anti-harassment: add option to toggle whether to allow follows/packmate requests from accounts you've never interacted with before; default to off

7 files changed, 30 insertions, 2 deletions

diff --git a/app/controllers/settings/preferences_controller.rb b/app/controllers/settings/preferences_controller.rb
index feebabbc8..c91f40d26 100644
--- a/app/controllers/settings/preferences_controller.rb
+++ b/app/controllers/settings/preferences_controller.rb
@@ -54,6 +54,7 @@ class Settings::PreferencesController < Settings::BaseController
       :invert_filters,
       :filter_timelines_only,
       :monsterpit_api,
+      :allow_unknown_follows,
       chosen_languages: []
     )
   end
diff --git a/app/lib/activitypub/activity/follow.rb b/app/lib/activitypub/activity/follow.rb
index 66df92601..1c19c7006 100644
--- a/app/lib/activitypub/activity/follow.rb
+++ b/app/lib/activitypub/activity/follow.rb
@@ -14,6 +14,11 @@ class ActivityPub::Activity::Follow < ActivityPub::Activity
       return
     end
 
+    if !target_account.user.allow_unknown_follows? && !(target_account.following?(@account) || ever_mentioned_by?(target_account))
+      reject_follow_request!(target_account)
+      return
+    end
+
     # Fast-forward repeat follow requests
     if @account.following?(target_account)
       AuthorizeFollowService.new.call(@account, target_account, skip_follow_request: true, follow_request_uri: @json['id'])
@@ -33,5 +38,11 @@ class ActivityPub::Activity::Follow < ActivityPub::Activity
   def reject_follow_request!(target_account)
     json = Oj.dump(serialize_payload(FollowRequest.new(account: @account, target_account: target_account, uri: @json['id']), ActivityPub::RejectFollowSerializer))
     ActivityPub::DeliveryWorker.perform_async(json, target_account.id, @account.inbox_url)
+  endA
+
+  private
+
+  def ever_mentioned_by?(target_account)
+    Status.joins(:mentions).merge(target_account.mentions).where(account_id: @account.id).exists?
   end
 end
diff --git a/app/models/user.rb b/app/models/user.rb
index b28e3229f..96b6f1f58 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -47,6 +47,7 @@
 #  filter_undescribed        :boolean          default(FALSE), not null
 #  filters_enabled           :boolean          default(FALSE), not null
 #  monsterfork_api           :integer          default("full"), not null
+#  allow_unknown_follows     :boolean          default(FALSE), not null
 #
 
 class User < ApplicationRecord
diff --git a/app/views/settings/preferences/show.html.haml b/app/views/settings/preferences/show.html.haml
index d65fc46e7..97ac59975 100644
--- a/app/views/settings/preferences/show.html.haml
+++ b/app/views/settings/preferences/show.html.haml
@@ -70,6 +70,11 @@
   %hr/
 
   .fields-group
+    = f.input :allow_unknown_follows, as: :boolean, wrapper: :with_label
+
+  %hr/
+
+  .fields-group
     = f.input :only_known, as: :boolean, wrapper: :with_label
     = f.input :hide_boosts, as: :boolean, wrapper: :with_label
     = f.input :media_only, as: :boolean, wrapper: :with_label
diff --git a/config/locales/simple_form.en.yml b/config/locales/simple_form.en.yml
index 0cab950e9..c84bb8fd7 100644
--- a/config/locales/simple_form.en.yml
+++ b/config/locales/simple_form.en.yml
@@ -153,6 +153,7 @@ en:
         setting_larger_drawer: Increase width of compose drawer column
         setting_larger_emoji: Increase size of emoji
         setting_filter_mentions: Apply filters to mentions
+        setting_unknown_follows: Allow packmate requests from accounts you've never interacted with
         setting_hide_replies_muted: Filter replies to those who you are muting
         setting_hide_replies_blocked: Filter replies to those who you are blocking
         setting_hide_replies_blocker: Filter replies to those who are blocking you
diff --git a/db/migrate/20200115201524_add_allow_unknown_follows_to_users.rb b/db/migrate/20200115201524_add_allow_unknown_follows_to_users.rb
new file mode 100644
index 000000000..f735c8aa8
--- /dev/null
+++ b/db/migrate/20200115201524_add_allow_unknown_follows_to_users.rb
@@ -0,0 +1,7 @@
+class AddAllowUnknownFollowsToUsers < ActiveRecord::Migration[5.2]
+  def change
+    safety_assured {
+      add_column :users, :allow_unknown_follows, :boolean, null: false, default: false
+    }
+  end
+end
diff --git a/db/structure.sql b/db/structure.sql
index 06dafb256..e3ba0572e 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -2429,7 +2429,8 @@ CREATE TABLE public.users (
     media_only boolean DEFAULT false NOT NULL,
     filter_undescribed boolean DEFAULT false NOT NULL,
     filters_enabled boolean DEFAULT false NOT NULL,
-    monsterfork_api smallint DEFAULT 2 NOT NULL
+    monsterfork_api smallint DEFAULT 2 NOT NULL,
+    allow_unknown_follows boolean DEFAULT false NOT NULL
 );
 
 
@@ -5468,6 +5469,7 @@ INSERT INTO "schema_migrations" (version) VALUES
 ('20200110221920'),
 ('20200111042543'),
 ('20200114011918'),
-('20200114030940');
+('20200114030940'),
+('20200115201524');