about summary refs log tree commit diff
path: root/app/lib
AgeCommit message (Collapse)Author
2018-10-25Allow inbox owner to view implicitly targeted ActivityPub payload (#9093)Eugen Rochko
Fix #9091
2018-10-20Add option to block reports from domain (#8830)Eugen Rochko
2018-10-17Improve support for aspects/circles (#8950)Eugen Rochko
* Add silent column to mentions * Save silent mentions in ActivityPub Create handler and optimize it Move networking calls out of the database transaction * Add "limited" visibility level masked as "private" in the API Unlike DMs, limited statuses are pushed into home feeds. The access control rules between direct and limited statuses is almost the same, except for counter and conversation logic * Ensure silent column is non-null, add spec * Ensure filters don't check silent mentions for blocks/mutes As those are "this person is also allowed to see" rather than "this person is involved", therefore does not warrant filtering * Clean up code * Use Status#active_mentions to limit returned mentions * Fix code style issues * Use Status#active_mentions in Notification And remove stream_entry eager-loading from Notification
2018-10-12Improve signature verification safeguards (#8959)Eugen Rochko
* Downcase signed_headers string before building the signed string The HTTP Signatures draft does not mandate the “headers” field to be downcased, but mandates the header field names to be downcased in the signed string, which means that prior to this patch, Mastodon could fail to process signatures from some compliant clients. It also means that it would not actually check the Digest of non-compliant clients that wouldn't use a lowercased Digest field name. Thankfully, I don't know of any such client. * Revert "Remove dead code (#8919)" This reverts commit a00ce8c92c06f42109aad5cfe65d46862cf037bb. * Restore time window checking, change it to 12 hours By checking the Date header, we can prevent replaying old vulnerable signatures. The focus is to prevent replaying old vulnerable requests from software that has been fixed in the meantime, so a somewhat long window should be fine and accounts for timezone misconfiguration. * Escape users' URLs when formatting them Fixes possible HTML injection * Escape all string interpolations in Formatter class Slightly improve performance by reducing class allocations from repeated Formatter#encode calls * Fix code style issues
2018-10-11Fix typo in ActivityPub Create handler (#8952)Eugen Rochko
Regression from #8951
2018-10-11Move network calls out of transaction in ActivityPub handler (#8951)Eugen Rochko
Mention and emoji code may perform network calls, but does not need to do that inside the database transaction. This may improve availability of database connections when using pgBouncer in transaction mode.
2018-10-07Add conversations API (#8832)Eugen Rochko
* Add conversations API * Add web UI for conversations * Add test for conversations API * Add tests for ConversationAccount * Improve web UI * Rename ConversationAccount to AccountConversation * Remove conversations on block and mute * Change last_status_id to be a denormalization of status_ids * Add optimistic locking
2018-10-05Leave unknown language as nil if account is remote (#8861)Jeong Arm
* Force use language detector if account is remote * Set unknown remote toot's language as nil
2018-10-03Fix handling of ActivityPub activities lacking some attributes (#8864)ThibG
2018-09-28Fix class autoloading issue in ActivityPub::Activity::Create (#8820)Eugen Rochko
2018-09-28Exclude replies from list timelines (#8683)cbayerlein
* Changed list behaviour I added the following line to the FeedManager (app/lib/feed_manager.rb) in the push_to_list function: `return false if status.reply?` Now all posts that are replies are filtered out, so that now only "genuine" posts are displayed in the list. This is a first approach to solve issue #5916 * Update feed_manager.rb As suggested by @Gargron
2018-09-25Add a new preference to always hide all media (#8569)ふぁぼ原
2018-09-24Add user preference to always expand toots marked with content warnings (#8762)Matt Sweetman
2018-09-18Redesign forms, verify link ownership with rel="me" (#8703)Eugen Rochko
* Verify link ownership with rel="me" * Add explanation about verification to UI * Perform link verifications * Add click-to-copy widget for verification HTML * Redesign edit profile page * Redesign forms * Improve responsive design of settings pages * Restore landing page sign-up form * Fix typo * Support <link> tags, add spec * Fix links not being verified on first discovery and passive updates
2018-08-31Fix autoplay issue with spoiler tag (#8540)Renato "Lond" Cerqueira
Add tests to avoid similar issues in the future
2018-08-31Do not sign useless User-Agent or Accept-Encoding headers (#8533)Eugen Rochko
Fix #8080
2018-08-30Add animate custom emoji param to embed pages (#8507)Renato "Lond" Cerqueira
* Add animate custom emoji param to embed pages * Rename param, use it for avatars and gifs * Fix issues pointed by codeclimate and breaking test * Ignore brakeman warning
2018-08-26Add CLI task for rotating keys (#8466)Eugen Rochko
* If an Update is signed with known key, skip re-following procedure Because it means the remote actor did *not* lose their database * Add CLI method for rotating keys bin/tootctl accounts rotate [USERNAME] Generates a new RSA key per account and sends out an Update activity signed with the old key. * Key rotation: Space out Update fan-outs every 5 minutes per 1000 accounts * Skip suspended accounts in key rotation
2018-08-26Fix low-hanging rubocop gripes (#8458)Quint Guvernator
* rubocop: quit being so picky * rubocop: miscellany * rubocop: prefer present to blank
2018-08-26Spread out crawling randomly to avoid DDoSing the link (#8445)Eugen Rochko
* Spread out crawling randomly to avoid DDoSing the link Fix #4486 * Remove trailing whitespace
2018-08-25Support ActivityStreams’ summaryMap. (#8422)M Somerville
In the same way as contentMap and nameMap.
2018-08-23Add ability to change an instance default theme from the administration ↵Jakub Mendyk
panel (#7092) (#8381) * Add default_settings class method to ScopedSettings ScopedSettings was extended to use value of unscoped setting instead of only using defaults set in config/settings.yml for selected settings. This adds possibility for admins to set default values of users' settings, for example default theme (as requested in #7092). * Add ability to change an instance default theme Closes #7092
2018-08-23Do not crash if remote custom emoji does not define updated date (fixes ↵ThibG
#8376) (#8377)
2018-08-22Improve federated ID validation (#8372)Eugen Rochko
* Fix URI not being sufficiently validated with prefetched JSON * Add additional id validation to OStatus documents, when possible
2018-08-17Implement Undo { Accept { Follow } } (fixes #8234) (#8245)ThibG
* Add Follow#revoke_request! * Implement Undo { Accept { Follow } } (fixes #8234)
2018-08-17Use correct activity id in Accept when receiving duplicate Follow (fixes ↵ThibG
#8218) (#8244)
2018-08-12Expect relays to answer with accept/reject (#8179)Eugen Rochko
2018-08-05Serialize text-less statuses as '.' over OStatus (fixes #7856) (#8126)ThibG
2018-07-30Fix incorrect context definition for the "featured" keyword (#8090)Eugen Rochko
* Fix incorrect context definition for the "featured" keyword Fix #8077 * Adjust context definition for movedTo
2018-07-16Fix activity:interactions counter to count all interactions (#8037)Eugen Rochko
2018-07-16Whitelist dat/ipfs/gopher links in sanitizer (#8034)Eugen Rochko
Fix #7994
2018-07-16Add admin dashboard (#8029)Eugen Rochko
2018-07-14Disable language detection for texts shorter than 140 characters (#8010)Eugen Rochko
If the input text is blank after preparation (only mention, or only URL, or empty as in a media post), then use nil as language, since it's OK to show to everyone. Otherwise, always fall back to the server's default locale
2018-07-14Do not count self in potential friendships (#8014)Eugen Rochko
2018-07-10Make whole-word filter regex consistent between Ruby and JS (#7987)Eugen Rochko
2018-07-09Add option to not consider word boundaries when processing keyword filtering ↵ThibG
(#7975) * Add option to not consider word boundaries when filtering phrases * Add a few tests for keyword/phrase filtering
2018-07-06In keyword filter, account for reblogs, HTML and whole-words (#7960)Eugen Rochko
* In keyword filter, account for reblogs, HTML and whole-words * Match whole words in JS filter, too * Fix typo
2018-07-05Check reblogged status for blocked/muted mentions (#7957)Eugen Rochko
2018-07-03Re-add follow recommendations API (#7918)Eugen Rochko
* Re-add follow recommendations API GET /api/v1/suggestions Removed in 8efa081f210d72ed450c39ac4cde0fd84fb3d3fb due to Neo4J dependency. The algorithm uses triadic closures, takes into account suspensions, blocks, mutes, domain blocks, excludes locked and moved accounts, and prefers more recently updated accounts. * Track interactions with people you don't follow Replying to, favouriting and reblogging someone you're not following will make them show up in follow recommendations. The interactions have different weights: - Replying is 1 - Favouriting is 10 (decidedly positive interaction, but private) - Reblogging is 20 Following them, muting or blocking will remove them from the list, obviously. * Remove triadic closures, ensure potential friendships are trimmed
2018-06-29Merge `HIDDEN_SERVICE_VIA_TRANSPARENT_PROXY` into ↵MIYAGI Hikaru
`ALLOW_ACCESS_TO_HIDDEN_SERVICE` (#7901) If Mastodon accesses to the hidden service via transparent proxy, it's needed to avoid checking whether it's a private address, since `.onion` is resolved to a private address. I was previously using the `HIDDEN_SERVICE_VIA_TRANSPARENT_PROXY` to provide that function. However, I realized that using `HIDDEN_SERVICE_VIA_TRANSPARENT_PROXY` is redundant, since this specification is always used with `ALLOW_ACCESS_TO_HIDDEN_SERVICE`. Therefore, I decided to integrate the setting of `HIDDEN_SERVICE_VIA_TRANSPARENT_PROXY` into` ALLOW_ACCESS_TO_HIDDEN_SERVICE`.
2018-06-29Keyword/phrase filtering (#7905)Eugen Rochko
* Add keyword filtering GET|POST /api/v1/filters GET|PUT|DELETE /api/v1/filters/:id - Irreversible filters can drop toots from home or notifications - Other filters can hide toots through the client app - Filters use a phrase valid in particular contexts, expiration * Make sure expired filters don't get applied client-side * Add missing API methods * Remove "regex filter" from column settings * Add tests * Add test for FeedManager * Add CustomFilter test * Add UI for managing filters * Add streaming API event to allow syncing filters * Fix tests
2018-06-17Allow selecting default posting language instead of auto-detect (#7828)Eugen Rochko
* Allow selecting default posting language instead of auto-detect * Enable default language setting in credentials API * Fix form saving
2018-06-08Do not accept ActivityPub follow requests from blocked user (#7756)Eugen Rochko
* Do not accept ActivityPub follow requests from blocked user Fix #7745 * Deliver auto-rejection immediately when follow-requested by blocked account * Fix trailing whitespace
2018-05-31Exclude unlisted, private and direct toots from affecting trends (#7686)Eugen Rochko
2018-05-29Fix N+1 on AtomSerializer (#7669)abcang
2018-05-28Record trending tags from ActivityPub, too (#7647)Eugen Rochko
2018-05-25Ignore multiple occurrences of a hashtag within a status (fixes #7585) (#7606)ThibG
2018-05-18Resolve unknown status from Add activity, skip Remove if unknown (#7526)Eugen Rochko
Fix #7518
2018-05-18Add preference to hide following/followers lists (#7532)Eugen Rochko
* Add preference to hide following/followers lists - Public pages - ActivityPub collections (does not return pages but does give total) - REST API (unless it's your own) (does not federate) Fix #6901 * Add preference * Add delegation * Fix issue * Fix issue
2018-05-18User agent for WebFinger (#7531)MIYAGI Hikaru
* User agent for WebFinger * local_domain → web_domain * 'http' is away accidentally...
generated by cgit-pink (git 2.37.1) at 2024-12-26 09:48:13 +0000