70 Commits (features/quote-post-authoring-backend)

Author	SHA1	Message	Date
Matt Jankowski	1ae3510ede	Add coverage for TOS interstitial interruption flow of web app controller concern (#35235)	3 weeks ago
Matt Jankowski	ab7f50ce4e	Reduce hard coding of `LOCAL_DOMAIN` env value throughout tests (#35025)	1 month ago
David Roetzel	319fbbbfac	Experimental Async Refreshes API (#34918)	1 month ago
Matt Jankowski	6463415e06	Update `rubocop-rspec` to version 3.6.0 (#34497)	3 months ago
Matt Jankowski	fb0856458b	Verify page content in `ChallengableConcern` spec (#33895)	5 months ago
Matt Jankowski	23a0d91126	Combine examples to reduce factories in specs (#33841)	6 months ago
Matt Jankowski	c68eb82ffa	Use explicit config loading from `bin/rubocop` (#33256)	7 months ago
Matt Jankowski	7efe0bde9d	Add `have_http_link_header` matcher and set header values as strings (#31010)	11 months ago
Matt Jankowski	f1003b2560	Enable "zero monkey patching" mode in RSpec (#31614)	11 months ago
Matt Jankowski	5b595b8a5a	Remove usage of `assigns` in controller specs (#30195)	11 months ago
Matt Jankowski	f1300ad284	Rename jobs/attachments rspec tag names (#29762)	1 year ago
Matt Jankowski	65e82211cd	Rename `cache_*` methods to `preload_*` in controller concern (#30209)	1 year ago
Matt Jankowski	f9100743ec	Add `Api::ErrorHandling` concern for api/base controller (#29574)	1 year ago
Matt Jankowski	f91acba70a	Combine repeated requests in account controller concern spec (#28957)	2 years ago
Matt Jankowski	00341c70ff	Use Sidekiq `fake!` instead of `inline!` in specs (#25369)	2 years ago
Claire	a2624ff739	Convert signature verification specs to request specs (#28443)	2 years ago
Claire	6fed0fcbaa	Remove unneeded settings cleanup from specs (#28425)	2 years ago
Matt Jankowski	1f1c75bba5	File cleanup/organization in `controllers/concerns` (#27846)	2 years ago
Matt Jankowski	291dc04e67	Remove un-needed `action` and `template` options to `render` in controllers (#28022)	2 years ago
Matt Jankowski	69d00e2721	Fix `RSpec/InstanceVariable` cop (#27766)	2 years ago
Matt Jankowski	bcd0171e5e	Fix `Lint/UselessAssignment` cop (#27472)	2 years ago
Claire	94893cf24f	Merge pull request from GHSA-hcqf-fw2r-52g4 ... * Revert "Fix request URL normalisation for bare domain and 8-bit characters (#26285)" This reverts commit 8891d8945d. * Revert "Do not normalize URL before fetching it (#26219)" This reverts commit fd284311e7.	2 years ago
Claire	60b9fa641d	Fix cached posts including stale stats (#26409)	2 years ago
Christian Schmidt	fd284311e7	Do not normalize URL before fetching it (#26219)	2 years ago
Matt Jankowski	f48d345de1	Use correct naming on controller concern specs (#26197)	2 years ago
Matt Jankowski	d2e5430d4a	Fix RSpec/ExpectChange cop (#25101)	2 years ago
Nick Schonning	99e2e9b81f	Fix minor typos in comments and spec names (#21831)	2 years ago
Nick Schonning	da3bd913ae	Autofix Rubocop Style/HashSyntax (#23754)	2 years ago
Matt Jankowski	c97b611b6b	Fix RSpec/InferredSpecType cop (#24736)	2 years ago
Matt Jankowski	710745e16b	Fix RSpec/ContextWording cop (#24739)	2 years ago
Matt Jankowski	3df665fd23	Fix Lint/ConstantDefinitionInBlock cop (#24763)	2 years ago
Nick Schonning	aef0051fd0	Enable Rubocop HTTP status rules (#23717)	2 years ago
Claire	68dcbcb7bf	Add more specific error messages to HTTP signature verification (#21617) ... * Return specific error on failure to parse Date header * Add error message when preferredUsername is not set * Change error report to be JSON and include more details * Change error report to differentiate unknown account and failed refresh * Add tests	3 years ago
Claire	8cf7006d4e	Refactor ActivityPub handling to prepare for non-Account actors (#19212) ... * Move ActivityPub::FetchRemoteAccountService to ActivityPub::FetchRemoteActorService ActivityPub::FetchRemoteAccountService is kept as a wrapper for when the actor is specifically required to be an Account * Refactor SignatureVerification to allow non-Account actors * fixup! Move ActivityPub::FetchRemoteAccountService to ActivityPub::FetchRemoteActorService * Refactor ActivityPub::FetchRemoteKeyService to potentially return non-Account actors * Refactor inbound ActivityPub payload processing to accept non-Account actors * Refactor inbound ActivityPub processing to accept activities relayed through non-Account * Refactor how Account key URIs are built * Refactor Request and drop unused key_id_format parameter * Rename ActivityPub::Dereferencer `signature_account` to `signature_actor`	3 years ago
Eugen Rochko	3917353645	Fix single Redis connection being used across all threads (#18135) ... * Fix single Redis connection being used across all Sidekiq threads * Fix tests	3 years ago
Claire	f5639e1cbe	Change public profile pages to be disabled for unconfirmed users (#17385) ... Fixes #17382 Note that unconfirmed and unapproved accounts can still be searched for and their (empty) account retrieved using the REST API.	4 years ago
Claire	e38fc319dc	Refactor and improve tests (#17386) ... * Change account and user fabricators to simplify and improve tests - `Fabricate(:account)` implicitly fabricates an associated `user` if no `domain` attribute is given (an account with `domain: nil` is considered a local account, but no user record was created), unless `user: nil` is passed - `Fabricate(:account, user: Fabricate(:user))` should still be possible but is discouraged. * Fix and refactor tests - avoid passing unneeded attributes to `Fabricate(:user)` or `Fabricate(:account)` - avoid embedding `Fabricate(:user)` into a `Fabricate(:account)` or the other way around - prefer `Fabricate(:user, account_attributes: …)` to `Fabricate(:user, account: Fabricate(:account, …)` - also, some tests were using remote accounts with local user records, which is not representative of production code.	4 years ago
Claire	5027abecd1	Fix cache_collection crashing when given an empty collection (#15921) ... * Fix cache_collection crashing when given an empty collection * Add tests	4 years ago
Claire	43eff898a0	Prepare Mastodon for Rails 6 (#15911) ... * Fix misuse of foreign_type * Fix use of removed "add_template_helper" * Use response.media_type instead of response.content_type in tests * Fix CSV export controller test on Rails 6 Rails 6 sets a "filename*" field in the Content-Disposition header to explicitly encode the filename as UTF-8. This changes checks the first part of the Content-Disposition header so it matches in both Rails 5 and Rails 6. * Fix emoji formatting with Rails 6 * Make emoji output more idiomatic and robust * Switch from redis-rails gem to built-in Rails redis cache storage	4 years ago
Eugen Rochko	ed099d8bdc	Change account suspensions to be reversible by default (#14726)	5 years ago
ThibG	4bcef12bad	Fix sr locale being selected over sr-Latn (#13693) ... * Fix sr locale being selected over sr-Latn * Update tests	5 years ago
Eugen Rochko	5265df0a8a	Change signature verification to ignore signatures with invalid host (#13033) ... Instead of returning a signature verification error, pretend there was no signature (i.e., this does not allow access to resources that need a valid signature), so public resources can still be fetched Fix #13011	6 years ago
Eugen Rochko	49b2f7c0a2	Fix base64-encoded file uploads not being possible (#12748) ... Fix #3804, Fix #5776	6 years ago
Eugen Rochko	e1066cd431	Add password challenge to 2FA settings, e-mail notifications (#11878) ... Fix #3961	6 years ago
Eugen Rochko	bd1545de5e	Change locale detection to run once per session (#8657) ... Fix #6462	6 years ago
Eugen Rochko	4e8dcc5dbb	Add HTTP signatures to all outgoing ActivityPub GET requests (#11284)	6 years ago
Eugen Rochko	63c7fe8e48	Refactor controllers for statuses, accounts, and more (#11249)	6 years ago
Eugen Rochko	51e154f5e8	Admission-based registrations mode (#10250) ... Fix #6856 Fix #6951	6 years ago
ysksn	dd85700a3e	Add spec for AccountableConcern#log_action (#9559)	7 years ago
Eugen Rochko	21ad21cb50	Improve signature verification safeguards (#8959) ... * Downcase signed_headers string before building the signed string The HTTP Signatures draft does not mandate the “headers” field to be downcased, but mandates the header field names to be downcased in the signed string, which means that prior to this patch, Mastodon could fail to process signatures from some compliant clients. It also means that it would not actually check the Digest of non-compliant clients that wouldn't use a lowercased Digest field name. Thankfully, I don't know of any such client. * Revert "Remove dead code (#8919)" This reverts commit a00ce8c92c. * Restore time window checking, change it to 12 hours By checking the Date header, we can prevent replaying old vulnerable signatures. The focus is to prevent replaying old vulnerable requests from software that has been fixed in the meantime, so a somewhat long window should be fine and accounts for timezone misconfiguration. * Escape users' URLs when formatting them Fixes possible HTML injection * Escape all string interpolations in Formatter class Slightly improve performance by reducing class allocations from repeated Formatter#encode calls * Fix code style issues	7 years ago