about summary refs log tree commit diff
path: root/config/initializers
AgeCommit message (Collapse)Author
2019-07-30Add whitelist mode (#11291)Eugen Rochko
2019-07-04Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
2019-07-02Remove unused StatsD code and expose StatsD as a global variable (#11232)Eugen Rochko
The instrumentation code was used for StatsD metrics collection prior to the switch to the nsa gem and should have been removed at that point as it no longer does anything at all
2019-06-24Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts: - app/models/media_attachment.rb Upstream added audio attachment support - app/serializers/initial_state_serializer.rb Upstream added audio attachment support and how mimetypes are returned - app/serializers/rest/instance_serializer.rb Upstream added a few fields - config/application.rb Upstream added a different paperclip transcoder
2019-06-20Add moderation API (#9387)Eugen Rochko
Fix #8580 Fix #7143
2019-06-10Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts: - app/controllers/settings/notifications_controller.rb - app/javascript/packs/public.js - app/views/settings/preferences/show.html.haml - app/views/stream_entries/_simple_status.html.haml - config/locales/simple_form.en.yml - config/locales/simple_form.pl.yml - config/navigation.rb - config/routes.rb
2019-06-07Change preferences page into appearance, notifications, and other (#10977)Eugen Rochko
2019-05-28Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
2019-05-28Fix undefined method error (#10868)Hinaloe
2019-05-28Fix undefined method error. (#10867)mayaeh
2019-05-27Improve rate limiting (#10860)ThibG
* Rate limit based on remote address IP, not on potential reverse proxy * Limit rate of unauthenticated API requests further * Rate-limit paging requests to one every 3 seconds
2019-05-04Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts: - app/models/media_attachment.rb
2019-05-04Fix CSP when PAPERCLIP_ROOT_URL is set to a different hostThibaut Girka
2019-05-04Fix CSP when dealing with S3 hostsThibaut Girka
2019-05-03Bump rack-attack from 5.4.2 to 6.0.0 (#10599)dependabot[bot]
* Bump rack-attack from 5.4.2 to 6.0.0 Bumps [rack-attack](https://github.com/kickstarter/rack-attack) from 5.4.2 to 6.0.0. - [Release notes](https://github.com/kickstarter/rack-attack/releases) - [Changelog](https://github.com/kickstarter/rack-attack/blob/master/CHANGELOG.md) - [Commits](https://github.com/kickstarter/rack-attack/compare/v5.4.2...v6.0.0) Signed-off-by: dependabot[bot] <support@dependabot.com> * fix payload[:request]
2019-04-24Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
2019-04-23Fix stoplight logging to stderr separate from Rails logger (#10624)Eugen Rochko
2019-04-08Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts: - config/locales/pl.yml Conflict caused by new upstream string too close to glitch-specific “flavour” string. Took both strings.
2019-04-07Add rate limit for media proxy requests (#10490)Eugen Rochko
30 per 30 minutes, like media uploads
2019-03-28Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts: - app/workers/activitypub/distribute_poll_update_worker.rb - config/locales/pl.yml
2019-03-27Remove unused ActivityPub `@context` values depending on response (#10378)Eugen Rochko
Fix #8078
2019-03-22Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
2019-03-21cas_options :validate_url should be :service_validate_url (#10328)Eric
Otherwise, no matter what is given for CAS_VALIDATE_URL the default /serviceValidate path would be used.
2019-02-15Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
2019-02-14Add tight rate-limit for API deletions (#10042)Eugen Rochko
Deletions take a lot of resources to execute and cause a lot of federation traffic, so it makes sense to decrease the number someone can queue up through the API. 30 per 30 minutes
2019-02-10Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts: - app/controllers/oauth/authorized_applications_controller.rb Two changes too close to each other - app/controllers/settings/sessions_controller.rb - app/lib/user_settings_decorator.rb Two changes too close to each other - app/models/media_attachment.rb New changes too close to glitch-soc only changes. - app/models/user.rb Two changes too close to each other. - app/services/remove_status_service.rb Kept direct timeline code which had been removed upstream. - app/views/settings/preferences/show.html.haml Two changes too close to each other. - config/locales/en.yml Introduction of a new string too close to glitch-soc-only's “flavour” - config/locales/ja.yml Introduction of a new string too close to glitch-soc-only's “flavour” - config/locales/pl.yml Introduction of a new string too close to glitch-soc-only's “flavour” - config/locales/simple_form.en.yml Introduction of a new string too close to glitch-soc-only's “skin” - config/locales/simple_form.pl.yml Introduction of a new string too close to glitch-soc-only's “skin” - config/settings.yml Reverted upstream's decision of enabling posting application by default.
2019-02-09Fix URL linkifier grabbing full-width spaces and quotations (#9997)Eugen Rochko
Fix #9993 Fix #5654
2019-01-19Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
No conflicts.
2019-01-18Add timeouts for S3 (#9842)Eugen Rochko
2019-01-16Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts: - config/locales/simple_form.pl.yml
2019-01-15Disable Same-Site cookie implementation to fix SSO issues on WebKit browsers ↵Moritz Heiber
(#9819)
2019-01-10Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts: - .eslintrc.yml Removed, as upstream removed it. - app/controllers/admin/statuses_controller.rb Minor code cleanup when porting one of our features. - app/models/account.rb Note length validation has changed upstream. We now use upstream's validation (dropped legacy glitch-soc account metadata stuff) but with configurable limit. - app/services/post_status_service.rb Upstream has added support for scheduled toots, refactoring the code a bit. Adapted our changes to this refactoring. - app/views/stream_entries/_detailed_status.html.haml Not a real conflict, changes too close. - app/views/stream_entries/_simple_status.html.haml Not a real conflict, changes too close.
2019-01-05Enable immutable caching for S3 objects (#9722)Nolan Lawson
I also added "public" here, as I can't think of a good reason not to add it. Perhaps it has some marginal benefit in that ISPs (or other proxies) can cache it for all users. The assets are certainly publicly available and the same for all users.
2019-01-02Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts manually resolved: - app/services/post_status_service.rb - config/locales/simple_form.pl.yml - config/routes.rb - config/webpack/loaders/sass.js - config/webpack/shared.js - package.json - yarn.lock
2018-12-24Add REST API for creating an account (#9572)Eugen Rochko
* Add REST API for creating an account The method is available to apps with a token obtained via the client credentials grant. It creates a user and account records, as well as an access token for the app that initiated the request. The user is unconfirmed, and an e-mail is sent as usual. The method returns the access token, which the app should save for later. The REST API is not available to users with unconfirmed accounts, so the app must be smart to wait for the user to click a link in their e-mail inbox. The method is rate-limited by IP to 5 requests per 30 minutes. * Redirect users back to app from confirmation if they were created with an app * Add tests * Return 403 on the method if registrations are not open * Require agreement param to be true in the API when creating an account
2018-12-23Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts: - config/routes.rb Upstream changed some admin routes, conflict was because of an added :show action for statuses on our side. Kept it.
2018-12-21Skip mailer job retries when a record no longer exists (#9590)Eugen Rochko
Fix #8666
2018-12-15Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts: - app/controllers/directories_controller.rb - app/controllers/settings/applications_controller.rb - app/controllers/settings/base_controller.rb - app/controllers/settings/deletes_controller.rb - app/controllers/settings/exports_controller.rb - app/controllers/settings/follower_domains_controller.rb - app/controllers/settings/imports_controller.rb - app/controllers/settings/migrations_controller.rb - app/controllers/settings/notifications_controller.rb - app/controllers/settings/preferences_controller.rb - app/controllers/settings/sessions_controller.rb - app/controllers/settings/two_factor_authentication/confirmations_controller.rb - app/controllers/settings/two_factor_authentication/recovery_codes_controller.rb - app/controllers/settings/two_factor_authentications_controller.rb Conflicts were due to some refactoring already made in glitch-soc when introducing flavours.
2018-12-14Remove form_action from CSPRey Tucker
This trips an issue when trying to authenticate through to third-party sites, e.g. bridge.joinmastodon.org: Refused to send form data to 'https://bridge.joinmastodon.org/' because it violates the following Content Security Policy directive: "form-action 'self'". Thread: https://vulpine.club/@digifox/101230933751352042
2018-12-10Use same CORS policy for /@:username and /users/:username (#9485)ThibG
Fixes #8189 rack-cors being called before the application router, it does not follow the redirection, and we need a separate rule for /users/:username.
2018-12-02Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
2018-12-02Preload common JSON-LD contexts (#9412)ThibG
Fixes #9411
2018-11-12Tighten CSP a bitThibaut Girka
2018-10-26Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts: - app/controllers/admin/base_controller.rb - app/controllers/filters_controller.rb - app/controllers/invites_controller.rb - app/controllers/settings/deletes_controller.rb - app/controllers/settings/exports_controller.rb - app/controllers/settings/follower_domains_controller.rb - app/controllers/settings/migrations_controller.rb - app/controllers/settings/notifications_controller.rb - app/controllers/settings/preferences_controller.rb - app/controllers/settings/two_factor_authentication/recovery_codes_controller.rb - app/javascript/packs/public.js - app/views/settings/profiles/show.html.haml Conflicts were mostly due to the addition of body classes to the settings page, this was caused by rejecting upstream changes for most of those files and modifying Settings::BaseController instead. Another cause of conflicts was the deletion of client-side checking of display name / bio length, this was modified in app/javascript/core/settings.js instead.
2018-10-25Allow cross-origin requests to /.well-known/* URLs. (#9083)Ben Lubar
Right now, this includes three endpoints: host-meta, webfinger, and change-password. host-meta and webfinger are publicly available and do not use any authentication. Nothing bad can be done by accessing them in a user's browser. change-password being CORS-enabled will only reveal the URL it redirects to (which is /auth/edit) but not anything about the actual /auth/edit page, because it does not have CORS enabled. The documentation for hosting an instance on a different domain should also be updated to point out that Access-Control-Allow-Origin: * should be set at a minimum for the /.well-known/host-meta redirect to allow browser-based non-proxied instance discovery.
2018-10-22Merge branch 'master' into glitch-soc/merge-upstreamThibaut Girka
Conflicts: - .github/ISSUE_TEMPLATE/bug_report.md Took our version. - CONTRIBUTING.md Updated the embedded copy of upstream's version. - README.md Took our version. - app/policies/status_policy.rb Not a real conflict, took code from both. - app/views/layouts/embedded.html.haml Added upstream's changes (dns-prefetch) and fixed `%body.embed` - app/views/settings/preferences/show.html.haml Reverted some of upstream changes, as we have a page dedicated for flavours and skins. - config/initializers/content_security_policy.rb Kept our version of the CSP. - config/initializers/doorkeeper.rb Not a real conflict, took code from both.
2018-10-19Add unread indicator to conversations (#9009)Eugen Rochko
2018-10-12Add manifest_src to CSP, add blob to connect_src (#8967)ThibG
2018-10-12Fix CSP headers blocking media and development environment (#8962)Eugen Rochko
Regression from #8957
2018-10-11Set Content-Security-Policy rules through RoR's config (#8957)ThibG
* Set CSP rules in RoR's configuration * Override CSP setting in the embed controller to allow frames
generated by cgit-pink (git 2.37.1) at 2024-10-30 17:02:47 +0000