about summary refs log tree commit diff
path: root/app/controllers/application_controller.rb
AgeCommit message (Collapse)Author
2020-07-22Fix RSS feeds not being cachable (#14368)ThibG
* Add tests for some cachable responses This only covers responses that we should have managed to make cachable so far. It's not the case of all responses that should be cachable in the end. * Fix RSS feeds not being cachable
2020-03-08Add specific rate limits for posting and following (#13172)Eugen Rochko
2020-01-04Fix base64-encoded file uploads not being possible (#12748)Eugen Rochko
Fix #3804, Fix #5776
2019-12-30Fix HTML error pages being returned when JSON is expected (#12713)Eugen Rochko
Fix #12509 See also #12214
2019-12-10Fix missing error templates for non-HTML requests (#12593)Eugen Rochko
2019-11-13Change to always returns html document in error pages (#12214)Yamagishi Kazutoshi
2019-09-07Add healthcheck endpoint for web (#11770)Yamagishi Kazutoshi
2019-08-30Fix uncaught parameter missing exceptions and missing error templates (#11702)Eugen Rochko
2019-08-18Fix uncaught 422 and 500 errors (#11590)Eugen Rochko
2019-08-16Fix 422 being returned instead of 404 when POSTing (#11574)Eugen Rochko
2019-07-30Add whitelist mode (#11291)Eugen Rochko
2019-07-22Change unconfirmed user login behaviour (#11375)Eugen Rochko
Allow access to account settings, 2FA, authorized applications, and account deletions to unconfirmed and pending users, as well as users who had their accounts disabled. Suspended users cannot update their e-mail or password or delete their account. Display account status on account settings page, for example, when an account is frozen, limited, unconfirmed or pending review. After sign up, login users straight away and show a simple page that tells them the status of their account with links to account settings and logout, to reduce onboarding friction and allow users to correct wrongly typed e-mail addresses. Move the final sign-up step of SSO integrations to be the same as above to reduce code duplication.
2019-07-21Add (back) rails-level JSON caching (#11333)Eugen Rochko
2019-07-21Change locale detection to run once per session (#8657)Eugen Rochko
Fix #6462
2019-07-19Add ActivityPub actor representing the entire server (#11321)ThibG
* Add support for an instance actor * Skip username validation for local Application accounts * Add migration script to create instance actor * Make Codeclimate happy * Switch to id -99 for instance actor * Remove unused `icon` and `image` attributes from instance actor * Use if/elsif/else instead of return + ternary operator * Add instance actor to fresh installs * Use instance actor as instance representative Use instance actor for forwarding reports, relay operations, and spam auto-reporting. * Seed database in test environment * Fix single-user mode * Fix tests * Fix specs to accomodate for an extra `Account` * Auto-reject follows on instance actor Following an instance actor might make sense, but we are not handling that right now, so auto-reject. * Fix webfinger lookup and serialization for instance actor * Rename instance actor * Make it clear in the HTML view that the instance actor should not be blocked * Raise cache time for instance actor as there's no dynamic content * Re-use /about/more with a flash message for instance actor profile
2019-07-17Fix caching headers in ActivityPub endpoints (#11331)ThibG
* Fix reverse-proxy caching in public fetch mode * Fix caching in ActivityPub-specific controllers
2019-07-11Add ActivityPub secure mode (#11269)Eugen Rochko
* Add HTTP signature requirement for served ActivityPub resources * Change `SECURE_MODE` to `AUTHORIZED_FETCH` * Add 'Signature' to 'Vary' header and improve code style * Improve code style by adding `public_fetch_mode?` method
2019-07-08Refactor controllers for statuses, accounts, and more (#11249)Eugen Rochko
2019-06-25Fix unnecessary SQL query performed on unauthenticated requests (#11179)Eugen Rochko
2019-06-05Cleanup various controllers (#10972)ThibG
* Remove skip_session! as it is not supported in Rails 5 * Minor cleanup in StreamEntriesController * Remove redundant mark_cacheable! calls
2019-03-17Reduce server load caused by anonymous viewing. (#9059)Ben Lubar
Do not start a session if the current user is not logged in for public-facing pages. Mark pages that don't care about sessions as publicly cacheable. Keep the max age as 0 so proxies and browsers will still try to retrieve an updated version but can still fall back to the stale version if the site is down or too slow. Fixes #9035.
2018-11-16Remove intermediary arrays when creating hash maps from results (#9291)Eugen Rochko
2018-10-28Include preview cards in status entity in REST API (#9120)Eugen Rochko
* Include preview cards in status entity in REST API * Display preview card in-stream * Improve in-stream display of preview cards
2018-09-09Add force_login option to OAuth authorize page (#8655)Eugen Rochko
* Add force_login option to OAuth authorize page For when a user needs to sign into an app from multiple accounts on the same server * When logging out from modal header, redirect back after re-login
2018-08-23Allow mods to disable login, improve message when login disabled (#8329)Eugen Rochko
* Allow moderators to disable/enable login * Instead of rejecting login, show forbidden error when login disabled Avoid confusion because when login is rejected, the message is that the account is not activated, which is wrong. * Fix tests
2018-08-23Add ability to change an instance default theme from the administration ↵Jakub Mendyk
panel (#7092) (#8381) * Add default_settings class method to ScopedSettings ScopedSettings was extended to use value of unscoped setting instead of only using defaults set in config/settings.yml for selected settings. This adds possibility for admins to set default values of users' settings, for example default theme (as requested in #7092). * Add ability to change an instance default theme Closes #7092
2018-08-19Unuse ActiveRecord::Base#cache_key (#8185)abcang
* Unuse ActiveRecord::Base#cache_key * Enable cache_versioning * Call cache_collection
2018-05-26Catch ActionController::UnknownFormat and return HTTP 406 (#7621)Eugen Rochko
An error like that should not appear in production error log.
2018-05-11Update session activation time (fixes #5605) (#7408)ThibG
2018-04-03Improve require_admin! and require_staff! filters (#7018)Emelia Smith
Previously these returns 302 redirects instead of 403s, which meant posting links to admin pages in slack caused them to unfurl, rather than stay as a link. Additionally, require_admin! doesn't appear to be actively used, on require_staff!
2018-02-28Fix #942: Seamless LDAP login (#6556)Eugen Rochko
2018-02-22Fix #6526: Only store redirect location if not in JSON format (#6528)Eugen Rochko
2018-02-02pam authentication (#5303)Alexander
* add pam support, without extra column * bugfixes for pam login * document options * fix code style * fix codestyle * fix tests * don't call remember_me without password * fix codestyle * improve checks for pam usage (should fix tests) * fix remember_me part 1 * add remember_token column because :rememberable requires either a password or this column. * migrate db for remember_token * move pam_authentication to the right place, fix logic bug in edit.html.haml * fix tests * fix pam authentication, improve username lookup, add comment * valid? is sometimes not honored, return nil instead trying to authenticate with pam * update devise_pam_authenticatable2 and adjust code. Fixes sideeffects observed in tests * update devise_pam_authenticatable gem, fixes for codeconventions, fix finding user * codeconvention fixes * code convention fixes * fix idention * update dependency, explicit conflict check * fix disabled password updates if in pam mode * fix check password if password is present, fix templates * block registration if account is maintained by pam * Revert "block registration if account is maintained by pam" This reverts commit 8e7a083d650240b6fac414926744b4b90b435f20. * fix identation error introduced by rebase * block usernames maintained by pam * document pam settings better * fix code style
2018-01-07Fix force_ssl conditional (#6201)Yamagishi Kazutoshi
2018-01-07Fix unintended cache (#6214)Yamagishi Kazutoshi
2018-01-04Make sure private toots remain private and do not end up in HTTP caches (#6175)ThibG
2018-01-04Cache JSON of immutable ActivityPub representations (#6171)Eugen Rochko
2017-12-29Add more instance stats APIs (#6125)Eugen Rochko
* Add GET /api/v1/instance/peers API to reveal known domains * Add GET /api/v1/instance/activity API * Make new APIs disableable, exclude private statuses from activity stats * Fix code style issue * Fix week timestamps
2017-11-17Fix some rubocop style issues (#5730)Eugen Rochko
2017-11-11Add moderator role and add pundit policies for admin actions (#5635)Eugen Rochko
* Add moderator role and add pundit policies for admin actions * Add rake task for turning user into mod and revoking it again * Fix handling of unauthorized exception * Deliver new report e-mails to staff, not just admins * Add promote/demote to admin UI, hide some actions conditionally * Fix unused i18n
2017-09-19Add support for multiple themes (#4959)Andrew
* Add support for selecting a theme * Fix codeclimate issues * Look up site default style if current user is not available due to e.g. not being logged in * Remove outdated comment in common.js * Address requested changes in themes PR * Fix codeclimate issues * Explicitly check current_account in application controller and only check theme availability if non-nil * codeclimate * explicit precedence with && * Fix code style in application_controller according to @nightpool's suggestion, use default style in embedded.html.haml * codeclimate: indentation + return
2017-08-05Add "signed in as" header to some pages (#4523)Eugen Rochko
2017-07-07Fix #4058 - Use a long-lived cookie to keep track of user-level sessions (#4091)Eugen Rochko
* Fix #4058 - Use a long-lived cookie to keep track of user-level sessions * Fix tests, smooth migrate from previous session-based identifier
2017-06-25Bind web UI access tokens to sessions (#3940)Eugen Rochko
* Add overview of active sessions * Better display of browser/platform name * Improve how browser information is stored and displayed for sessions overview * Fix test * Fix #2347 - Bind web UI access token to session When you logout, session also destroys the access token, so it's no longer valid. If access token is destroyed some other way, the session is also destroyed, requiring a re-login. Fix #1681 - Add scheduler to remove revoked access tokens and grants * Fix test
2017-05-24Show error message to suspended user (#3281)Yamagishi Kazutoshi
2017-05-22Change "Account.any?" to "Account.exists?" (#3217)Yamagishi Kazutoshi
2017-05-22single_user_mode? always returns boolean (#3215)Akihiko Odaki
This change also adds a specification for the method.
2017-05-01Error responses cleanup (#2692)Matt Jankowski
* Use respond_with_error for forbidden errors * Wrap up common error code into single method
2017-04-30Extract user tracking into concern (#2600)Matt Jankowski
2017-04-25Localize with i18n for Devise::FailureApp (#2309)alpaca-tc
This PR fixes I18n.locale for rake middlewares. Mastodon uses Devise that depends on Warden. Warden::Manager can be found in rake middleware. It is outside of the controller. In the case of authentication failed, warden calls throw(:warden). At the time Warden::Manager delegates request to failure_app to generate response and flash[:alert] after catching it. Unfortunately, I18n.locale is already reset then because I18n.with_locale is enabled only inside the controller. If we used I18n.locale=, Devise::FailureApp could get the current locale.
generated by cgit-pink (git 2.37.1) at 2024-06-26 16:13:48 +0000