mastodon

Commit Graph

Author	SHA1	Message	Date
ThibG	75b1488cf4	Add tombstones for remote statuses (#9830 ) * Add Tombstone model to remember object deletion * Do not recreate a status if it has been deleted * Record Tombstone for remote deleted items Also, only record deleted items from same-host actors * Clear an user's tombstones when their key change	6 years ago
Eugen Rochko	31f396b57d	Add support for non-public reblogs from ActivityPub (#9841 ) Fix #9838	6 years ago
Eugen Rochko	4ab42287c0	Use summary as summary for converted ActivityPub objects (#9823 ) Fix #8609	6 years ago
ThibG	a4f07bad95	Reduce chances of race conditions when processing deleted toots (#9815 ) * Reduce chances of race conditions when processing deleted toots * Prevent race condition when processing deleted toots	6 years ago
ThibG	70be301d69	Ensure blocked user unfollows blocker if Block/Undo Block are processed out of order (#9687 ) * Ensure blocked user unfollows blocker if Block/Undo Block are processed out of order * Add specs for Block causing unfollow and for out-of-order Block + Undo	6 years ago
ThibG	b2f4114550	Do not ignore federated reports targetting already-reported accounts (#9534 )	6 years ago
ThibG	290932602b	Reduce usage of LD signatures (#9659 ) * Do not LDS-sign Follow, Accept, Reject, Undo, Block * Do not use LDS for Create activities of private toots * Minor cleanup * Ignore unsigned activities instead of misattributing them * Use status.distributable? instead of querying visibility directly	6 years ago
Eugen Rochko	0f938ff29c	Add handler for Move activity (#9629 )	6 years ago
Eugen Rochko	aa9a20cde0	Fix ThreadResolveWorker getting queued with invalid URLs (#9628 )	6 years ago
ThibG	81bda7d67c	Add setting to not aggregate reblogs (#9248 ) * Add setting to not aggregate reblogs Fixes #9222 * Handle cases where user is nil in add_to_home and add_to_list * Add hint for setting_aggregate_reblogs option * Reword setting_aggregate_reblogs label	6 years ago
Eugen Rochko	c39d7e7b2b	Fix TLS handshake timeout not being enforced (#9381 ) Follow-up to #9329	6 years ago
Eugen Rochko	43c311b3a1	Fix nil error when no DNS addresses are found for host (#9379 )	6 years ago
Eugen Rochko	fd8145d232	Fix connect timeout not being enforced (#9329 ) * Fix connect timeout not being enforced The loop was catching the timeout exception that should stop execution, so the next IP would no longer be within a timed block, which led to requests taking much longer than 10 seconds. * Use timeout on each IP attempt, but limit to 2 attempts * Fix code style issue * Do not break Request#perform if no block given * Update method stub in spec for Request * Move timeout inside the begin/rescue block * Use Resolv::DNS with timeout of 1 to get IP addresses * Update Request spec to stub Resolv::DNS instead of Addrinfo * Fix Resolve::DNS stubs in Request spec	6 years ago
ThibG	466e3d710c	Include replies to list owner and replies to list members in list statuses (#9324 )	6 years ago
Eugen Rochko	384e953b75	Revert connect timeout from 1s to 10s (#9319 ) The failure rate in Sidekiq is too high	6 years ago
Eugen Rochko	9311430ed7	Prevent multiple handlers for Delete of Actor from running (#9292 )	6 years ago
Eugen Rochko	8069fd636b	Remove intermediary arrays when creating hash maps from results (#9291 )	6 years ago
ThibG	7f5a4be580	Fix emoji update date processing (#9255 )	6 years ago
Eugen Rochko	4615512285	Reduce connect timeout limit and limit signature failures by source IP (#9236 ) * Reduce connect timeout from 10s to 1s * Limit failing signature verifications per source IP	6 years ago
Eugen Rochko	be202f9377	Accept the same payload in multiple inboxes and deliver (#9150 )	6 years ago
m.b	2b18f5f85d	Add Page AP type support (#9121 )	6 years ago
ThibG	e53cc673e7	Ignore invalid hashtags on remote statuses instead of rejecting them (#9118 ) Fixes #9115	6 years ago
ThibG	82e7988afc	Fix missing `mention` argument when processing incoming Create activities (#9114 ) * Fix missing `mention` argument when processing incoming Create activities * Fix typo (param → params)	6 years ago
Eugen Rochko	d4cf963749	Allow inbox owner to view implicitly targeted ActivityPub payload (#9093 ) Fix #9091	6 years ago
Eugen Rochko	fd5285658f	Add option to block reports from domain (#8830 )	6 years ago
Eugen Rochko	ddd30f331c	Improve support for aspects/circles (#8950 ) * Add silent column to mentions * Save silent mentions in ActivityPub Create handler and optimize it Move networking calls out of the database transaction * Add "limited" visibility level masked as "private" in the API Unlike DMs, limited statuses are pushed into home feeds. The access control rules between direct and limited statuses is almost the same, except for counter and conversation logic * Ensure silent column is non-null, add spec * Ensure filters don't check silent mentions for blocks/mutes As those are "this person is also allowed to see" rather than "this person is involved", therefore does not warrant filtering * Clean up code * Use Status#active_mentions to limit returned mentions * Fix code style issues * Use Status#active_mentions in Notification And remove stream_entry eager-loading from Notification	6 years ago
Eugen Rochko	21ad21cb50	Improve signature verification safeguards (#8959 ) * Downcase signed_headers string before building the signed string The HTTP Signatures draft does not mandate the “headers” field to be downcased, but mandates the header field names to be downcased in the signed string, which means that prior to this patch, Mastodon could fail to process signatures from some compliant clients. It also means that it would not actually check the Digest of non-compliant clients that wouldn't use a lowercased Digest field name. Thankfully, I don't know of any such client. * Revert "Remove dead code (#8919)" This reverts commit `a00ce8c92c`. * Restore time window checking, change it to 12 hours By checking the Date header, we can prevent replaying old vulnerable signatures. The focus is to prevent replaying old vulnerable requests from software that has been fixed in the meantime, so a somewhat long window should be fine and accounts for timezone misconfiguration. * Escape users' URLs when formatting them Fixes possible HTML injection * Escape all string interpolations in Formatter class Slightly improve performance by reducing class allocations from repeated Formatter#encode calls * Fix code style issues	6 years ago
Eugen Rochko	61d44dd11f	Fix typo in ActivityPub Create handler (#8952 ) Regression from #8951	6 years ago
Eugen Rochko	790d3bc637	Move network calls out of transaction in ActivityPub handler (#8951 ) Mention and emoji code may perform network calls, but does not need to do that inside the database transaction. This may improve availability of database connections when using pgBouncer in transaction mode.	6 years ago
Eugen Rochko	774ac47373	Add conversations API (#8832 ) * Add conversations API * Add web UI for conversations * Add test for conversations API * Add tests for ConversationAccount * Improve web UI * Rename ConversationAccount to AccountConversation * Remove conversations on block and mute * Change last_status_id to be a denormalization of status_ids * Add optimistic locking	6 years ago
Jeong Arm	144d73730d	Leave unknown language as nil if account is remote (#8861 ) * Force use language detector if account is remote * Set unknown remote toot's language as nil	6 years ago
ThibG	ba444797d2	Fix handling of ActivityPub activities lacking some attributes (#8864 )	6 years ago
Eugen Rochko	ef69c655cc	Fix class autoloading issue in ActivityPub::Activity::Create (#8820 )	6 years ago
cbayerlein	4b78546135	Exclude replies from list timelines (#8683 ) * Changed list behaviour I added the following line to the FeedManager (app/lib/feed_manager.rb) in the push_to_list function: `return false if status.reply?` Now all posts that are replies are filtered out, so that now only "genuine" posts are displayed in the list. This is a first approach to solve issue #5916 * Update feed_manager.rb As suggested by @Gargron	6 years ago
ふぁぼ原	f7a6f9489d	Add a new preference to always hide all media (#8569 )	6 years ago
Matt Sweetman	1889526e23	Add user preference to always expand toots marked with content warnings (#8762 )	6 years ago
Eugen Rochko	f4d549d300	Redesign forms, verify link ownership with rel="me" (#8703 ) * Verify link ownership with rel="me" * Add explanation about verification to UI * Perform link verifications * Add click-to-copy widget for verification HTML * Redesign edit profile page * Redesign forms * Improve responsive design of settings pages * Restore landing page sign-up form * Fix typo * Support <link> tags, add spec * Fix links not being verified on first discovery and passive updates	6 years ago
Renato "Lond" Cerqueira	fe56d26f7b	Fix autoplay issue with spoiler tag (#8540 ) Add tests to avoid similar issues in the future	7 years ago
Eugen Rochko	e3764bdb52	Do not sign useless User-Agent or Accept-Encoding headers (#8533 ) Fix #8080	7 years ago
Renato "Lond" Cerqueira	11658d8653	Add animate custom emoji param to embed pages (#8507 ) * Add animate custom emoji param to embed pages * Rename param, use it for avatars and gifs * Fix issues pointed by codeclimate and breaking test * Ignore brakeman warning	7 years ago
Eugen Rochko	cabdbb7f9c	Add CLI task for rotating keys (#8466 ) * If an Update is signed with known key, skip re-following procedure Because it means the remote actor did not lose their database * Add CLI method for rotating keys bin/tootctl accounts rotate [USERNAME] Generates a new RSA key per account and sends out an Update activity signed with the old key. * Key rotation: Space out Update fan-outs every 5 minutes per 1000 accounts * Skip suspended accounts in key rotation	7 years ago
Quint Guvernator	da13fa5021	Fix low-hanging rubocop gripes (#8458 ) * rubocop: quit being so picky * rubocop: miscellany * rubocop: prefer present to blank	7 years ago
Eugen Rochko	b4ba4b1b5d	Spread out crawling randomly to avoid DDoSing the link (#8445 ) * Spread out crawling randomly to avoid DDoSing the link Fix #4486 * Remove trailing whitespace	7 years ago
M Somerville	95bd0d4528	Support ActivityStreams’ summaryMap. (#8422 ) In the same way as contentMap and nameMap.	7 years ago
Jakub Mendyk	6cb3514d64	Add ability to change an instance default theme from the administration panel (#7092 ) (#8381 ) * Add default_settings class method to ScopedSettings ScopedSettings was extended to use value of unscoped setting instead of only using defaults set in config/settings.yml for selected settings. This adds possibility for admins to set default values of users' settings, for example default theme (as requested in #7092). * Add ability to change an instance default theme Closes #7092	7 years ago
ThibG	42573b76f1	Do not crash if remote custom emoji does not define updated date (fixes #8376 ) (#8377 )	7 years ago
Eugen Rochko	802cf6a4c5	Improve federated ID validation (#8372 ) * Fix URI not being sufficiently validated with prefetched JSON * Add additional id validation to OStatus documents, when possible	7 years ago
ThibG	59f7f4c923	Implement Undo { Accept { Follow } } (fixes #8234 ) (#8245 ) * Add Follow#revoke_request! * Implement Undo { Accept { Follow } } (fixes #8234)	7 years ago
ThibG	1ee675d68b	Use correct activity id in Accept when receiving duplicate Follow (fixes #8218 ) (#8244 )	7 years ago
Eugen Rochko	39e361a56d	Expect relays to answer with accept/reject (#8179 )	7 years ago

1 2 3 4 5 ...

406 Commits (70405db63ccfc7b9b2816e0e6bfeb6d99a8c6ec1)