about summary refs log tree commit diff
path: root/app/controllers
AgeCommit message (Collapse)Author
2020-03-06Remove useless `respond_to` calls (#13208)Eugen Rochko
2020-02-27Fix leak of arbitrary statuses through unfavourite action in REST API (#13161)Eugen Rochko
2020-02-24Fix dismissing an announcement twice raising an obscure error (#13124)ThibG
2020-02-19Fix account JSON/RSS not being cacheable due to wrong mime type comparison ↵ThibG
(#13116) `request.format` is not a symbol but a `Mime::Type`, so the condition actually never matched, and a session was created even for those requests, preventing caching.
2020-02-16Fix sign-ups without checked user agreement being accepted through the web ↵ThibG
form (#13088) * Fix user agreement not being verified * Fix tests * Fix up agreement field being dismissed
2020-02-08Fix unfiltered params error when generating ActivityPub tag pagination (#13049)Eugen Rochko
2020-02-07Fix malformed HTML causing uncaught error (#13042)Eugen Rochko
Fix OEmbed preview API leaking existence of private statuses (see #12930)
2020-02-03Change signature verification to ignore signatures with invalid host (#13033)Eugen Rochko
Instead of returning a signature verification error, pretend there was no signature (i.e., this does not allow access to resources that need a valid signature), so public resources can still be fetched Fix #13011
2020-02-03Change how unread announcements are handled (#13020)ThibG
* Change meaning of /api/v1/announcements/:id/dismiss to mark an announcement as read * Change how unread announcements are counted in UI * Add unread marker to announcements and mark announcements as unread as they are displayed * Fixups
2020-01-27Add publish/unpublish controls to announcements in admin UI (#12967)Eugen Rochko
2020-01-26Add streaming API updates for announcements being modified or deleted (#12963)Eugen Rochko
Change `all_day` to be a visual client-side cue only Publish immediately if `scheduled_at` is in the past Add `published_at` and `updated_at` to announcements JSON
2020-01-24Fix OEmbed leaking information about existence of non-public statuses (#12930)Eugen Rochko
2020-01-24Fix password change/reset not immediately invalidating other sessions (#12928)Eugen Rochko
While making browser requests in the other sessions after a password change or reset does not allow you to be logged in and correctly invalidates the session making the request, sessions have API tokens associated with them, which can still be used until that session is invalidated. This is a security issue for accounts that were already compromised some other way because it makes it harder to throw out the hijacker.
2020-01-24Fix relationships page not showing results in admin UI (#12934)Eugen Rochko
Follow-up to #12927
2020-01-23Add announcements (#12662)Eugen Rochko
* Add announcements Fix #11006 * Add reactions to announcements * Add admin UI for announcements * Add unit tests * Fix issues - Add `with_dismissed` param to announcements API - Fix end date not being formatted when time range is given - Fix announcement delete causing reactions to send streaming updates - Fix announcements container growing too wide and mascot too small - Fix `all_day` being settable when no time range is given - Change text "Update" to "Announcement" * Fix scheduler unpublishing announcements before they are due * Fix filter params not being passed to announcements filter
2020-01-23Change followers page to relationships page in admin UI (#12927)Eugen Rochko
Allow browsing and filtering all relationships instead of just followers, unify the codebase with the user-facing relationship manager, add ability to see who the user invited
2020-01-20Various fixes and improvements (#12878)Eugen Rochko
* Fix unused role routes being generated * Remove unused JavaScript code * Refactor filters code to be DRYer * Fix `.count == 0` comparisons to `.empty?` in views * Fix filters in views
2020-01-14Fix access to OEmbed endpoint in secure mode (#12864)Eugen Rochko
2020-01-04Fix base64-encoded file uploads not being possible (#12748)Eugen Rochko
Fix #3804, Fix #5776
2020-01-03Fix missing authentication call in filters controller (#12746)Eugen Rochko
2020-01-03Fix uncaught unknown format errors in host meta controller (#12747)Eugen Rochko
2019-12-31Hide blocked users from more places (#12733)ThibG
* Hide blocked, muted, and blocked-by users from toot favourite lists * Hide blocked, muted, and blocked-by users from toot reblog lists * Hide blocked, muted, and blocked-by users from followers/following (API) * Fix tests * Hide blocked, muted, and blocked-by users from followers/following on public pages
2019-12-31Fix error when fetching followers/following from REST API when user has ↵Eugen Rochko
network hidden (#12716) Fix #12510
2019-12-30Remove unused AccountRelationshipsPresenter call in public pages (#12734)ThibG
Those were used to show a “follow” or “unfollow” button on account grid on public pages, but that got removed a while ago.
2019-12-30Fix settings pages being cacheable by the browser (#12714)Eugen Rochko
Fix #12255
2019-12-30Fix HTML error pages being returned when JSON is expected (#12713)Eugen Rochko
Fix #12509 See also #12214
2019-12-10Fix missing error templates for non-HTML requests (#12593)Eugen Rochko
2019-12-06Fix generic HTTP 500 error on duplicate records (#12563)Eugen Rochko
Fix #12551 Fix #12547
2019-12-01Add follow_request notification type (#12198)ThibG
* Add follow_request notification type The notification type already existed in the backend but was never pushed to the front-end. This also means translation strings were also available for the backend, from the notification mailer. Unlike other notification types, these are off by default, to match what I remember of Gargron's view on the topic: that follow requests should not clutter notifications and should instead be reviewed at the user's own leisure in the dedicated column. Since follow requests have their own column, I've deemed it unnecessary to add a specific tab for them in the notification quick filter. * Show follow request link in single-column if there are pending requests, even if account isn't locked * Push follow requests from notifications to the follow_requests list * Offer to accept or reject follow request from the notification * Redesign follow request notification
2019-11-30Add ability to filter reports by target account domain (#12154)ThibG
* Add ability to filter reports by target account domain * Reword by_target_domain label
2019-11-28Fix proofs API being inaccessible in secure mode (#12495)Eugen Rochko
2019-11-17Support min_id-based pagination for bookmarks (#12381)Gomasy
* Support min_id-based pagination for bookmarks * Fix spec
2019-11-16make it not return http 400 when passing and empty source argument (#12259)Jennifer Glauche
* make it not return http 400 when passing and empty source argument * create a spec for the empty source hash bug * compact checks for nil, empty? parameters * use nil.blank? instead checking for nil
2019-11-13Add bookmarks (#7107)ThibG
* Add backend support for bookmarks Bookmarks behave like favourites, except they aren't shared with other users and do not have an associated counter. * Add spec for bookmark endpoints * Add front-end support for bookmarks * Introduce OAuth scopes for bookmarks * Add bookmarks to archive takeout * Fix migration * Coding style fixes * Fix rebase issue * Update bookmarked_statuses to latest UI changes * Update bookmark actions to properly reflect status changes in state * Add bookmarks item to single-column layout * Make active bookmarks red
2019-11-13Change to always returns html document in error pages (#12214)Yamagishi Kazutoshi
2019-10-24Add setting for whether to crop images in unexpanded toots (#12126)Faye Duxovni
2019-10-24Fix incoming federation in whitelist mode (#12185)ThibG
… posting to the AP inbox required a logged-in local user…
2019-10-09Fix attachment not being re-downloaded even if file is not stored (#12125)Eugen Rochko
Change the behaviour of remotable concern. Previously, it would skip downloading an attachment if the stored remote URL is identical to the new one. Now it would not be skipped if the attachment is not actually currently stored by Paperclip.
2019-10-06Fix `GET /api/v1/instance` REST APIs being unavailable in secure mode (#12089)Eugen Rochko
2019-10-06Fix performance of home feed regeneration (#12084)Eugen Rochko
Fetching statuses from all followed accounts at once takes too long within Postgres. Fetching them one by one and merging in Ruby could be a lot less resource-intensive Because the query for dynamically fetching the home timeline is so heavy, we can no longer offer it when the home timeline is missing
2019-10-03Add `reason` param to `POST /api/v1/accounts` REST API (#12064)Eugen Rochko
For approval-required registrations mode
2019-10-02Fix RSS caching (but disable localization) (#12054)ThibG
2019-10-02Fix featured hashtag URL being interpreted as media or with_replies (#12048)Eugen Rochko
Fix #12034
2019-09-29Add a nodeinfo endpoint (#12002)Eugen Rochko
* Add nodeinfo endpoint * dont commit stuff from my local dev * consistant naming since we implimented 2.1 schema * Add some additional node info stuff * Add nodeinfo endpoint * dont commit stuff from my local dev * consistant naming since we implimented 2.1 schema * expanding this to include federation info * codeclimate feedback * CC feedback * using activeserializers seems like a good idea... * get rid of draft 2.1 version * Reimplement 2.1, also fix metaData -> metadata * Fix metaData -> metadata here too * Fix nodeinfo 2.1 tests * Implement cache for monthly user aggregate * Useless * Remove ostatus from the list of supported protocols * Fix nodeinfo's open_registration reading obsolete setting variable * Only serialize domain blocks with user-facing limitations * Do not needlessly list noop severity in nodeinfo * Only serialize domain blocks info in nodeinfo when they are set to be displayed to everyone * Enable caching for nodeinfo endpoints * Fix rendering nodeinfo * CodeClimate fixes * Please CodeClimate * Change InstancePresenter#active_user_count_months for clarity * Refactor NodeInfoSerializer#metadata * Remove nodeinfo 2.1 support as the schema doesn't exist * Clean-up
2019-09-29Fix account migration not affecting followers on origin server (#11980)Eugen Rochko
2019-09-29Add (back) option to set redirect notice on account without moving followers ↵Eugen Rochko
(#11994) Fix #11913
2019-09-28Fix redirecting non-functional accounts on public pages (#11978)Eugen Rochko
Fix #11969
2019-09-28Add `exclude_unreviewed` param to `GET /api/v2/search` REST API (#11977)Eugen Rochko
Make it so normal search returns even unreviewed matches, but autosuggestions do not. Fix #11960
2019-09-27Change silences to always require approval on follow (#11975)ThibG
* Change silenced accounts to require approval on follow * Also require approval for follows by people explicitly muted by target accounts * Do not auto-accept silenced or muted accounts when switching from locked to unlocked * Add `follow_requests_count` to verify_credentials * Show “Follow requests” menu item if needed even if account is locked * Add tests * Correctly reflect that follow requests weren't auto-accepted when local account is silenced * Accept follow requests from user-muted accounts to avoid leaking mutes
2019-09-27Improve status pin query (#11972)abcang
generated by cgit-pink (git 2.37.1) at 2024-11-09 16:19:13 +0000