mastodon

Commit Graph

Author	SHA1	Message	Date
santiagorodriguez96	e8d41bc2fe	Add WebAuthn as an alternative 2FA method (#14466 ) * feat: add possibility of adding WebAuthn security keys to use as 2FA This adds a basic UI for enabling WebAuthn 2FA. We did a little refactor to the Settings page for editing the 2FA methods – now it will list the methods that are available to the user (TOTP and WebAuthn) and from there they'll be able to add or remove any of them. Also, it's worth mentioning that for enabling WebAuthn it's required to have TOTP enabled, so the first time that you go to the 2FA Settings page, you'll be asked to set it up. This work was inspired by the one donde by Github in their platform, and despite it could be approached in different ways, we decided to go with this one given that we feel that this gives a great UX. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add request for WebAuthn as second factor at login if enabled This commits adds the feature for using WebAuthn as a second factor for login when enabled. If users have WebAuthn enabled, now a page requesting for the use of a WebAuthn credential for log in will appear, although a link redirecting to the old page for logging in using a two-factor code will also be present. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add possibility of deleting WebAuthn Credentials Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: disable WebAuthn when an Admin disables 2FA for a user Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: remove ability to disable TOTP leaving only WebAuthn as 2FA Following examples form other platforms like Github, we decided to make Webauthn 2FA secondary to 2FA with TOTP, so that we removed the possibility of removing TOTP authentication only, leaving users with just WEbAuthn as 2FA. Instead, users will have to click on 'Disable 2FA' in order to remove second factor auth. The reason for WebAuthn being secondary to TOPT is that in that way, users will still be able to log in using their code from their phone's application if they don't have their security keys with them – or maybe even lost them. * We had to change a little the flow for setting up TOTP, given that now it's possible to setting up again if you already had TOTP, in order to let users modify their authenticator app – given that now it's not possible for them to disable TOTP and set it up again with another authenticator app. So, basically, now instead of storing the new `otp_secret` in the user, we store it in the session until the process of set up is finished. This was because, as it was before, when users clicked on 'Edit' in the new two-factor methods lists page, but then went back without finishing the flow, their `otp_secret` had been changed therefore invalidating their previous authenticator app, making them unable to log in again using TOTP. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * refactor: fix eslint errors The PR build was failing given that linting returning some errors. This commit attempts to fix them. * refactor: normalize i18n translations The build was failing given that i18n translations files were not normalized. This commits fixes that. * refactor: avoid having the webauthn gem locked to a specific version * refactor: use symbols for routes without '/' * refactor: avoid sending webauthn disabled email when 2FA is disabled When an admins disable 2FA for users, we were sending two mails to them, one notifying that 2FA was disabled and the other to notify that WebAuthn was disabled. As the second one is redundant since the first email includes it, we can remove it and send just one email to users. * refactor: avoid creating new env variable for webauthn_origin config * refactor: improve flash error messages for webauthn pages Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>	5 years ago
ThibG	f6a82cb2cd	Fix not being able to unbookmark toots when blocked by their author (#14604 ) * Fix not being able to unbookmark toots when blocked by their author * Add tests	5 years ago
ThibG	f55dd193f9	Fix RSS feeds not being cachable (#14368 ) * Add tests for some cachable responses This only covers responses that we should have managed to make cachable so far. It's not the case of all responses that should be cachable in the end. * Fix RSS feeds not being cachable	5 years ago
ThibG	0a8a3fe595	Fix being unable to unboost when blocked by their author (#14308 ) Fixes #14307	5 years ago
Eugen Rochko	6e25574ce5	Fix media attachments enumeration (#14254 ) * Fix media attachment enumeration * Switch media_attachments id to snowflake ids Co-authored-by: Thibaut Girka <thib@sitedethib.com>	5 years ago
Eugen Rochko	72a7cfaa39	Add e-mail-based sign in challenge for users with disabled 2FA (#14013 )	5 years ago
ThibG	aed3a436a2	Fix serialization of replies when some of them are URIs (#13957 ) * Fix serialization of replies when some of them are URIs Fixes #13956 * Add test	5 years ago
ThibG	71fce71c94	Fix webfinger returning wrong status code on malformed or missing param (#13759 ) Fixes #13757	5 years ago
dependabot-preview[bot]	78202e9138	Bump doorkeeper from 5.3.3 to 5.4.0 (#13733 ) * Bump doorkeeper from 5.3.3 to 5.4.0 Bumps [doorkeeper](https://github.com/doorkeeper-gem/doorkeeper) from 5.3.3 to 5.4.0. - [Release notes](https://github.com/doorkeeper-gem/doorkeeper/releases) - [Changelog](https://github.com/doorkeeper-gem/doorkeeper/blob/master/CHANGELOG.md) - [Commits](https://github.com/doorkeeper-gem/doorkeeper/compare/v5.3.3...v5.4.0) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> * Fix tests * Fix use of Doorkeeper::AccessToken.find_or_create_for * Fix tests? Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com> Co-authored-by: Thibaut Girka <thib@sitedethib.com>	5 years ago
ThibG	4bcef12bad	Fix sr locale being selected over sr-Latn (#13693 ) * Fix sr locale being selected over sr-Latn * Update tests	5 years ago
Eugen Rochko	4b766f9846	Refactor monkey-patching of Goldfinger (#12561 )	5 years ago
Eugen Rochko	8be4c2ba21	Add ability to remove identity proofs from account (#13682 ) Fix #12613	5 years ago
ThibG	f1e0fa80f6	Fix own following/followers not showing muted users (#13614 ) Fixes #13612	5 years ago
Eugen Rochko	5cff7910c2	Add more ActivityPub controller tests (#13590 )	5 years ago
Eugen Rochko	988b0493fe	Add more tests for ActivityPub controllers (#13585 )	5 years ago
ThibG	61f35c1a8a	Fix reported accounts not being whitelisted when resolving a spamcheck report (#13289 )	5 years ago
Eugen Rochko	339ce1c4e9	Add specific rate limits for posting and following (#13172 )	5 years ago
Eugen Rochko	0c28a505dd	Fix leak of arbitrary statuses through unfavourite action in REST API (#13161 )	5 years ago
ThibG	c48d895ea7	Fix sign-ups without checked user agreement being accepted through the web form (#13088 ) * Fix user agreement not being verified * Fix tests * Fix up agreement field being dismissed	5 years ago
Eugen Rochko	5265df0a8a	Change signature verification to ignore signatures with invalid host (#13033 ) Instead of returning a signature verification error, pretend there was no signature (i.e., this does not allow access to resources that need a valid signature), so public resources can still be fetched Fix #13011	5 years ago
Eugen Rochko	f52c988e12	Add announcements (#12662 ) * Add announcements Fix #11006 * Add reactions to announcements * Add admin UI for announcements * Add unit tests * Fix issues - Add `with_dismissed` param to announcements API - Fix end date not being formatted when time range is given - Fix announcement delete causing reactions to send streaming updates - Fix announcements container growing too wide and mascot too small - Fix `all_day` being settable when no time range is given - Change text "Update" to "Announcement" * Fix scheduler unpublishing announcements before they are due * Fix filter params not being passed to announcements filter	5 years ago
Eugen Rochko	49b2f7c0a2	Fix base64-encoded file uploads not being possible (#12748 ) Fix #3804, Fix #5776	5 years ago
ThibG	3b3bdc7293	Hide blocked users from more places (#12733 ) * Hide blocked, muted, and blocked-by users from toot favourite lists * Hide blocked, muted, and blocked-by users from toot reblog lists * Hide blocked, muted, and blocked-by users from followers/following (API) * Fix tests * Hide blocked, muted, and blocked-by users from followers/following on public pages	5 years ago
ThibG	da2143b308	Fixes featured hashtag setting page erroring out instead of rejecting invalid tags (#12436 ) * Revert "Fix ignoring whole status because of one invalid hashtag (#11621)" This reverts commit `dff46b260b`. * Fix statuses being rejected because of invalid hashtag names * Add spec for invalid hashtag names in statuses * Add test for featured tags controller	5 years ago
Gomasy	5a2c0707f1	Support min_id-based pagination for bookmarks (#12381 ) * Support min_id-based pagination for bookmarks * Fix spec	5 years ago
Jennifer Glauche	fd93a9c871	make it not return http 400 when passing and empty source argument (#12259 ) * make it not return http 400 when passing and empty source argument * create a spec for the empty source hash bug * compact checks for nil, empty? parameters * use nil.blank? instead checking for nil	5 years ago
ThibG	dfea7368c9	Add bookmarks (#7107 ) * Add backend support for bookmarks Bookmarks behave like favourites, except they aren't shared with other users and do not have an associated counter. * Add spec for bookmark endpoints * Add front-end support for bookmarks * Introduce OAuth scopes for bookmarks * Add bookmarks to archive takeout * Fix migration * Coding style fixes * Fix rebase issue * Update bookmarked_statuses to latest UI changes * Update bookmark actions to properly reflect status changes in state * Add bookmarks item to single-column layout * Make active bookmarks red	5 years ago
Yamagishi Kazutoshi	afb398b583	Change to always returns html document in error pages (#12214 )	5 years ago
Eugen Rochko	5f69eb89e2	Add a nodeinfo endpoint (#12002 ) * Add nodeinfo endpoint * dont commit stuff from my local dev * consistant naming since we implimented 2.1 schema * Add some additional node info stuff * Add nodeinfo endpoint * dont commit stuff from my local dev * consistant naming since we implimented 2.1 schema * expanding this to include federation info * codeclimate feedback * CC feedback * using activeserializers seems like a good idea... * get rid of draft 2.1 version * Reimplement 2.1, also fix metaData -> metadata * Fix metaData -> metadata here too * Fix nodeinfo 2.1 tests * Implement cache for monthly user aggregate * Useless * Remove ostatus from the list of supported protocols * Fix nodeinfo's open_registration reading obsolete setting variable * Only serialize domain blocks with user-facing limitations * Do not needlessly list noop severity in nodeinfo * Only serialize domain blocks info in nodeinfo when they are set to be displayed to everyone * Enable caching for nodeinfo endpoints * Fix rendering nodeinfo * CodeClimate fixes * Please CodeClimate * Change InstancePresenter#active_user_count_months for clarity * Refactor NodeInfoSerializer#metadata * Remove nodeinfo 2.1 support as the schema doesn't exist * Clean-up	5 years ago
Eugen Rochko	3ed94dcc1a	Add account migration UI (#11846 ) Fix #10736 - Change data export to be available for non-functional accounts - Change non-functional accounts to include redirecting accounts	5 years ago
Eugen Rochko	e1066cd431	Add password challenge to 2FA settings, e-mail notifications (#11878 ) Fix #3961	5 years ago
Eugen Rochko	a4b60e9ba4	Fix TOTP codes not being filtered from logs during enabling/disabling (#11877 ) Not a serious issue because they are meaningless past single use	5 years ago
Eugen Rochko	c707ef49d9	Fix 2FA challenge and password challenge for non-database users (#11831 ) * Fix 2FA challenge not appearing for non-database users Fix #11685 * Fix account deletion not working when using external login Fix #11691	5 years ago
Eugen Rochko	18331fefa2	Remove deprecated `GET /api/v1/search` API (#11823 ) Use `GET /api/v2/search` instead	5 years ago
Eugen Rochko	c5d37f18cb	Change deletes to preserve soft-deleted statuses in unresolved reports (#11805 ) Change all account actions except "none" to resolve all unresolved reports Refactor `SuspendAccountService` to be more readable	5 years ago
Tao Bror Bojlén	4fe127664b	add admin setting for default search engine indexing (fix #11750 ) (#11804 )	5 years ago
ThibG	4faaa5b25e	Add updated relationship to follow request API responses (#11800 ) Fixes #11747	5 years ago
Eugen Rochko	1110ea1a91	Add batch actions and categories to admin UI for custom emojis (#11793 )	6 years ago
Eugen Rochko	e445a8af64	Add timeline read markers API (#11762 ) Fix #4093	6 years ago
Eugen Rochko	b54b725d6b	Fix uncaught domain normalization error in remote follow (#11703 )	6 years ago
Eugen Rochko	22ce4778eb	Fix uncaught parameter missing exceptions and missing error templates (#11702 )	6 years ago
Eugen Rochko	97192d9a77	Fix remote and staff-removed statuses leaving media behind for a day (#11638 ) The reason for unattaching media instead of removing it is to support delete & redraft functionality, but remote or staff-removed statuses will never be redrafted, so the media should be deleted immediately	6 years ago
Eugen Rochko	e5cee8062f	Fix blurhash and autoplay not working on public pages (#11585 )	6 years ago
Yusuke Nakamura	82d2069c75	Bump faker from 1.9.6 to 2.1.0 and update faker api (#11489 ) * Bump faker from 1.9.6 to 2.1.0 Bumps [faker](https://github.com/stympy/faker) from 1.9.6 to 2.1.0. - [Release notes](https://github.com/stympy/faker/releases) - [Changelog](https://github.com/stympy/faker/blob/master/CHANGELOG.md) - [Commits](https://github.com/stympy/faker/compare/1.9.6...v2.1.0) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> * Use faker api v2 https://github.com/stympy/faker/releases/tag/2.0	6 years ago
Eugen Rochko	115dab78f1	Change admin UI for hashtags and add back whitelisted trends (#11490 ) Fix #271 Add back the `GET /api/v1/trends` API with the caveat that it does not return tags that have not been allowed to trend by the staff. When a hashtag begins to trend (internally) and that hashtag has not been previously reviewed by the staff, the staff is notified. The new admin UI for hashtags allows filtering hashtags by where they are used (e.g. in the profile directory), whether they have been reviewed or are pending reviewal, they show by how many people the hashtag is used in the directory, how many people used it today, how many statuses with it have been created today, and it allows fixing the name of the hashtag to make it more readable. The disallowed hashtags feature has been reworked. It is now controlled from the admin UI for hashtags instead of from the file `config/settings.yml`	6 years ago
Eugen Rochko	8b9d0a0533	Remove XML version of Webfinger and remove links to Atom feeds (#11460 ) Fix #11453	6 years ago
Eugen Rochko	964ae8eee5	Change unconfirmed user login behaviour (#11375 ) Allow access to account settings, 2FA, authorized applications, and account deletions to unconfirmed and pending users, as well as users who had their accounts disabled. Suspended users cannot update their e-mail or password or delete their account. Display account status on account settings page, for example, when an account is frozen, limited, unconfirmed or pending review. After sign up, login users straight away and show a simple page that tells them the status of their account with links to account settings and logout, to reduce onboarding friction and allow users to correct wrongly typed e-mail addresses. Move the final sign-up step of SSO integrations to be the same as above to reduce code duplication.	6 years ago
Eugen Rochko	bd1545de5e	Change locale detection to run once per session (#8657 ) Fix #6462	6 years ago
Eugen Rochko	5bf67ca913	Add ActivityPub secure mode (#11269 ) * Add HTTP signature requirement for served ActivityPub resources * Change `SECURE_MODE` to `AUTHORIZED_FETCH` * Add 'Signature' to 'Vary' header and improve code style * Improve code style by adding `public_fetch_mode?` method	6 years ago
Eugen Rochko	4e8dcc5dbb	Add HTTP signatures to all outgoing ActivityPub GET requests (#11284 )	6 years ago

1 2 3 4 5 ...

442 Commits (22483a70cf99f62069250d373ddb26eb14dcb689)