about summary refs log tree commit diff
path: root/app
AgeCommit message (Collapse)Author
2022-01-24Fix link_to_login argument handling when a block is passed (#17345)Claire
2022-01-23Fix error-prone SQL queries (#15828)Claire
* Fix error-prone SQL queries in Account search While this code seems to not present an actual vulnerability, one could easily be introduced by mistake due to how the query is built. This PR parameterises the `to_tsquery` input to make the query more robust. * Harden code for Status#tagged_with_all and Status#tagged_with_none Those two scopes aren't used in a way that could be vulnerable to an SQL injection, but keeping them unchanged might be a hazard. * Remove unneeded spaces surrounding tsquery term * Please CodeClimate * Move advanced_search_for SQL template to its own function This avoids one level of indentation while making clearer that the SQL template isn't build from all the dynamic parameters of advanced_search_for. * Add tests covering tagged_with, tagged_with_all and tagged_with_none * Rewrite tagged_with_none to avoid multiple joins and make it more robust * Remove obsolete brakeman warnings * Revert "Remove unneeded spaces surrounding tsquery term" The two queries are not strictly equivalent. This reverts commit 86f16c537e06c6ba4a8b250f25dcce9f049023ff.
2022-01-23Change `percent` to `rate` in retention metrics API (#16910)Claire
2022-01-23Add OMNIAUTH_ONLY environment variable to enforce externa log-in (#17288)Claire
* Remove support for OAUTH_REDIRECT_AT_SIGN_IN Fixes #15959 Introduced in #6540, OAUTH_REDIRECT_AT_SIGN_IN allowed skipping the log-in form to instead redirect to the external OmniAuth login provider. However, it did not prevent the log-in form on /about introduced by #10232 from appearing, and completely broke with the introduction of #15228. As I restoring that previous log-in flow without introducing a security vulnerability may require extensive care and knowledge of how OmniAuth works, this commit removes support for OAUTH_REDIRECT_AT_SIGN_IN instead for the time being. * Add OMNIAUTH_ONLY environment variable to enforce external log-in only * Disable user registration when OMNIAUTH_ONLY is set to true * Replace log-in links When OMNIAUTH_ONLY is set with exactly one OmniAuth provider
2022-01-23Remove support for OAUTH_REDIRECT_AT_SIGN_IN (#17287)Claire
Fixes #15959 Introduced in #6540, OAUTH_REDIRECT_AT_SIGN_IN allowed skipping the log-in form to instead redirect to the external OmniAuth login provider. However, it did not prevent the log-in form on /about introduced by #10232 from appearing, and completely broke with the introduction of #15228. As I restoring that previous log-in flow without introducing a security vulnerability may require extensive care and knowledge of how OmniAuth works, this commit removes support for OAUTH_REDIRECT_AT_SIGN_IN instead for the time being.
2022-01-23Remove leftover database columns from Devise::Models::Rememberable (#17191)Claire
* Remove leftover database columns from Devise::Models::Rememberable * Update fix-duplication maintenance script * Improve errors/warnings in the fix-duplicates maintenance script
2022-01-20Fix text being incorrectly pre-selected in composer textarea on /share (#17339)Claire
Fixes #17295
2022-01-20Add post edited notice in admin and public UIs (#17335)Claire
* Add edited toot flag on public pages * Add toot edit flag to admin pages
2022-01-19Fix error when using raw distribution worker (#17334)Eugen Rochko
Regression from #16697
2022-01-19Fix error when processing poll updates (#17333)Eugen Rochko
Regression from #16697
2022-01-19Add support for editing for published statuses (#16697)Eugen Rochko
* Add support for editing for published statuses * Fix references to stripped-out code * Various fixes and improvements * Further fixes and improvements * Fix updates being potentially sent to unauthorized recipients * Various fixes and improvements * Fix wrong words in test * Fix notifying accounts that were tagged but were not in the audience * Fix mistake
2022-01-19Fix NameError on ActivityPub::FetchFeaturedCollectionService (#17326)Jeong Arm
Related: #16954
2022-01-17Fix `pinned` attribute not being set for private self-posts (#17304)Claire
2022-01-17Add notifications for statuses deleted by moderators (#17204)Eugen Rochko
2022-01-17Add support for private pinned posts (#16954)Claire
* Add support for private pinned toots * Allow local user to pin private toots * Change wording to avoid "direct message"
2022-01-16Fix admin interface crash when displaying deleted user (#17301)Claire
2022-01-16Remove IP tracking columns from users table (#16409)Eugen Rochko
2022-01-10Gradually increase retry waiting for media processing (#17271)Jeong Arm
2021-12-30Remove custom emojis on domain purge (#17210)Jeong Arm
2021-12-28Fix media descriptions not being used for client-side filtering (#17206)Claire
Fix oversight in #13837
2021-12-27Fix warnings on Rails boot (#16946)Eugen Rochko
2021-12-26Fix tag rendering error in hashtag column settings (#17184)Rens Groothuijsen
* Flatten tags in configuration to regular array before converting to JSON * Render filter tags using toJS instead of toJSON
2021-12-21Fix duplicate record on admin/accounts when searching with IP (#17150)Jeong Arm
2021-12-17Add ability for admins to delete canonical email blocks (#16644)Claire
* Add admin option to remove canonical email blocks from a deleted account * Add tootctl canonical_email_blocks to inspect and remove canonical email blocks
2021-12-17Add ability to purge undeliverable domains from admin interface (#16686)Claire
* Add ability to purge undeliverable domains from admin interface * Add tests
2021-12-17Change title of retention chart (#16909)Claire
Changes from “Retention” to “User retention rate by month after sign-up”. This should make it much clearer to people not familiar with retention charts what it actually means.
2021-12-17Change list title input styling (#17092)Claire
2021-12-15ignore hashtag suggestions if they vary only in case (#16460)David Sterry
* ignore hashtag suggestions if they vary only in case * remove console.logs and unused args * consistently add space when dismissing suggestions * linting
2021-12-13Fix follow recommendation biased towards older accounts (#17126)Takeshi Umeda
2021-12-13Change trending hashtags threshold back from 15 to 5 (#17122)Eugen Rochko
2021-12-05Fix redirection when succeeded WebAuthn (#17098)heguro
2021-12-05Show correct error message if chosen password is too long (#17082)Rens Groothuijsen
* Add correct error message for exceeding max length on password confirmation field * Code style fixes
2021-12-05Add batch suspend for accounts in admin UI (#17009)Eugen Rochko
2021-11-29Fix error on trending mailer due to missing constant (#17072)Eugen Rochko
2021-11-28Fix server graph on admin/tags/:id (#17066)Jeong Arm
2021-11-26Fix admin statuses order(#16937) (#16969)Jeong Arm
* Fix #16937 * Add test for statuses order
2021-11-26Fix searching for additional hashtags in hashtag column (#17054)Claire
2021-11-26Fix color of hashtag column settings inputs (#17058)Claire
Fixes #17057
2021-11-26Fix opening wrong profile when clicking on username of boosting user in ↵Claire
WebUI (#17060) Fixes #16799
2021-11-26Remove Keybase integration (#17045)Eugen Rochko
2021-11-26Fix error on trending hashtags/links pages in admin UI due to missing ↵Eugen Rochko
constant (#17044)
2021-11-25Fix handling of recursive toots in WebUI (#17041)Claire
2021-11-25Fix filtering DMs from non-followed users (#17042)Claire
2021-11-25Add trending links (#16917)Eugen Rochko
* Add trending links * Add overriding specific links trendability * Add link type to preview cards and only trend articles Change trends review notifications from being sent every 5 minutes to being sent every 2 hours Change threshold from 5 unique accounts to 15 unique accounts * Fix tests
2021-11-24Fix error when suspending user with an already-existing canonical email ↵Claire
block (#17036) * Fix error when suspending user with an already-existing canonical email block Fixes #17033 While attempting to create a `CanonicalEmailBlock` with an existing hash would raise an `ActiveRecord::RecordNotUnique` error, this being done within a transaction would cancel the whole transaction. For this reason, checking for uniqueness in Rails would query the database within the transaction and avoid invalidating the whole transaction for this reason. A race condition is still possible, where multiple accounts sharing a canonical email would be blocked in concurrent transactions, in which only one would succeed, but that is way less likely to happen that the current issue, and can always be retried after the first failure, unlike the current situation. * Add tests
2021-11-19Fix overflow of long profile fields in admin view (#17010)Claire
2021-11-19Fix background-color of emoji-mart selector (#17011)Claire
Reverts part of #16907 to fix hardcoded color
2021-11-18Bump chewy from 5.2.0 to 7.2.3 (supports Elasticsearch 7.x) (#16915)Takeshi Umeda
* Bump chewy from 5.2.0 to 7.2.2 * fix style (codeclimate) * fix style * fix style * Bump chewy from 7.2.2 to 7.2.3
2021-11-18Add lazy load to emoji-mart (#16907)Mashiro
* perf: lazyload emoji-mart! * Bump lazyload
2021-11-14Fix confusing error when webfinger request returns empty document (#16986)Claire
For some reason, some misconfigured servers return an empty document when queried over webfinger. Since an empty document does not lead to a parse error, the error is not caught properly and triggers uncaught exceptions later on. This PR fixes that by immediately erroring out with `Webfinger::Error` on getting an empty response.
generated by cgit-pink (git 2.37.1) at 2024-07-08 23:35:08 +0000