mastodon

Commit Graph

Author	SHA1	Message	Date
Eugen Rochko	f7117646af	Add cold-start follow recommendations (#15945 )	4 years ago
Eugen Rochko	619fad6cf8	Remove spam check and dependency on nilsimsa gem (#16011 )	4 years ago
Eugen Rochko	487e37d6d4	Add system checks to dashboard in admin UI (#15989 )	4 years ago
Eugen Rochko	82cce18227	Change health check (#15988 )	4 years ago
Claire	a650a1157d	Fix /admin/tags/:id crashing since Rails 6.1 update (#15953 ) Raw SQL passed to `pluck` now has to be explicitly marked as SQL via Arel.sql, see https://github.com/rails/rails/pull/27947	4 years ago
Claire	59f94593d0	Add warning in admin dashboard if some required queues are not handled (#15954 )	4 years ago
Eugen Rochko	dd1eb9918a	Add `email` param to `POST /api/v1/emails/confirmations` (#15949 ) Allow changing e-mail as long as the account is unconfirmed	4 years ago
Claire	cbd0ee1d07	Update Mastodon to Rails 6.1 (#15910 ) * Update devise-two-factor to unreleased fork for Rails 6 support Update tests to match new `rotp` version. * Update nsa gem to unreleased fork for Rails 6 support * Update rails to 6.1.3 and rails-i18n to 6.0 * Update to unreleased fork of pluck_each for Ruby 6 support * Run "rails app:update" * Add missing ActiveStorage config file * Use config.ssl_options instead of removed ApplicationController#force_ssl Disabled force_ssl-related tests as they do not seem to be easily testable anymore. * Fix nonce directives by removing Rails 5 specific monkey-patching * Fix fixture_file_upload deprecation warning * Fix yield-based test failing with Rails 6 * Use Rails 6's index_with when possible * Use ActiveRecord::Cache::Store#delete_multi from Rails 6 This will yield better performances when deleting an account * Disable Rails 6.1's automatic preload link headers Since Rails 6.1, ActionView adds preload links for javascript files in the Links header per default. In our case, that will bloat headers too much and potentially cause issues with reverse proxies. Furhermore, we don't need those links, as we already output them as HTML link tags. * Switch to Rails 6.0 default config * Switch to Rails 6.1 default config * Do not include autoload paths in the load path	4 years ago
Claire	b358229834	Further preparation for Rails 6 (#15916 ) * Use ActiveRecord::Result#to_ary instead of deprecated to_hash They do the same thing, and to_hash has been removed from Rails 6.1 * Explicitly name polymorphic indexes to workaround a bug in Rails 6.1 cf. https://github.com/rails/rails/issues/41693 * Fix incorrect usage of “foreign_key” in migration script * Use `ActiveModel::Errors#delete` instead of deprecated clear method * Fix link headers tests on Rails 6.1 Rails 6.1 adds values to the Link header by default, thus it is not a LinkHeader object anymore. Fix the test to parse the Link header instead of assuming it is a LinkHeader.	4 years ago
Claire	5027abecd1	Fix cache_collection crashing when given an empty collection (#15921 ) * Fix cache_collection crashing when given an empty collection * Add tests	4 years ago
Eugen Rochko	ee1119208c	Add `POST /api/v1/emails/confirmations` to REST API (#15816 ) Only available to the application the user originally signed-up with	4 years ago
Eugen Rochko	9aa37b32c3	Add `details` to error response for `POST /api/v1/accounts` in REST API (#15803 )	4 years ago
Claire	75189af528	Fix crash on receiving requests with missing Digest header (#15782 ) * Fix crash on receiving requests with missing Digest header Return an error pointing out that Digest is missing, instead of crashing. Fixes #15743 * Fix from review feedback	4 years ago
Eugen Rochko	8331fdf7e0	Add server rules (#15769 )	4 years ago
Justin Tracey	c9e8e1739c	replace all instances of "ends_with?" with "end_with?" (#15745 ) The "ends_with?" method is just a Rails alias of Ruby's "end_with?" method. Using the latter makes the code less brittle.	4 years ago
Eugen Rochko	e31ed27485	Add `GET /api/v1/accounts/lookup` REST API (#15740 )	4 years ago
Eugen Rochko	15ced8728f	Refactor Api::Web::SettingsController (#15717 )	4 years ago
Cecylia Bocovich	e79f8dd85c	Onion service related changes to HTTPS handling (#15560 ) * Enable secure cookie flag for https only * Disable force_ssl for .onion hosts only Co-authored-by: Aiden McClelland <me@drbonez.dev>	4 years ago
Claire	acdeb162b8	Create instance actor if it hasn't been properly seeded (#15693 ) An uncommon but somewhat difficult to digagnose issue is dealing with improperly-seeded databases. In such cases, instance-signed fetches will fail with a ActiveRecord::RecordNotFound error, usually caught and handled as generic 404, leading people to think the remote resource itself has not been found, while it's the local instance actor that does not exist. This commit changes the code so that failure to find the instance actor automatically creates a new one, so that improperly-seeded databases do not cause any issue.	4 years ago
abcang	7ab53f221a	Improved performance of notification preloading (#15640 ) * Improved performance of notification preloading * Remove Cacheable from Notification * Fix test	4 years ago
ThibG	2ff01f78f7	Fix /activity endpoint not require signature in authorized fetch mode (#15592 ) Fixes #15589 Co-authored-by: Claire <claire.github-309c@sitedethib.com>	4 years ago
ThibG	54d4e5252b	Use Rails' index_by where it makes sense (#15542 ) * Use Rails' index_by where it makes sense * Fix tests Co-authored-by: Claire <claire.github-309c@sitedethib.com>	4 years ago
Levi Bard	11d603101a	Fix muting users with duration via the REST api (#15516 )	4 years ago
luigi	087ed84367	Optimize map { ... }.compact calls (#15513 ) * Optimize map { ... }.compact using Enumerable#filter_map, supported since Ruby 2.7 * Add poyfill for Enumerable#filter_map	4 years ago
ThibG	a1a8aa4a08	Skip processing Update activities on unknown accounts (#15514 ) This also skips fetching the actor completely. This will be useful if we end up distributing Update activities linked to account suspensions more widely (they are currently only delivered to the suspended account's followers), as currently, instances not knowing about the suspended account would fetch it to then process the suspension. Co-authored-by: Claire <claire.github-309c@sitedethib.com>	4 years ago
ThibG	4552449c26	Fix profile update not being sent on profile/header picture deletion (#15461 ) Fixes #15460 Co-authored-by: Claire <claire.github-309c@sitedethib.com>	4 years ago
trwnh	4950e59cdc	Use existing FeaturedTag serializer and delete AccountFeaturedTag serializer (#15415 ) * Update featured_tags_controller.rb * Update featured_tag_serializer.rb * Update featured_tag_serializer.rb * Delete account_featured_tag_serializer.rb * please codeclimate * please codeclimate	4 years ago
Eugen Rochko	8a95867693	Add option to obfuscate domain name in public list of domain blocks (#15355 ) - Replace the middle of the domain with * characters (except for periods) - Add SHA-256 digest of the domain name in tooltip	4 years ago
Eugen Rochko	1045549f85	Add stoplight for object storage failures, return HTTP 503 (#13043 )	4 years ago
Eugen Rochko	216b85b053	Fix performance on instances list in admin UI (#15282 ) - Reduce duplicate queries - Remove n+1 queries - Add accounts count to detailed view - Add separate action log entry for updating existing domain blocks	4 years ago
ThibG	49eb4d4ddf	Add honeypot fields and minimum fill-out time for sign-up form (#15276 ) * Add honeypot fields to limit non-specialized spam Add two honeypot fields: a fake website input and a fake password confirmation one. The label/placeholder/aria-label tells not to fill them, and they are hidden in CSS, so legitimate users should not fall into these. This should cut down on some non-Mastodon-specific spambots. * Require a 3 seconds delay before submitting the registration form * Fix tests * Move registration form time check to model validation * Give people a chance to clear the honeypot fields * Refactor honeypot translation strings Co-authored-by: Claire <claire.github-309c@sitedethib.com>	4 years ago
Eugen Rochko	48bef17cc9	Fix slow distinct queries where grouped queries are faster (#15287 ) About 2x speed-up on inboxes query	4 years ago
Takeshi Umeda	44d5c6bc8f	Fix incorrect conditions for suspended accounts in Get API for account featured tags (#15270 )	4 years ago
ThibG	c43f4cd3bb	Fix not being able to unfavorite toots one has lost access to (#15192 ) Fixes #15191	4 years ago
ThibG	96c1e71329	Add import/export feature for bookmarks (#14956 ) * Add ability to export bookmarks * Add support for importing bookmarks * Add bookmark import tests * Add bookmarks export test	4 years ago
Eugen Rochko	8532429af7	Fix 2FA/sign-in token sessions being valid after password change (#14802 ) If someone tries logging in to an account and is prompted for a 2FA code or sign-in token, even if the account's password or e-mail is updated in the meantime, the session will show the prompt and allow the login process to complete with a valid 2FA code or sign-in token	4 years ago
Takeshi Umeda	148ce97e21	Add interrelationship icon (#15149 ) * Add interrelationship icon * Fix arrow for rtl * Fix to predefined color	4 years ago
Takeshi Umeda	2b1a6e734f	Add follow selected followers button (#15148 ) * Add follow selected followers button * Fix unused variable * Fix i18n normalize	4 years ago
Eugen Rochko	3134691948	Add support for reversible suspensions through ActivityPub (#14989 )	4 years ago
ThibG	b29defb851	Change order of announcements in admin page to sort them newest-first (#15091 ) * Change order of announcements in admin page to sort show newly-created first Fixes #15090 * Use reverse-chronological rather than creation date only	4 years ago
Takeshi Umeda	d6fe0c94ca	Add account sensitized (#14361 ) * Add account sensitized * Fix i18n normalize * Fix description and spec * Fix spec * Fix wording	4 years ago
ThibG	fa929d8b81	Tweak signature verification (#15069 ) * Add more specific error message when request body digest is invalid This may help other implementors debug their implementation. * Relax Host parameter requirement to GET requests The only POST requests processed by Mastodon need objects/actors (including their host) to be explicitly mentioned in the request's body, so replaying a legitimate request to another host should not be a security issue. * Support Digest headers using multiple algorithms or lowercase alogirthm names	4 years ago
Mélanie Chauvel	0a8ab822e2	Sort filters by “keyword or phrase” in Settings (#15050 )	4 years ago
ThibG	ca56527140	Add follower synchronization mechanism (#14510 ) * Add support for followers synchronization on the receiving end Check the `collectionSynchronization` attribute on `Create` and `Announce` activities and synchronize followers from provided collection if possible. * Add tests for followers synchronization on the receiving end * Add support for follower synchronization on the sender's end * Add tests for the sending end * Switch from AS attributes to HTTP header Replace the custom `collectionSynchronization` ActivityStreams attribute by an HTTP header (`X-AS-Collection-Synchronization`) with the same syntax as the `Signature` header and the following fields: - `collectionId` to specify which collection to synchronize - `digest` for the SHA256 hex-digest of the list of followers known on the receiving instance (where “receiving instance” is determined by accounts sharing the same host name for their ActivityPub actor `id`) - `url` of a collection that should be fetched by the instance actor Internally, move away from the webfinger-based `domain` attribute and use account `uri` prefix to group accounts. * Add environment variable to disable followers synchronization Since the whole mechanism relies on some new preconditions that, in some extremely rare cases, might not be met, add an environment variable (DISABLE_FOLLOWERS_SYNCHRONIZATION) to disable the mechanism altogether and avoid followers being incorrectly removed. The current conditions are: 1. all managed accounts' actor `id` and inbox URL have the same URI scheme and netloc. 2. all accounts whose actor `id` or inbox URL share the same URI scheme and netloc as a managed account must be managed by the same Mastodon instance as well. As far as Mastodon is concerned, breaking those preconditions require extensive configuration changes in the reverse proxy and might also cause other issues. Therefore, this environment variable provides a way out for people with highly unusual configurations, and can be safely ignored for the overwhelming majority of Mastodon administrators. * Only set follower synchronization header on non-public statuses This is to avoid unnecessary computations and allow Follow-related activities to be handled by the usual codepath instead of going through the synchronization mechanism (otherwise, any Follow/Undo/Accept activity would trigger the synchronization mechanism even if processing the activity itself would be enough to re-introduce synchronization) * Change how ActivityPub::SynchronizeFollowersService handles follow requests If the remote lists a local follower which we only know has sent a follow request, consider the follow request as accepted instead of sending an Undo. * Integrate review feeback - rename X-AS-Collection-Synchronization to Collection-Synchronization - various minor refactoring and code style changes * Only select required fields when computing followers_hash * Use actor URI rather than webfinger domain in synchronization endpoint * Change hash computation to be a XOR of individual hashes Makes it much easier to be memory-efficient, and avoid sorting discrepancy issues. * Marginally improve followers_hash computation speed * Further improve hash computation performances by using pluck_each	4 years ago
OSAMU SATO	96761752ec	Add duration parameter to muting. (#13831 ) * Adding duration to muting. * Remove useless checks	4 years ago
Eugen Rochko	5e1364c448	Add IP-based rules (#14963 )	4 years ago
ThibG	78e45a5285	Add option to disable swiping motions across the WebUI (#13885 ) Fixes #13882	4 years ago
Eugen Rochko	8c8bf0289f	Fix not being able to enable status notifications in Web Push API (#14822 )	4 years ago
Eugen Rochko	974b1b79ce	Add option to be notified when a followed user posts (#13546 ) * Add bell button Fix #4890 * Remove duplicate type from post-deployment migration * Fix legacy class type mappings * Improve query performance with better index * Fix validation * Remove redundant index from notifications	4 years ago
Eugen Rochko	ed099d8bdc	Change account suspensions to be reversible by default (#14726 )	4 years ago

1 2 3 4 5 ...

1094 Commits (463875f645abf59eb64c760ec1439d9434ebc86e)