From b4b8eaf61cfb0bd6df8fe1cf0d00e55be13dd1f5 Mon Sep 17 00:00:00 2001
From: multiple creatures <dev@multiple-creature.party>
Date: Wed, 15 Jan 2020 14:24:55 -0600
Subject: anti-harassment: add option to toggle whether to allow
 follows/packmate requests from accounts you've never interacted with before;
 default to off

---
 app/controllers/settings/preferences_controller.rb |  1 +
 app/lib/activitypub/activity/follow.rb             | 11 +++++++++++
 app/models/user.rb                                 |  1 +
 app/views/settings/preferences/show.html.haml      |  5 +++++
 4 files changed, 18 insertions(+)

(limited to 'app')

diff --git a/app/controllers/settings/preferences_controller.rb b/app/controllers/settings/preferences_controller.rb
index feebabbc8..c91f40d26 100644
--- a/app/controllers/settings/preferences_controller.rb
+++ b/app/controllers/settings/preferences_controller.rb
@@ -54,6 +54,7 @@ class Settings::PreferencesController < Settings::BaseController
       :invert_filters,
       :filter_timelines_only,
       :monsterpit_api,
+      :allow_unknown_follows,
       chosen_languages: []
     )
   end
diff --git a/app/lib/activitypub/activity/follow.rb b/app/lib/activitypub/activity/follow.rb
index 66df92601..1c19c7006 100644
--- a/app/lib/activitypub/activity/follow.rb
+++ b/app/lib/activitypub/activity/follow.rb
@@ -14,6 +14,11 @@ class ActivityPub::Activity::Follow < ActivityPub::Activity
       return
     end
 
+    if !target_account.user.allow_unknown_follows? && !(target_account.following?(@account) || ever_mentioned_by?(target_account))
+      reject_follow_request!(target_account)
+      return
+    end
+
     # Fast-forward repeat follow requests
     if @account.following?(target_account)
       AuthorizeFollowService.new.call(@account, target_account, skip_follow_request: true, follow_request_uri: @json['id'])
@@ -33,5 +38,11 @@ class ActivityPub::Activity::Follow < ActivityPub::Activity
   def reject_follow_request!(target_account)
     json = Oj.dump(serialize_payload(FollowRequest.new(account: @account, target_account: target_account, uri: @json['id']), ActivityPub::RejectFollowSerializer))
     ActivityPub::DeliveryWorker.perform_async(json, target_account.id, @account.inbox_url)
+  endA
+
+  private
+
+  def ever_mentioned_by?(target_account)
+    Status.joins(:mentions).merge(target_account.mentions).where(account_id: @account.id).exists?
   end
 end
diff --git a/app/models/user.rb b/app/models/user.rb
index b28e3229f..96b6f1f58 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -47,6 +47,7 @@
 #  filter_undescribed        :boolean          default(FALSE), not null
 #  filters_enabled           :boolean          default(FALSE), not null
 #  monsterfork_api           :integer          default("full"), not null
+#  allow_unknown_follows     :boolean          default(FALSE), not null
 #
 
 class User < ApplicationRecord
diff --git a/app/views/settings/preferences/show.html.haml b/app/views/settings/preferences/show.html.haml
index d65fc46e7..97ac59975 100644
--- a/app/views/settings/preferences/show.html.haml
+++ b/app/views/settings/preferences/show.html.haml
@@ -69,6 +69,11 @@
 
   %hr/
 
+  .fields-group
+    = f.input :allow_unknown_follows, as: :boolean, wrapper: :with_label
+
+  %hr/
+
   .fields-group
     = f.input :only_known, as: :boolean, wrapper: :with_label
     = f.input :hide_boosts, as: :boolean, wrapper: :with_label
-- 
cgit