263 Commits (3a3b40e0c36902b66526303af8d5fdecb8bab5c2)

Author	SHA1	Message	Date
Yamagishi Kazutoshi	d7268befa8	Add healthcheck endpoint for web (#11770)	5 years ago
ThibG	692c5b439a	Fix ActivityPub context not being dynamically computed (#11746) ... * Fix contexts not being dynamically included Fixes #11649 * Refactor Note context in serializer * Refactor Actor serializer	6 years ago
ThibG	8203e24cf4	Fix CSP needlessly allowing blob URLs in script-src (#11620)	6 years ago
Eugen Rochko	b7f5f0ec10	Fix media host not being included in connect-src for OCR (#11577)	6 years ago
Eugen Rochko	28636f43e4	Add OCR tool to media editing modal (#11566)	6 years ago
Eugen Rochko	24552b5160	Add whitelist mode (#11291)	6 years ago
Eugen Rochko	3bc0c4a884	Remove unused StatsD code and expose StatsD as a global variable (#11232) ... The instrumentation code was used for StatsD metrics collection prior to the switch to the nsa gem and should have been removed at that point as it no longer does anything at all	6 years ago
Eugen Rochko	7696f77245	Add moderation API (#9387) ... Fix #8580 Fix #7143	6 years ago
Eugen Rochko	1db4117030	Change preferences page into appearance, notifications, and other (#10977)	6 years ago
Hinaloe	b793722d7d	Fix undefined method error (#10868)	6 years ago
mayaeh	afb17b7045	Fix undefined method error. (#10867)	6 years ago
ThibG	0e9b8be18a	Improve rate limiting (#10860) ... * Rate limit based on remote address IP, not on potential reverse proxy * Limit rate of unauthenticated API requests further * Rate-limit paging requests to one every 3 seconds	6 years ago
dependabot[bot]	ecbea2e3c6	Bump rack-attack from 5.4.2 to 6.0.0 (#10599) ... * Bump rack-attack from 5.4.2 to 6.0.0 Bumps [rack-attack](https://github.com/kickstarter/rack-attack) from 5.4.2 to 6.0.0. - [Release notes](https://github.com/kickstarter/rack-attack/releases) - [Changelog](https://github.com/kickstarter/rack-attack/blob/master/CHANGELOG.md) - [Commits](https://github.com/kickstarter/rack-attack/compare/v5.4.2...v6.0.0) Signed-off-by: dependabot[bot] <support@dependabot.com> * fix payload[:request]	6 years ago
Eugen Rochko	8a0d677cde	Fix stoplight logging to stderr separate from Rails logger (#10624)	6 years ago
Eugen Rochko	0e8819f0e8	Add rate limit for media proxy requests (#10490) ... 30 per 30 minutes, like media uploads	6 years ago
Eugen Rochko	11fe293e1b	Remove unused ActivityPub `@context` values depending on response (#10378) ... Fix #8078	6 years ago
Eric	7169928f96	cas_options :validate_url should be :service_validate_url (#10328) ... Otherwise, no matter what is given for CAS_VALIDATE_URL the default /serviceValidate path would be used.	6 years ago
Eugen Rochko	99fa1ce93d	Add tight rate-limit for API deletions (#10042) ... Deletions take a lot of resources to execute and cause a lot of federation traffic, so it makes sense to decrease the number someone can queue up through the API. 30 per 30 minutes	6 years ago
Eugen Rochko	016ad37bc8	Fix URL linkifier grabbing full-width spaces and quotations (#9997) ... Fix #9993 Fix #5654	6 years ago
Eugen Rochko	4699cf853c	Add timeouts for S3 (#9842)	6 years ago
Moritz Heiber	ecf40d09ed	Disable Same-Site cookie implementation to fix SSO issues on WebKit browsers (#9819)	6 years ago
Nolan Lawson	f05eb67081	Enable immutable caching for S3 objects (#9722) ... I also added "public" here, as I can't think of a good reason not to add it. Perhaps it has some marginal benefit in that ISPs (or other proxies) can cache it for all users. The assets are certainly publicly available and the same for all users.	6 years ago
Eugen Rochko	5d2fc6de32	Add REST API for creating an account (#9572) ... * Add REST API for creating an account The method is available to apps with a token obtained via the client credentials grant. It creates a user and account records, as well as an access token for the app that initiated the request. The user is unconfirmed, and an e-mail is sent as usual. The method returns the access token, which the app should save for later. The REST API is not available to users with unconfirmed accounts, so the app must be smart to wait for the user to click a link in their e-mail inbox. The method is rate-limited by IP to 5 requests per 30 minutes. * Redirect users back to app from confirmation if they were created with an app * Add tests * Return 403 on the method if registrations are not open * Require agreement param to be true in the API when creating an account	6 years ago
Eugen Rochko	240c122767	Skip mailer job retries when a record no longer exists (#9590) ... Fix #8666	6 years ago
ThibG	3f12c07ff5	Use same CORS policy for /@:username and /users/:username (#9485) ... Fixes #8189 rack-cors being called before the application router, it does not follow the redirection, and we need a separate rule for /users/:username.	6 years ago
ThibG	84e5ed43e7	Preload common JSON-LD contexts (#9412) ... Fixes #9411	6 years ago
Ben Lubar	13e049d772	Allow cross-origin requests to /.well-known/* URLs. (#9083) ... Right now, this includes three endpoints: host-meta, webfinger, and change-password. host-meta and webfinger are publicly available and do not use any authentication. Nothing bad can be done by accessing them in a user's browser. change-password being CORS-enabled will only reveal the URL it redirects to (which is /auth/edit) but not anything about the actual /auth/edit page, because it does not have CORS enabled. The documentation for hosting an instance on a different domain should also be updated to point out that Access-Control-Allow-Origin: * should be set at a minimum for the /.well-known/host-meta redirect to allow browser-based non-proxied instance discovery.	6 years ago
Eugen Rochko	a38a452481	Add unread indicator to conversations (#9009)	6 years ago
ThibG	8ab081ec32	Add manifest_src to CSP, add blob to connect_src (#8967)	6 years ago
Eugen Rochko	edc7f895be	Fix CSP headers blocking media and development environment (#8962) ... Regression from #8957	6 years ago
ThibG	2d27c11061	Set Content-Security-Policy rules through RoR's config (#8957) ... * Set CSP rules in RoR's configuration * Override CSP setting in the embed controller to allow frames	6 years ago
Sascha	b2a57a5d6f	add ffmpeg initializer (#8855) ... * add ffmpeg initializer * use different expression to check for environment var	6 years ago
ashleyhull-versent	f194857ac9	rubocop issues - Cleaning up (#8912) ... * cleanup pass * undo mistakes * fixed. * revert	6 years ago
aus-social	0a4739c732	lint pass 2 (#8878) ... * Code quality pass * Typofix * Update applications_controller_spec.rb * Update applications_controller_spec.rb	6 years ago
aus-social	1f98eae1cf	Lint pass (#8876)	6 years ago
Yamagishi Kazutoshi	65f04e6046	Fix that Rails.cache information could not be sent via StatsD (#8831)	6 years ago
Eugen Rochko	f4d549d300	Redesign forms, verify link ownership with rel="me" (#8703) ... * Verify link ownership with rel="me" * Add explanation about verification to UI * Perform link verifications * Add click-to-copy widget for verification HTML * Redesign edit profile page * Redesign forms * Improve responsive design of settings pages * Restore landing page sign-up form * Fix typo * Support <link> tags, add spec * Fix links not being verified on first discovery and passive updates	6 years ago
luzpaz	40dd19be37	Misc. typos (#8694) ... Found via `codespell -q 3 --skip="./app/javascript/mastodon/locales,./config/locales"`	6 years ago
Sorin Davidoi	6f3d934bc1	feat(cookies): Use the same-site attribute to lax (#8626) ... CSFR-prevention is already implemented but adding this doesn't hurt. A brief introduction to Same-Site cookies (and the difference between strict and lax) can be found at https://blog.mozilla.org/security/2018/04/24/same-site-cookies-in-firefox-60/ TLDR: We use lax since we want the cookies to be sent when the user navigates safely from an external site.	7 years ago
M Somerville	2bba6e582d	Rename S3_CLOUDFRONT_HOST to S3_ALIAS_HOST. (#8423) ... Still check for S3_CLOUDFRONT_HOST for existing installs.	7 years ago
ThibG	f06fa09962	Revert to using Paperclip's filesystem storage, and fix dangling records in remove_remote (#8339) ... * Fix uncaching worker * Revert to using Paperclip's filesystem backend instead of fog-local fog-local has lots of concurrency issues, causing failure to delete files, dangling file records, and spurious errors UncacheMediaWorker	7 years ago
Immae	b0f4fe456b	Add ldap search filter (#8151)	7 years ago
Eugen Rochko	018a9e4e7f	Add post-deployment migration system (#8182) ... Adopted from GitLab CE. Generate new migration with: rails g post_deployment_migration name_of_migration_here By default they are run together with db:migrate. To not run them, the env variable SKIP_POST_DEPLOYMENT_MIGRATIONS must be set Code by Yorick Peterse <yorickpeterse@gmail.com>, see also: 83c8241160	7 years ago
abcang	69bf116345	Add secure option to additional cookie (#8069)	7 years ago
Eugen Rochko	1f6ed4f86a	Add more granular OAuth scopes (#7929) ... * Add more granular OAuth scopes * Add human-readable descriptions of the new scopes * Ensure new scopes look good on the app UI * Add tests * Group scopes in screen and color-code dangerous ones * Fix wrong extra scope	7 years ago
MIYAGI Hikaru	ddd0bb69e1	Merge `HIDDEN_SERVICE_VIA_TRANSPARENT_PROXY` into `ALLOW_ACCESS_TO_HIDDEN_SERVICE` (#7901) ... If Mastodon accesses to the hidden service via transparent proxy, it's needed to avoid checking whether it's a private address, since `.onion` is resolved to a private address. I was previously using the `HIDDEN_SERVICE_VIA_TRANSPARENT_PROXY` to provide that function. However, I realized that using `HIDDEN_SERVICE_VIA_TRANSPARENT_PROXY` is redundant, since this specification is always used with `ALLOW_ACCESS_TO_HIDDEN_SERVICE`. Therefore, I decided to integrate the setting of `HIDDEN_SERVICE_VIA_TRANSPARENT_PROXY` into` ALLOW_ACCESS_TO_HIDDEN_SERVICE`.	7 years ago
Eugen Rochko	0df91c7b1e	Add dat, dweb, ipfs, ipns, ssb, gopher protocols to URL extractor (#7810) ... * Add dat:// and gopher:// to URL extractor Fix #6072 * Fix comment indent * Add dweb, ipfs, ipns, ssb	7 years ago
Eugen Rochko	53f0452b70	Remove rack-timeout (#7809) ... Timeout considered harmful due to leaving the app in a broken state, including unreaped database connections	7 years ago
Eugen Rochko	d87649db07	Disable AMS logging (#7623) ... Especially in production it's just noise and doesn't mix well with the log format	7 years ago
MIYAGI Hikaru	919eef3098	User agent for WebFinger (#7531) ... * User agent for WebFinger * local_domain → web_domain * 'http' is away accidentally...	7 years ago