about summary refs log tree commit diff
path: root/app/lib
AgeCommit message (Collapse)Author
2019-02-27Fix mention processing for unknwon accounts on incoming ActivityPub Notes ↵ThibG
(#10125) `::FetchRemoteAccountService` is not `ActivityPub::FetchRemoteAccountService`, its second argument is the pre-fetched body. Passing `id: false` actually passed a `Hash` as the prefetched body, instead of properly resolving unknown remote accounts.
2019-02-17Fix Announce activities of unknown statuses not fetching those statuses (#10065)Eugen Rochko
Regression from #9998
2019-02-17Add logging for rejected ActivityPub payloads and add tests (#10062)Eugen Rochko
2019-02-15Filter incoming Announce activities by relation to local activity (#10041)Eugen Rochko
* Filter incoming Announce activities by relation to local activity Reject if announcer is not followed by local accounts, and is not from an enabled relay, and the object is not a local status Follow-up to #10005 * Fix tests
2019-02-13Filter incoming Create activities by relation to local activity (#10005)Eugen Rochko
Reject those from accounts with no local followers, from relays that are not enabled, which do not address local accounts and are not replies to accounts that do have local followers
2019-02-13Alternative handling of private self-boosts (#9998)ThibG
* When self-boosting, embed original toot into Announce serialization * Process unknown self-boosts from Announce object if it is more than an URI * Add some self-boost specs * Only serialize private toots in self-Announces
2019-02-09Fix URL linkifier grabbing full-width spaces and quotations (#9997)Eugen Rochko
Fix #9993 Fix #5654
2019-02-09 Only URLs extract with pre-escaped text (#9991)Hinaloe
* [test] add japanese hashtag testcase * Only URLs extract with pre-escaped text ( https://github.com/tootsuite/mastodon/issues/9989 )
2019-02-02Make displaying application used to toot opt-in (#9897)ThibG
* Make storing and displaying application used to toot opt-in * Revert to storing application info, and display it to the author via API
2019-02-02Create Redisable#redis (#9633)ysksn
* Create Redisable * Use #redis instead of Redis.current
2019-02-02Allow most kinds of characters in URL query (fixes #8408) (#8447)Jakub Mendyk
* Allow unicode characters in URL query strings Fixes #8408 * Alternative approach to unicode support in urls Adds PoC/idea to approch this problem.
2019-01-18Add tombstones for remote statuses (#9830)ThibG
* Add Tombstone model to remember object deletion * Do not recreate a status if it has been deleted * Record Tombstone for remote deleted items Also, only record deleted items from same-host actors * Clear an user's tombstones when their key change
2019-01-18Add support for non-public reblogs from ActivityPub (#9841)Eugen Rochko
Fix #9838
2019-01-16Use summary as summary for converted ActivityPub objects (#9823)Eugen Rochko
Fix #8609
2019-01-16Reduce chances of race conditions when processing deleted toots (#9815)ThibG
* Reduce chances of race conditions when processing deleted toots * Prevent race condition when processing deleted toots
2019-01-02Ensure blocked user unfollows blocker if Block/Undo Block are processed out ↵ThibG
of order (#9687) * Ensure blocked user unfollows blocker if Block/Undo Block are processed out of order * Add specs for Block causing unfollow and for out-of-order Block + Undo
2018-12-30Do not ignore federated reports targetting already-reported accounts (#9534)ThibG
2018-12-30Reduce usage of LD signatures (#9659)ThibG
* Do not LDS-sign Follow, Accept, Reject, Undo, Block * Do not use LDS for Create activities of private toots * Minor cleanup * Ignore unsigned activities instead of misattributing them * Use status.distributable? instead of querying visibility directly
2018-12-29Add handler for Move activity (#9629)Eugen Rochko
2018-12-26Fix ThreadResolveWorker getting queued with invalid URLs (#9628)Eugen Rochko
2018-12-09Add setting to not aggregate reblogs (#9248)ThibG
* Add setting to not aggregate reblogs Fixes #9222 * Handle cases where user is nil in add_to_home and add_to_list * Add hint for setting_aggregate_reblogs option * Reword setting_aggregate_reblogs label
2018-11-27Fix TLS handshake timeout not being enforced (#9381)Eugen Rochko
Follow-up to #9329
2018-11-27Fix nil error when no DNS addresses are found for host (#9379)Eugen Rochko
2018-11-22Fix connect timeout not being enforced (#9329)Eugen Rochko
* Fix connect timeout not being enforced The loop was catching the timeout exception that should stop execution, so the next IP would no longer be within a timed block, which led to requests taking much longer than 10 seconds. * Use timeout on each IP attempt, but limit to 2 attempts * Fix code style issue * Do not break Request#perform if no block given * Update method stub in spec for Request * Move timeout inside the begin/rescue block * Use Resolv::DNS with timeout of 1 to get IP addresses * Update Request spec to stub Resolv::DNS instead of Addrinfo * Fix Resolve::DNS stubs in Request spec
2018-11-21Include replies to list owner and replies to list members in list statuses ↵ThibG
(#9324)
2018-11-21Revert connect timeout from 1s to 10s (#9319)Eugen Rochko
The failure rate in Sidekiq is too high
2018-11-16Prevent multiple handlers for Delete of Actor from running (#9292)Eugen Rochko
2018-11-16Remove intermediary arrays when creating hash maps from results (#9291)Eugen Rochko
2018-11-10Fix emoji update date processing (#9255)ThibG
2018-11-08Reduce connect timeout limit and limit signature failures by source IP (#9236)Eugen Rochko
* Reduce connect timeout from 10s to 1s * Limit failing signature verifications per source IP
2018-10-30Accept the same payload in multiple inboxes and deliver (#9150)Eugen Rochko
2018-10-29Add Page AP type support (#9121)m.b
2018-10-26Ignore invalid hashtags on remote statuses instead of rejecting them (#9118)ThibG
Fixes #9115
2018-10-26Fix missing `mention` argument when processing incoming Create activities ↵ThibG
(#9114) * Fix missing `mention` argument when processing incoming Create activities * Fix typo (param → params)
2018-10-25Allow inbox owner to view implicitly targeted ActivityPub payload (#9093)Eugen Rochko
Fix #9091
2018-10-20Add option to block reports from domain (#8830)Eugen Rochko
2018-10-17Improve support for aspects/circles (#8950)Eugen Rochko
* Add silent column to mentions * Save silent mentions in ActivityPub Create handler and optimize it Move networking calls out of the database transaction * Add "limited" visibility level masked as "private" in the API Unlike DMs, limited statuses are pushed into home feeds. The access control rules between direct and limited statuses is almost the same, except for counter and conversation logic * Ensure silent column is non-null, add spec * Ensure filters don't check silent mentions for blocks/mutes As those are "this person is also allowed to see" rather than "this person is involved", therefore does not warrant filtering * Clean up code * Use Status#active_mentions to limit returned mentions * Fix code style issues * Use Status#active_mentions in Notification And remove stream_entry eager-loading from Notification
2018-10-12Improve signature verification safeguards (#8959)Eugen Rochko
* Downcase signed_headers string before building the signed string The HTTP Signatures draft does not mandate the “headers” field to be downcased, but mandates the header field names to be downcased in the signed string, which means that prior to this patch, Mastodon could fail to process signatures from some compliant clients. It also means that it would not actually check the Digest of non-compliant clients that wouldn't use a lowercased Digest field name. Thankfully, I don't know of any such client. * Revert "Remove dead code (#8919)" This reverts commit a00ce8c92c06f42109aad5cfe65d46862cf037bb. * Restore time window checking, change it to 12 hours By checking the Date header, we can prevent replaying old vulnerable signatures. The focus is to prevent replaying old vulnerable requests from software that has been fixed in the meantime, so a somewhat long window should be fine and accounts for timezone misconfiguration. * Escape users' URLs when formatting them Fixes possible HTML injection * Escape all string interpolations in Formatter class Slightly improve performance by reducing class allocations from repeated Formatter#encode calls * Fix code style issues
2018-10-11Fix typo in ActivityPub Create handler (#8952)Eugen Rochko
Regression from #8951
2018-10-11Move network calls out of transaction in ActivityPub handler (#8951)Eugen Rochko
Mention and emoji code may perform network calls, but does not need to do that inside the database transaction. This may improve availability of database connections when using pgBouncer in transaction mode.
2018-10-07Add conversations API (#8832)Eugen Rochko
* Add conversations API * Add web UI for conversations * Add test for conversations API * Add tests for ConversationAccount * Improve web UI * Rename ConversationAccount to AccountConversation * Remove conversations on block and mute * Change last_status_id to be a denormalization of status_ids * Add optimistic locking
2018-10-05Leave unknown language as nil if account is remote (#8861)Jeong Arm
* Force use language detector if account is remote * Set unknown remote toot's language as nil
2018-10-03Fix handling of ActivityPub activities lacking some attributes (#8864)ThibG
2018-09-28Fix class autoloading issue in ActivityPub::Activity::Create (#8820)Eugen Rochko
2018-09-28Exclude replies from list timelines (#8683)cbayerlein
* Changed list behaviour I added the following line to the FeedManager (app/lib/feed_manager.rb) in the push_to_list function: `return false if status.reply?` Now all posts that are replies are filtered out, so that now only "genuine" posts are displayed in the list. This is a first approach to solve issue #5916 * Update feed_manager.rb As suggested by @Gargron
2018-09-25Add a new preference to always hide all media (#8569)ふぁぼ原
2018-09-24Add user preference to always expand toots marked with content warnings (#8762)Matt Sweetman
2018-09-18Redesign forms, verify link ownership with rel="me" (#8703)Eugen Rochko
* Verify link ownership with rel="me" * Add explanation about verification to UI * Perform link verifications * Add click-to-copy widget for verification HTML * Redesign edit profile page * Redesign forms * Improve responsive design of settings pages * Restore landing page sign-up form * Fix typo * Support <link> tags, add spec * Fix links not being verified on first discovery and passive updates
2018-08-31Fix autoplay issue with spoiler tag (#8540)Renato "Lond" Cerqueira
Add tests to avoid similar issues in the future
2018-08-31Do not sign useless User-Agent or Accept-Encoding headers (#8533)Eugen Rochko
Fix #8080
generated by cgit-pink (git 2.37.1) at 2024-11-05 07:58:31 +0000