip]

* New translations doorkeeper.en.yml (Latvian)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations en.yml (Slovak)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Slovak)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Armenian)
[ci skip]

* New translations en.json (Danish)
[ci skip]

* New translations en.yml (Arabic)
[ci skip]

* New translations en.yml (Catalan)
[ci skip]

* New translations en.yml (Czech)
[ci skip]

* New translations en.yml (Danish)
[ci skip]

* New translations en.yml (Spanish)
[ci skip]

* New translations en.yml (German)
[ci skip]

* New translations en.yml (Greek)
[ci skip]

* New translations en.yml (Basque)
[ci skip]

* New translations en.yml (Hungarian)
[ci skip]

* New translations en.yml (Slovak)
[ci skip]

* New translations en.yml (Persian)
[ci skip]

* New translations en.yml (Swedish)
[ci skip]

* New translations en.yml (French)
[ci skip]

* New translations en.yml (Chinese Simplified)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Italian)
[ci skip]

* New translations en.yml (Sinhala)
[ci skip]

* New translations en.yml (Sardinian)
[ci skip]

* New translations en.yml (Esperanto)
[ci skip]

* New translations en.yml (Vietnamese)
[ci skip]

* New translations en.yml (Turkish)
[ci skip]

* New translations en.yml (Ukrainian)
[ci skip]

* New translations en.yml (Chinese Traditional)
[ci skip]

* New translations en.yml (Galician)
[ci skip]

* New translations en.yml (Icelandic)
[ci skip]

* New translations en.yml (Portuguese, Brazilian)
[ci skip]

* New translations en.yml (Indonesian)
[ci skip]

* New translations en.yml (Tamil)
[ci skip]

* New translations en.yml (Spanish, Argentina)
[ci skip]

* New translations en.yml (Serbian (Cyrillic))
[ci skip]

* New translations en.yml (Albanian)
[ci skip]

* New translations en.yml (Japanese)
[ci skip]

* New translations en.yml (Georgian)
[ci skip]

* New translations en.yml (Korean)
[ci skip]

* New translations en.yml (Lithuanian)
[ci skip]

* New translations en.yml (Dutch)
[ci skip]

* New translations en.yml (Norwegian)
[ci skip]

* New translations en.yml (Polish)
[ci skip]

* New translations en.yml (Portuguese)
[ci skip]

* New translations en.yml (Russian)
[ci skip]

* New translations en.yml (Slovenian)
[ci skip]

* New translations en.yml (Spanish, Mexico)
[ci skip]

* New translations en.yml (Norwegian Nynorsk)
[ci skip]

* New translations en.yml (Estonian)
[ci skip]

* New translations en.yml (Kazakh)
[ci skip]

* New translations en.json (Norwegian Nynorsk)
[ci skip]

* New translations en.yml (Thai)
[ci skip]

* New translations en.yml (Bengali)
[ci skip]

* New translations en.yml (Asturian)
[ci skip]

* New translations en.yml (Scottish Gaelic)
[ci skip]

* New translations en.yml (Occitan)
[ci skip]

* New translations en.json (Kurmanji (Kurdish))
[ci skip]

* New translations en.yml (Kurmanji (Kurdish))
[ci skip]

* New translations en.json (Sorani (Kurdish))
[ci skip]

* New translations en.yml (Breton)
[ci skip]

* New translations en.yml (Malay)
[ci skip]

* New translations en.yml (Welsh)
[ci skip]

* New translations en.yml (Chinese Traditional, Hong Kong)
[ci skip]

* New translations en.yml (Tatar)
[ci skip]

* New translations en.yml (Malayalam)
[ci skip]

* New translations en.yml (Sorani (Kurdish))
[ci skip]

* New translations en.yml (Corsican)
[ci skip]

* New translations en.yml (Kabyle)
[ci skip]

* New translations en.yml (Catalan)
[ci skip]

* New translations en.yml (Polish)
[ci skip]

* New translations en.yml (Russian)
[ci skip]

* New translations en.yml (Russian)
[ci skip]

* New translations en.yml (Catalan)
[ci skip]

* New translations en.yml (Kurmanji (Kurdish))
[ci skip]

* New translations en.json (Russian)
[ci skip]

* New translations en.yml (Czech)
[ci skip]

* New translations en.json (Russian)
[ci skip]

* New translations en.yml (Czech)
[ci skip]

* New translations en.yml (Czech)
[ci skip]

* New translations en.yml (Turkish)
[ci skip]

* New translations en.yml (Occitan)
[ci skip]

* New translations en.yml (Czech)
[ci skip]

* New translations en.yml (Kurmanji (Kurdish))
[ci skip]

* New translations en.yml (Czech)
[ci skip]

* New translations en.yml (Danish)
[ci skip]

* New translations en.yml (Danish)
[ci skip]

* New translations en.yml (Kurmanji (Kurdish))
[ci skip]

* New translations en.yml (Norwegian)
[ci skip]

* New translations en.yml (Kurmanji (Kurdish))
[ci skip]

* New translations en.yml (Chinese Traditional)
[ci skip]

* New translations en.yml (Galician)
[ci skip]

* New translations en.yml (Galician)
[ci skip]

* New translations en.yml (French)
[ci skip]

* New translations en.yml (French)
[ci skip]

* New translations en.yml (Chinese Traditional)
[ci skip]

* New translations en.yml (Hungarian)
[ci skip]

* New translations en.yml (Albanian)
[ci skip]

* New translations en.yml (Albanian)
[ci skip]

* New translations en.yml (Ukrainian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Portuguese)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.json (Portuguese)
[ci skip]

* New translations en.yml (Portuguese)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Spanish)
[ci skip]

* New translations en.yml (Hungarian)
[ci skip]

* New translations en.yml (Italian)
[ci skip]

* New translations en.yml (Indonesian)
[ci skip]

* New translations en.yml (Indonesian)
[ci skip]

* New translations devise.en.yml (French)
[ci skip]

* Run `i18n-tasks normalize`

* Run `yarn manage:translations`

* Trim unnecessary line breaks

Co-authored-by: Yamagishi Kazutoshi <ykzts@desire.sh>
2021-10-17 10:28:51 +09:00
Claire a184c860ca
Fix retention rate computation (#16854) 2021-10-14 22:20:37 +02:00
Jeong Arm f4081d1564
Allow keeping only 1 boosts/favs on auto deleting posts (#16653)
* Allow keeping 1 boosts/favs on auto deleting posts

* Fix tests
2021-10-14 21:11:14 +02:00
Claire b21f3aa21d
Minor memory optimizations (#16507)
Reduce constant memory usage by ~100kB and further reduce boot-up memory
allocations and temporary memory use by a further ~200kB.
2021-10-14 21:04:57 +02:00
Jeong Arm 3ec8e04b3b
Add font-display to display text before loading (#16330) 2021-10-14 21:04:26 +02:00
gunchleoc 8ce42640e5
Add Northern Kurdish locale as requested by translator. It already has a project started on Crowdin. (#16548) 2021-10-14 21:02:54 +02:00
Claire 9b978872cc
Fix 404 error when filtering admin action logs by non-existent target account (#16643)
Currently, there is no way for an admin to delete an account record. However,
should that happen in the future, or should an admin mistype an account id,
`/admin/action_logs?target_account_id=<non-existent-account-id>` currently
returns a 404 instead of an empty list.

With this commit, the aforementioned page returns a correct list instead
(potentially non-empty if the account has been manually deleted)
2021-10-14 20:53:11 +02:00
Eugen Rochko 07341e7aa6
Add graphs and retention metrics to admin dashboard (#16829) 2021-10-14 20:44:59 +02:00
Claire 216570ad98
Fix scheduled statuses decreasing statuses counts (#16791)
* Add tests

* Fix scheduled statuses decreasing statuses counts

Fixes #16774
2021-10-14 19:59:21 +02:00
Claire 5159ba26e4
Fix error when rendering public pages with media attachments (#16763)
* Add tests

* Fix error when rendering public pages with media attachments

* Add tests

* Fix tests

* Please CodeClimate
2021-10-13 15:27:19 +02:00
Sasha Sorokin 89b5071fde
Add single option votes tooltip in polls (#16849)
Adds a tooltip when hovering over the percentages in a poll showing how
many votes were cast for that option.

Also removes descriptions from messages here since they are not picked
up by Crowdin anyway and might be confusing to other developers :)

Fixes #16820
2021-10-13 04:59:31 +02:00
Claire 84ceebe1c4
Fix media attachment size validation not correctly accounting for file type (#16819)
* Fix media attachment size validation not correctly accounting for file type

Fixes a regression introduced in #16724 caused by the fact that kt-paperclip
now correctly runs validations before processing, meaning that file size
verification could not rely on our before_post_processing hook.

Moved the `before_post_processing` hooks to `before_validate` to make sure
the media attachment type is set correctly before the file gets validated.

* Add tests
2021-10-06 14:49:32 +01:00
Mélanie Chauvel 900481b7fa
Improve hover and focus style in columns settings (#16222)
* Make focus visible on switches and text buttons in columns settings

* Make hover/focus visible on left/right arrows in columns settings

Use same style as for station action bar (reply/boost/fav/etc.)

* Tab first to “Pin/Unpin” before left/right arrows in columns settings
2021-10-01 00:55:51 +02:00
Claire 24f9ea7818
Fix webauthn secure key authentication (#16792)
* Add tests

* Fix webauthn secure key authentication

Fixes #16769
2021-09-30 05:26:29 +02:00
Mashiro 2e549fa2d5
Fix drawer tab menu routes in advanced web ui (#16793) 2021-09-30 05:19:08 +02:00
Claire fc3ae1343d
Switch from unmaintained paperclip to kt-paperclip (#16724)
* Switch from unmaintained paperclip to kt-paperclip

* Drop some compatibility monkey-patches not required by kt-paperclip

* Drop media spoof check monkey-patching

It's broken with kt-paperclip and hopefully it won't be needed anymore

* Fix regression introduced by paperclip 6.1.0

* Do not rely on pathname to call FastImage

* Add test for ogg vorbis file with cover art

* Add audio/vorbis to the accepted content-types

This seems erroneous as this would be the content-type for a vorbis stream
without an ogg container, but that's what the `marcel` gem outputs, so…

* Restore missing for_as_default method

* Refactor Attachmentable concern and delay Paperclip's content-type spoof check

Check for content-type spoofing *after* setting the extension ourselves, this
fixes a regression with kt-paperclip's validations being more strict than
paperclip 6.0.0 and rejecting some Pleroma uploads because of unknown
extensions.

* Please CodeClimate

* Add audio/vorbis to the unreliable set

It doesn't correspond to a file format and thus has no extension associated.
2021-09-29 23:52:36 +02:00
Claire 6b19e1e632
Fix incorrect use of old WebUI paths (#16773)
* Fix incorrect use of old WebUI paths

PR #16171 renamed some routes but missed some occurrences.
Without #16772, this leads to unreachable routes in those cases.

* Fix floating action button being displayed on statuses and compose screen
2021-09-27 07:24:04 +02:00
Claire 11502ae46e
Add aliases for WebUI routes that were renamed in #16171 (#16772)
* Add aliases for some WebUI routes that were renamed in #16171

Accounts and statuses routes need more work as they use different parameters.

* Add aliases for /statuses/* routes

* Add aliases for /accounts/* WebUI routes

Does not correctly set the “active” state on the navigation tabs but this is
a minor issue.

* Fix some routes

* Fix /accounts/:id/{media,followers,following} not loading on legacy routes
2021-09-27 07:23:48 +02:00
Eugen Rochko a0d4129893
Refactor notifications to go through a separate stream in streaming API (#16765)
Eliminate need to have custom notifications filtering logic in the
streaming API code by publishing notifications into a separate stream
and then simply using the multi-stream capability to subscribe to that
stream when necessary
2021-09-26 13:23:28 +02:00
Eugen Rochko 52e5c07948
Change routing paths to use usernames in web UI (#16171) 2021-09-26 05:46:13 +02:00
Claire e0af97164a
Fix followers synchronization mechanism not working when URI has empty path (#16744)
Follow-up to #16510, forgot the controller exposing the actual followers…
2021-09-15 18:51:16 +02:00
Claire db57bff11d
Stop setting a shortcode to newly-created media attachments (#16730)
* Stop setting a shortcode to newly-created media attachments

The WebUI has stopped using the “short media URL” in ages. This isn't used
anywhere except for mail notifications.

Deprecating it would allow us to eventually get rid of at least a database
column and corruption-prone index, as well as a controller.

* Fix tests
2021-09-13 18:59:37 +02:00
Holger 209f8f3a60
use relative path for scope (#16714)
Use relative path for `scope` in web manifest to allow users use PWA correctly via alternate domains.
2021-09-08 23:33:36 +02:00
Claire 12cd097e7c
Fix addressing of remote groups' followers (#16700)
Fixes #16699
2021-09-08 23:33:23 +02:00
Claire 2b18f7a943
Fix processing mentions to domains with non-ascii TLDs (#16689)
Fixes #16602
2021-09-01 22:06:40 +02:00
Truong Nguyen 7283a5d3b9
Explicitly set userVerification to discoraged (#16545) 2021-08-26 09:51:22 -05:00
Claire 94bcf45321
Fix authentication failures after going halfway through a sign-in attempt (#16607)
* Add tests

* Add security-related tests

My first (unpublished) attempt at fixing the issues introduced (extremely
hard-to-exploit) security vulnerabilities, addressing them in a test.

* Fix authentication failures after going halfway through a sign-in attempt

* Refactor `authenticate_with_sign_in_token` and `authenticate_with_two_factor` to make the two authentication steps more obvious
2021-08-25 22:52:41 +02:00
matildepark 79341d0f5f
Fix follow request count to dynamically update (#16652) 2021-08-25 17:46:29 +02:00
Daniel 5c21021176
Fix undefined variable for Auth::OmniauthCallbacksController (#16654)
The addition of authentication history broke the omniauth login with
the following error:

  method=GET path=/auth/auth/cas/callback format=html
  controller=Auth::OmniauthCallbacksController action=cas status=500
  error='NameError: undefined local variable or method `user' for
  #<Auth::OmniauthCallbacksController:0x00000000036290>
  Did you mean?  @user' duration=435.93 view=0.00 db=36.19

* app/controllers/auth/omniauth_callbacks_controller.rb: fix variable
  name to `@user`
2021-08-25 17:40:56 +02:00
Claire 3c45dfa0fe
Fix “discoverable” account setting being tied to profile directory (#16637) 2021-08-20 16:11:58 +02:00
Claire 9ac7e6fef7
Fix remotely-suspended accounts' toots being merged back into timelines (#16628)
* Fix remotely-suspended accounts' toots being merged back into timelines

* Mark remotely-deleted accounts as remotely suspended
2021-08-20 07:40:33 +01:00
Holger 0cae6c07bb
Fix #16603 (#16605)
Fix issue #16603 undefined method `serialize_payload' for Unsuspend Account Service error.
It seems that this service forgot to `include Payloadable` so that `serialize_payload` could not be found in this service.
2021-08-20 07:39:37 +01:00
Claire 0c24c865b7
Fix crash if a notification contains an unprocessed media attachment (#16573)
* Refactor AttachmentList

* Do not crash if a notification contains an unprocessed media attachment

Fixes #16530

* Fix spacing in compact form
2021-08-11 17:49:10 +02:00
Claire aaf24d3093
Fix download button color in audio player (#16572)
Fixes #16571
2021-08-11 17:48:55 +02:00
Claire 5efb1ff337
Fix followers synchronization mechanism not working when URI has empty path (#16510)
* Fix followers synchronization mechanism not working when URI has empty path

To my knowledge, there is no current implementation on the fediverse
that can use bare domains (e.g., actor is at https://example.org instead of
something like https://example.org/actor) that also plans to support the
followers synchronization mechanism. However, Mastodon's current implementation
would exclude such accounts from followers list.

Also adds tests and rename them to reflect the proper method names.

* Move url prefix regexp to its own constant
2021-08-11 17:48:42 +02:00
Claire 13b08610a0
Fix crash when encountering invalid account fields (#16598)
* Add test

* Fix crash when encountering invalid account fields
2021-08-11 16:40:55 +02:00
Claire 4ac78e2a06
Add feature to automatically delete old toots (#16529)
* Add account statuses cleanup policy model

* Record last inspected toot to delete to speed up successive calls to statuses_to_delete

* Add service to cleanup a given account's statuses within a budget

* Add worker to go through account policies and delete old toots

* Fix last inspected status id logic

All existing statuses older or equal to last inspected status id must be
kept by the current policy. This is an invariant that must be kept so that
resuming deletion from the last inspected status remains sound.

* Add tests

* Refactor scheduler and add tests

* Add user interface

* Add support for discriminating based on boosts/favs

* Add UI support for min_reblogs and min_favs, rework UI

* Address first round of review comments

* Replace Snowflake#id_at_start with with_random parameter

* Add tests

* Add tests for StatusesCleanupController

* Rework settings page

* Adjust load-avoiding mechanisms

* Please CodeClimate
2021-08-09 23:11:50 +02:00
Takeshi Umeda 709876bd6c
Fix invalid blurhash handling in Create activity (#16583) 2021-08-09 13:33:19 +02:00
Takeshi Umeda 590e1578bf
Fix when MoveWorker cannot get locale from remote account (#16576) 2021-08-08 15:31:02 +02:00