about summary refs log tree commit diff
path: root/config/initializers
AgeCommit message (Collapse)Author
2018-12-10Use same CORS policy for /@:username and /users/:username (#9485)ThibG
Fixes #8189 rack-cors being called before the application router, it does not follow the redirection, and we need a separate rule for /users/:username.
2018-12-02Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
2018-12-02Preload common JSON-LD contexts (#9412)ThibG
Fixes #9411
2018-11-12Tighten CSP a bitThibaut Girka
2018-10-26Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts: - app/controllers/admin/base_controller.rb - app/controllers/filters_controller.rb - app/controllers/invites_controller.rb - app/controllers/settings/deletes_controller.rb - app/controllers/settings/exports_controller.rb - app/controllers/settings/follower_domains_controller.rb - app/controllers/settings/migrations_controller.rb - app/controllers/settings/notifications_controller.rb - app/controllers/settings/preferences_controller.rb - app/controllers/settings/two_factor_authentication/recovery_codes_controller.rb - app/javascript/packs/public.js - app/views/settings/profiles/show.html.haml Conflicts were mostly due to the addition of body classes to the settings page, this was caused by rejecting upstream changes for most of those files and modifying Settings::BaseController instead. Another cause of conflicts was the deletion of client-side checking of display name / bio length, this was modified in app/javascript/core/settings.js instead.
2018-10-25Allow cross-origin requests to /.well-known/* URLs. (#9083)Ben Lubar
Right now, this includes three endpoints: host-meta, webfinger, and change-password. host-meta and webfinger are publicly available and do not use any authentication. Nothing bad can be done by accessing them in a user's browser. change-password being CORS-enabled will only reveal the URL it redirects to (which is /auth/edit) but not anything about the actual /auth/edit page, because it does not have CORS enabled. The documentation for hosting an instance on a different domain should also be updated to point out that Access-Control-Allow-Origin: * should be set at a minimum for the /.well-known/host-meta redirect to allow browser-based non-proxied instance discovery.
2018-10-22Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts: - .github/ISSUE_TEMPLATE/bug_report.md Took our version. - CONTRIBUTING.md Updated the embedded copy of upstream's version. - README.md Took our version. - app/policies/status_policy.rb Not a real conflict, took code from both. - app/views/layouts/embedded.html.haml Added upstream's changes (dns-prefetch) and fixed `%body.embed` - app/views/settings/preferences/show.html.haml Reverted some of upstream changes, as we have a page dedicated for flavours and skins. - config/initializers/content_security_policy.rb Kept our version of the CSP. - config/initializers/doorkeeper.rb Not a real conflict, took code from both.
2018-10-19Add unread indicator to conversations (#9009)Eugen Rochko
2018-10-12Add manifest_src to CSP, add blob to connect_src (#8967)ThibG
2018-10-12Fix CSP headers blocking media and development environment (#8962)Eugen Rochko
Regression from #8957
2018-10-11Set Content-Security-Policy rules through RoR's config (#8957)ThibG
* Set CSP rules in RoR's configuration * Override CSP setting in the embed controller to allow frames
2018-10-09Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
2018-10-09add ffmpeg initializer (#8855)Sascha
* add ffmpeg initializer * use different expression to check for environment var
2018-10-08Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
2018-10-08rubocop issues - Cleaning up (#8912)ashleyhull-versent
* cleanup pass * undo mistakes * fixed. * revert
2018-10-05Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts: db/migrate/20170716191202_add_hide_notifications_to_mute.rb spec/controllers/application_controller_spec.rb Took our version, upstream changes were only minor style linting.
2018-10-04lint pass 2 (#8878)aus-social
* Code quality pass * Typofix * Update applications_controller_spec.rb * Update applications_controller_spec.rb
2018-10-04Lint pass (#8876)aus-social
2018-10-01Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts: app/lib/user_settings_decorator.rb app/models/user.rb app/serializers/initial_state_serializer.rb app/views/stream_entries/_simple_status.html.haml config/locales/simple_form.en.yml config/locales/simple_form.ja.yml config/locales/simple_form.pl.yml config/routes.rb
2018-09-30Fix that Rails.cache information could not be sent via StatsD (#8831)Yamagishi Kazutoshi
2018-09-19Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts: Vagrantfile app/javascript/packs/public.js app/views/admin/settings/edit.html.haml app/views/settings/preferences/show.html.haml app/views/settings/profiles/show.html.haml config/locales/es.yml config/locales/simple_form.en.yml config/webpack/configuration.js config/webpack/loaders/babel.js package.json yarn.lock Split new additions to app/javascript/packs/public.js to app/javascript/core/settings.js
2018-09-18Redesign forms, verify link ownership with rel="me" (#8703)Eugen Rochko
* Verify link ownership with rel="me" * Add explanation about verification to UI * Perform link verifications * Add click-to-copy widget for verification HTML * Redesign edit profile page * Redesign forms * Improve responsive design of settings pages * Restore landing page sign-up form * Fix typo * Support <link> tags, add spec * Fix links not being verified on first discovery and passive updates
2018-09-14Misc. typos (#8694)luzpaz
Found via `codespell -q 3 --skip="./app/javascript/mastodon/locales,./config/locales"`
2018-09-11Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts: app/controllers/oauth/authorizations_controller.rb Just two changes being too close to one another. Took both.
2018-09-08feat(cookies): Use the same-site attribute to lax (#8626)Sorin Davidoi
CSFR-prevention is already implemented but adding this doesn't hurt. A brief introduction to Same-Site cookies (and the difference between strict and lax) can be found at https://blog.mozilla.org/security/2018/04/24/same-site-cookies-in-firefox-60/ TLDR: We use lax since we want the cookies to be sent when the user navigates safely from an external site.
2018-09-03Add manifest_src to CSPRey Tucker
Fixes manifest.json not being loaded because of CSP violation h/t https://vulpine.club/@binary/100662852252438648
2018-08-28Fix CSP with S3/SWIFT hostsThibaut Girka
2018-08-28Adjust CSP to fix image resizingThibaut Girka
2018-08-26Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts: app/views/layouts/application.html.haml Edited: app/helpers/application_helper.rb app/views/admin/domain_blocks/new.html.haml Conflict wasn't really one, just two changes too close to one another. Edition was to adapt the class names for themes to class names for skins and flavours. Also edited app/views/admin/domain_blocks/new.html.haml to strip the duplicate admin pack inclusion thing.
2018-08-25Rename S3_CLOUDFRONT_HOST to S3_ALIAS_HOST. (#8423)M Somerville
Still check for S3_CLOUDFRONT_HOST for existing installs.
2018-08-23Only apply CSP in production modeThibaut Girka
2018-08-23Tighten CSP while allowing CDN hostsThibaut Girka
2018-08-22Move CSP headers to the appropriate Rails configurationThibaut Girka
Also drop dev-static.glitch.social reference.
2018-08-21Merge branch 'master' into glitch-soc/masterThibaut Girka
Conflicts: config/routes.rb Added the “endorsements” route from upstream.
2018-08-21Revert to using Paperclip's filesystem storage, and fix dangling records in ↵ThibG
remove_remote (#8339) * Fix uncaching worker * Revert to using Paperclip's filesystem backend instead of fog-local fog-local has lots of concurrency issues, causing failure to delete files, dangling file records, and spurious errors UncacheMediaWorker
2018-08-17Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts: app/models/status.rb db/migrate/20180528141303_fix_accounts_unique_index.rb db/schema.rb Resolved by taking upstream changes (no real conflicts, just glitch-soc specific code too close to actual changes).
2018-08-15Add ldap search filter (#8151)Immae
2018-08-13Add post-deployment migration system (#8182)Eugen Rochko
Adopted from GitLab CE. Generate new migration with: rails g post_deployment_migration name_of_migration_here By default they are run together with db:migrate. To not run them, the env variable SKIP_POST_DEPLOYMENT_MIGRATIONS must be set Code by Yorick Peterse <yorickpeterse@gmail.com>, see also: https://gitlab.com/gitlab-org/gitlab-ce/commit/83c8241160ed48ab066e2c5bd58d0914a745197c
2018-08-13Add post-deployment migration system (#8182)Eugen Rochko
Adopted from GitLab CE. Generate new migration with: rails g post_deployment_migration name_of_migration_here By default they are run together with db:migrate. To not run them, the env variable SKIP_POST_DEPLOYMENT_MIGRATIONS must be set Code by Yorick Peterse <yorickpeterse@gmail.com>, see also: https://gitlab.com/gitlab-org/gitlab-ce/commit/83c8241160ed48ab066e2c5bd58d0914a745197c
2018-08-10Introduce OAuth scopes for bookmarksThibaut Girka
2018-07-26Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
2018-07-25Add secure option to additional cookie (#8069)abcang
2018-07-09Merge branch 'master' into glitch-soc/tentative-mergeThibaut Girka
Conflicts: README.md app/controllers/statuses_controller.rb app/lib/feed_manager.rb config/navigation.rb spec/lib/feed_manager_spec.rb Conflicts were resolved by taking both versions for each change. This means the two filter systems (glitch-soc's keyword mutes and tootsuite's custom filters) are in place, which will be changed in a follow-up commit.
2018-07-05Add more granular OAuth scopes (#7929)Eugen Rochko
* Add more granular OAuth scopes * Add human-readable descriptions of the new scopes * Ensure new scopes look good on the app UI * Add tests * Group scopes in screen and color-code dangerous ones * Fix wrong extra scope
2018-06-29Merge `HIDDEN_SERVICE_VIA_TRANSPARENT_PROXY` into ↵MIYAGI Hikaru
`ALLOW_ACCESS_TO_HIDDEN_SERVICE` (#7901) If Mastodon accesses to the hidden service via transparent proxy, it's needed to avoid checking whether it's a private address, since `.onion` is resolved to a private address. I was previously using the `HIDDEN_SERVICE_VIA_TRANSPARENT_PROXY` to provide that function. However, I realized that using `HIDDEN_SERVICE_VIA_TRANSPARENT_PROXY` is redundant, since this specification is always used with `ALLOW_ACCESS_TO_HIDDEN_SERVICE`. Therefore, I decided to integrate the setting of `HIDDEN_SERVICE_VIA_TRANSPARENT_PROXY` into` ALLOW_ACCESS_TO_HIDDEN_SERVICE`.
2018-06-15Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts: app/javascript/mastodon/initial_state.js db/schema.rb Upstream added a new field to initial_state. Not too sure about what happened with db/schema.rb though…
2018-06-15Add dat, dweb, ipfs, ipns, ssb, gopher protocols to URL extractor (#7810)Eugen Rochko
* Add dat:// and gopher:// to URL extractor Fix #6072 * Fix comment indent * Add dweb, ipfs, ipns, ssb
2018-06-15Remove rack-timeout (#7809)Eugen Rochko
Timeout considered harmful due to leaving the app in a broken state, including unreaped database connections
2018-05-27Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts: config/locales/ca.yml config/locales/nl.yml config/locales/oc.yml config/locales/pt-BR.yml Resolved conflicts by removing upstream-specific changes
2018-05-26Disable AMS logging (#7623)Eugen Rochko
Especially in production it's just noise and doesn't mix well with the log format
generated by cgit-pink (git 2.37.1) at 2024-12-01 10:44:58 +0000