228 Commits (b70de2cf6908db2ddbe0c35faebead70e8cd8f22)

Author	SHA1	Message	Date
Eugen Rochko	feed07227b	Apply a 25x rate limit by IP even to authenticated requests (#5948)	7 years ago
Naoki Kosaka	4bce376fdc	Missing require 'authorization_decorator'. (#5947)	7 years ago
Eugen Rochko	a865b62efc	Rate limit by user instead of IP when API user is authenticated (#5923) ... * Fix #668 - Rate limit by user instead of IP when API user is authenticated * Fix code style issue * Use request decorator provided by Doorkeeper	7 years ago
THE BOSS ♨	17e26f8afe	Fix typo in paperclip.rb (#5936)	7 years ago
Yamagishi Kazutoshi	b0db4dad79	Revert fog-aws (ref #5604) (#5934)	7 years ago
Eugen Rochko	42bcbd36b7	Remove rabl dependency (#5894) ... * Remove rabl dependency * Replicate old Oj configuration	7 years ago
Eugen Rochko	546257bc7f	Allow specifying STATSD_NAMESPACE (#5700)	7 years ago
MitarashiDango	cbbeec05be	Fix spell miss (SWIIFT_OBJECT_URL -> SWIFT_OBJECT_URL) (#5617)	7 years ago
Yamagishi Kazutoshi	47b0c61853	Unify file upload to using fog (#5604)	7 years ago
Jeong Arm	9d97054fe6	Remove timestamps on any option (#5282)	7 years ago
unarist	7fd66cf2fe	Fix migration failure due to StrongMigrations on production env (#5283)	7 years ago
Lynx Kotoura	32e8a87830	adjust public profile pages 2 (#5223)	7 years ago
Nishi, Keisuke	83ffc4dc07	Fix Paperclip::Fog always responds Not Found in OpenStack-v2 like ConoHa (#5155)	7 years ago
Eugen Rochko	35a8cafa35	Replace self-rolled statsd instrumention with localshred/nsa (#5118)	7 years ago
Eugen Rochko	db3ed498b0	When OAuth password verification fails, return 401 instead of redirect (#5111) ... Call to warden.authenticate! in resource_owner_from_credentials would make the request redirect to sign-in path, which is a bad response for apps. Now bad credentials just return nil, which leads to HTTP 401 from Doorkeeper. Also, accounts with enabled 2FA cannot be logged into this way.	7 years ago
Eugen Rochko	e528114c53	Follow-up to #4582 and #5027, removing dead code (#5101)	7 years ago
Eugen Rochko	b982d549f4	Add strong_migrations gem to warn when creating unsafe migrations (#5078)	7 years ago
Eugen Rochko	d68df88d4e	Disable private status federation over OStatus (#5027)	7 years ago
unarist	6db034a866	Re-allow underscore on valid_url_path_ending_chars (#4999) ... Limiting allowed characters in the last character of the URL is came from twitter-text, but underscore is allowed on there, and Mastodon before #4941.	7 years ago
ふぁぼ原	3816943e6b	Enable to recognize most kinds of characters as URL paths (#4941)	7 years ago
abcang	1aad015bbb	Revert unique retry job (#4937) ... * Revert "Enable UniqueRetryJobMiddleware even when called from sidekiq worker (#4836)" This reverts commit 6859d4c028. * Revert "Do not execute the job with the same arguments as the retry job (#4814)" This reverts commit be7ffa2d75.	7 years ago
Patrick Figel	3018043fc2	Add OpenStack Keystone V3 support (#4889) ... Keystone V2 is deprecated in favour of V3. This adds the necessary connection parameters for establishing a V3 connection. Connections to V2 endpoints are still possible and the configuration should remain compatible. This also introduces a SWIFT_REGION variable for multi-region OpenStack environments and a SWIFT_CACHE_TTL that controls how long tokens and other meta-data is cached for. Caching tokens avoids rate-limiting errors that would result in media uploads becoming unavailable during high load or when using tasks like media:remove_remote. fog-openstack only supports token caching for V3 endpoints, so a recommendation for using V3 was added.	7 years ago
abcang	6859d4c028	Enable UniqueRetryJobMiddleware even when called from sidekiq worker (#4836)	7 years ago
Adam Thurlow	6994664a13	swift-enable the paperclip! 📎 (#2322)	7 years ago
abcang	be7ffa2d75	Do not execute the job with the same arguments as the retry job (#4814)	7 years ago
Eugen Rochko	1b1e025b41	Use updated ActivityStreams context (added: sharedInbox) (#4764)	7 years ago
Eugen Rochko	00840f4f2e	Add handling of Linked Data Signatures in payloads (#4687) ... * Add handling of Linked Data Signatures in payloads * Add a way to sign JSON, fix canonicalization of signature options * Fix signatureValue encoding, send out signed JSON when distributing * Add missing security context	7 years ago
Eugen Rochko	cf615abbf9	Add configuration to disable private status federation over PuSH (#4582)	7 years ago
Colin Mitchell	871c0d251a	Application prefs section (#2758) ... * Add code for creating/managing apps to settings section * Add specs for app changes * Fix controller spec * Fix view file I pasted over by mistake * Add locale strings. Add 'my apps' to nav * Add Client ID/Secret to App page. Add some visual separation * Fix rubocop warnings * Fix embarrassing typo I lost an `end` statement while fixing a merge conflict. * Add code for creating/managing apps to settings section - Add specs for app changes - Add locale strings. Add 'my apps' to nav - Add Client ID/Secret to App page. Add some visual separation - Fix some bugs/warnings * Update to match code standards * Trigger notification * Add warning about not sharing API secrets * Tweak spec a bit * Cleanup fixture creation by using let! * Remove unused key * Add foreign key for application<->user	7 years ago
Eugen Rochko	6df8bd277b	Set correct content-type for ActivityPub JSON (#4592)	8 years ago
Eugen Rochko	40be4ea239	Extend Devise remember_me longevity to 1 year instead of 2 weeks (#4587) ... Force SSL only cookies for remember_me, adjust confirmation expiration time to fit with the user cleanup scheduler	8 years ago
Eugen Rochko	dd7ef0dc41	Add ActivityPub inbox (#4216) ... * Add ActivityPub inbox * Handle ActivityPub deletes * Handle ActivityPub creates * Handle ActivityPub announces * Stubs for handling all activities that need to be handled * Add ActivityPub actor resolving * Handle conversation URI passing in ActivityPub * Handle content language in ActivityPub * Send accept header when fetching actor, handle JSON parse errors * Test for ActivityPub::FetchRemoteAccountService * Handle public key and icon/image when embedded/as array/as resolvable URI * Implement ActivityPub::FetchRemoteStatusService * Add stubs for more interactions * Undo activities implemented * Handle out of order activities * Hook up ActivityPub to ResolveRemoteAccountService, handle Update Account activities * Add fragment IDs to all transient activity serializers * Add tests and fixes * Add stubs for missing tests * Add more tests * Add more tests	8 years ago
unarist	b42c018bb8	Add Content-Type header on throttled response to fix mojibake (#4558) ... application/json only allows Unicode, so this prevents from wrong charset detection.	8 years ago
Eugen Rochko	df605f0f8b	Add "signed in as" header to some pages (#4523)	8 years ago
Eugen Rochko	8d6c3cd48a	Fix sessions being replaced needlessly (#4292)	8 years ago
Eugen Rochko	a5a07da892	Correct OStatus inflection (Ostatus -> OStatus) (#4255)	8 years ago
Eugen Rochko	8c45cd0e36	Improve ActivityPub representations (#3844) ... * Improve webfinger templates and make tests more flexible * Clean up AS2 representation of actor * Refactor outbox * Create activities representation * Add representations of followers/following collections, do not redirect /users/:username route if format is empty * Remove unused translations * ActivityPub endpoint for single statuses, add ActivityPub::TagManager for better URL/URI generation * Add ActivityPub::TagManager#to * Represent all attachments as Document instead of Image/Video specifically (Because for remote ones we may not know for sure) Add mentions and hashtags representation to AP notes * Add AP-resolvable hashtag URIs * Use ActiveModelSerializers for ActivityPub * Clean up unused translations * Separate route for object and activity * Adjust cc/to matrices * Add to/cc to activities, ensure announce activity embeds target status and not the wrapper status, add "id" to all collections	8 years ago
Yamagishi Kazutoshi	0fa9dd8527	Add Rake task for generate VAPID key (#4195) ... * Add Rake task for generate VAPID key * edit config/initializers/vapid.rb	8 years ago
Sorin Davidoi	0c7c188c45	Web Push Notifications (#3243) ... * feat: Register push subscription * feat: Notify when mentioned * feat: Boost, favourite, reply, follow, follow request * feat: Notification interaction * feat: Handle change of public key * feat: Unsubscribe if things go wrong * feat: Do not send normal notifications if push is enabled * feat: Focus client if open * refactor: Move push logic to WebPushSubscription * feat: Better title and body * feat: Localize messages * chore: Fix lint errors * feat: Settings * refactor: Lazy load * fix: Check if push settings exist * feat: Device-based preferences * refactor: Simplify logic * refactor: Pull request feedback * refactor: Pull request feedback * refactor: Create /api/web/push_subscriptions endpoint * feat: Spec PushSubscriptionController * refactor: WebPushSubscription => Web::PushSubscription * feat: Spec Web::PushSubscription * feat: Display first media attachment * feat: Support direction * fix: Stuff broken while rebasing * refactor: Integration with session activations * refactor: Cleanup * refactor: Simplify implementation * feat: Set VAPID keys via environment * chore: Comments * fix: Crash when no alerts * fix: Set VAPID keys in testing environment * fix: Follow link * feat: Notification actions * fix: Delete previous subscription * chore: Temporary logs * refactor: Move migration to a later date * fix: Fetch the correct session activation and misc bugs * refactor: Move migration to a later date * fix: Remove follow request (no notifications) * feat: Send administrator contact to push service * feat: Set time-to-live * fix: Do not show sensitive images * fix: Reducer crash in error handling * feat: Add badge * chore: Fix lint error * fix: Checkbox label overlap * fix: Check for payload support * fix: Rename action "type" (crash in latest Chrome) * feat: Action to expand notification * fix: Lint errors * fix: Unescape notification body * fix: Do not allow boosting if the status is hidden * feat: Add VAPID keys to the production sample environment * fix: Strip HTML tags from status * refactor: Better error messages * refactor: Handle browser not implementing the VAPID protocol (Samsung Internet) * fix: Error when target_status is nil * fix: Handle lack of image * fix: Delete reference to invalid subscriptions * feat: Better error handling * fix: Unescape HTML characters after tags are striped * refactor: Simpify code * fix: Modify to work with #4091 * Sort strings alphabetically * i18n: Updated Polish translation it annoys me that it's not fully localized :P * refactor: Use current_session in PushSubscriptionController * fix: Rebase mistake * fix: Set cacheName to mastodon * refactor: Pull request feedback * refactor: Remove logging statements * chore(yarn): Fix conflicts with master * chore(yarn): Copy latest from master * chore(yarn): Readd offline-plugin * refactor: Use save! and update! * refactor: Send notifications async * fix: Allow retry when push fails * fix: Save track for failed pushes * fix: Minify sw.js * fix: Remove account_id from fabricator	8 years ago
Eugen Rochko	056b5ed72f	Improve UI of admin site settings (#4163)	8 years ago
Eugen Rochko	00df69bc89	Fix #4058 - Use a long-lived cookie to keep track of user-level sessions (#4091) ... * Fix #4058 - Use a long-lived cookie to keep track of user-level sessions * Fix tests, smooth migrate from previous session-based identifier	8 years ago
Yamagishi Kazutoshi	76eda2fc21	Add recursive object support to API response (#4095)	8 years ago
Eugen Rochko	f7301bd5b9	Add overview of active sessions (#3929) ... * Add overview of active sessions * Better display of browser/platform name * Improve how browser information is stored and displayed for sessions overview * Fix test	8 years ago
Sorin Davidoi	2211e8d1cd	Revocable sessions (#3616) ... * feat: Revocable sessions * fix: Tests using sign_in * feat: Configuration entry for the maximum number of session activations	8 years ago
Eugen Rochko	f3be605286	Rename FollowRemoteAccountService to ResolveRemoteAccountService (#3847) ... Rename Activitypub to ActivityPub	8 years ago
Matt Jankowski	2212dc4aaa	Update Rails to version 5.1.1 (#3121) ... * Update rails to version 5.1.1 * Run `rails app:update` * Remove the override of polymorphic activity relationship * Silence warning about otp_secret attribute being unknown to rails * We will only introduce form_with where we want to use remote data	8 years ago
Immae	a94c152fd3	Allow alternate domains for mastodon handlers (#3187)	8 years ago
Clworld	df92f010ad	Set config.cache_store in environments file. (#3219) ... * Set config.cache_store in application.rb * Set config.cache_store in environments. * fix code format.	8 years ago
Eugen Rochko	20c0054460	Adjust REDIS_URL usage in node_redis (#3183) ... Resolves #2780	8 years ago
Eugen Rochko	d78f555254	Improve language filter preferences look (#3184)	8 years ago
beatrix	5c1f70b5c5	namespace redis usage (#2869) ... * add redis-namespace gem * namespace redis usage * refactor redis namespace code to be less intrusive previously : would be prepended to keys when the REDIS_NAMESPACE env var was not set now if it is not set the namespacing functions are not used at all, which should prevent disruptions when instances update. * fix redis namespace variable style in streaming js * remove trailing space * final redis namespace style fix	8 years ago
alpaca-tc	ee3e0a93f4	Fixes unknown mime type (#2822)	8 years ago
Akihiko Odaki	0cdcf32865	Use ws protocol in streaming API base URL (#2606)	8 years ago
alpaca-tc	db92eec876	Localize 'throttled' (#2755)	8 years ago
Eugen Rochko	c997091166	Clean up redis configuration. Allow using REDIS_URL to set advanced (#2732) ... connection options instead of setting REDIS_HOST etc individually Close #1986	8 years ago
Eugen Rochko	f5bf5ebb82	Replace sprockets/browserify with Webpack (#2617) ... * Replace browserify with webpack * Add react-intl-translations-manager * Do not minify in development, add offline-plugin for ServiceWorker background cache updates * Adjust tests and dependencies * Fix production deployments * Fix tests * More optimizations * Improve travis cache for npm stuff * Re-run travis * Add back support for custom.scss as before * Remove offline-plugin and babili * Fix issue with Immutable.List().unshift(...values) not working as expected * Make travis load schema instead of running all migrations in sequence * Fix missing React import in WarningContainer. Optimize rendering performance by using ImmutablePureComponent instead of React.PureComponent. ImmutablePureComponent uses Immutable.is() to compare props. Replace dynamic callback bindings in <UI /> * Add react definitions to places that use JSX * Add Procfile.dev for running rails, webpack and streaming API at the same time	8 years ago
Tristan Mahé	964035b118	allow localhost to bypass the ratelimit (#2554)	8 years ago
yhirano	3d776de2cb	Change permission from 0755 to 0644 (#2536) ... * chmod -x assets.rb * chmod -x assets/fonts * raname extname from jpeg to jpg	8 years ago
Eugen Rochko	88725d6ce8	OEmbed support for PreviewCard (#2337) ... * OEmbed support for PreviewCard * Improve ProviderDiscovery code failure treatment * Do not crawl links if there is a content warning, since those don't display a link card anyway * Reset db schema * Fresh migrate * Fix rubocop style issues Fix #1681 - return existing access token when applicable instead of creating new * Fix test * Extract http client to helper * Improve oembed controller	8 years ago
ばん	5817bae2da	fix can toot whitespace (#2218)	8 years ago
Ash Furrow	66b39ccaed	Removes timestamp from URLs. (#2185)	8 years ago
tmyt	6c83fec971	Make configuarable s3_permissions for paperclip (#2139)	8 years ago
Yamagishi Kazutoshi	8b8e140c71	Change to switch signature version for Amazon S3 (#2124)	8 years ago
Eugen	e09ab2c0bd	Fix #1642, fix #1912 - Dictate content-type file extension (#2078) ... * Fix #1642, fix #1912 - Previous change (#1718) did not modify how original file was saved on upload * Fix for when file is missing	8 years ago
Eugen	ff5baa5349	Add rate limits for logins and sign-ups by IP (5 in 5 minutes) (#2079) ... * Add rate limits for logins and sign-ups by IP (5 in 5 minutes) Should be enough for normal attempts * Add rate limit for forgotten password form as well	8 years ago
Joachim Viide	363de2dffd	Leave out the "Expires" header from S3 uploads (#1886)	8 years ago
Naouak	3d3e32befb	Check for a custom css file to help customization of instances (#1368) ... * User can create a custom.scss to customize their instance without modifying gitted files. * Add documentation for customization. * Forgot the helper file * Fix Style to pass codeclimate * Requests from maintainer.	8 years ago
Patrick Figel	df4ff9a8e1	Add recovery code support for two-factor auth (#1773) ... * Add recovery code support for two-factor auth When users enable two-factor auth, the app now generates ten single-use recovery codes. Users are encouraged to print the codes and store them in a safe place. The two-factor prompt during login now accepts both OTP codes and recovery codes. The two-factor settings UI allows users to regenerated lost recovery codes. Users who have set up two-factor auth prior to this feature being added can use it to generate recovery codes for the first time. Fixes #563 and fixes #987 * Set OTP_SECRET in test enviroment * add missing .html to view file names	8 years ago
Les Orchard	7609593e48	Add REDIS_DB env variable to configure Redis database (#1366)	8 years ago
ThibG	a9529d3b4b	Allow running mastodon on a different domain as the one used for identifying users (#1267) ... * Allow running mastodon on a different domain as the one used for identifying users * Alter documentation of WEB_DOMAIN to make clear it shouldn't be used unless the admin knows what they are doing * Compare to web_domain instead of local_domain when dealing with feeds/API * Correctly identify mentions to local accounts Mentions URLs point to the person's web profile, i.e., the user page served on WEB_DOMAIN.	8 years ago
Valentin Lorentz	5ab0ffc6c8	Custom Paperclip path. (#778) ... * Custom Paperclip path. * Document PAPERCLIP_ROOT. * Add PAPERCLIP_ROOT_URL (and rename PAPERCLIP_ROOT to PAPERCLIP_ROOT_PATH).	8 years ago
Yusuke Abe	169c68a739	Add filename extension to paperclip (#1718)	8 years ago
Matt Jankowski	c44a700252	Quick best practice cleanup of views/helpers (#1546) ... * Remove trailing whitespace * Use query methods instead of explicit .blank? checks	8 years ago
Yann GUERN	a85d4473aa	Avoid user enumeration with devise paranoid mode (#1527)	8 years ago
Matt Jankowski	4ada50985a	Pagination improvements (#1445) ... * Replace will_paginate with kaminari * Use #page instead of #paginate in controllers * Replace will_paginate.page_gap with pagination.truncate in i18n * Customize kaminari views to match prior styles * Set kaminari options to match prior behavior * Replace will_paginate with paginate in views	8 years ago
Matt Jankowski	64dbde0dbf	Version bumps for ruby and misc gems (#1159) ... * Update rspec-rails to version 3.5.2 * Update addressable to version 2.5.1 * Update autoprefixer-rails to version 6.7.7.1 * Update bullet to version 5.5.1 * Update domain_name to version 0.5.20170404 * Update letter_opener_web to version 1.3.1 * Upate redis-rails to version 5.0.2 * Update active_record_query_trace to version 1.5.4 * Update capistrano-rails to version 1.2.3 * Update dotenv-rails to version 2.2.0 * Update pg to version 0.20.0 * Update tilt to version 2.0.7 * Update warden to version 1.2.7 * Update tins to version 1.13.2 * Update terminal-table to version 1.7.3 * Update oj to version 2.18.5 * Update simplecov to version 0.14.1 * Update uglifier to version 3.1.13 * Update hashdiff to version 0.3.2 * Update webmock to version 2.3.2 * Update devise to version 4.2.1 * Use ruby version 2.4.1 * Update sass to version 3.4.23 * Update puma to version 3.8.2 * Update will_paginate to version 3.1.5 * Update font-awesome-rails to version 4.7.0.1 * Update fuubar to version 2.2.0 * Update pry-rails to version 0.3.6 * Update simple-navigation to version 4.0.5 * Update rubocop to version 0.48.1 * Update doorkeeper to version 4.2.5 * Update faker to version 1.7.3 * Update aws-sdk to version 2.9.5 * Update fabrication to version 2.16.1 * Update hamlit-rails to version 0.2.0 * Update http to version 2.2.1 * Update httplog to version 0.99.2 * Update sidekiq to version 4.2.10 * Update rspec-sidekiq to version 3.0.0 * Update pghero to version 1.6.4 * Update rack-cors to version 0.4.1 * Update i18n-tasks to version 0.9.13 * Update ruby-oembed to version 0.12.0 * Update jquery-rails to version 4.3.1 * Update simple_form to version 3.4.0 * Update react-rails to version 1.11.0 * Update aws-sdk to version 2.9.6 * Update sidekiq-unique-jobs to version 5.0.0 * Update uglifier to version 3.2.0	8 years ago
Eugen Rochko	29ffe1cad3	Make sure Rabl is using Oj	8 years ago
Pete Keen	e9a6da6bc7	[#817] Add email whitelist ... This adds the ability to filter user signup with a whitelist instead of or in addition to a blacklist. Fixes #817	8 years ago
Eugen Rochko	5b12624847	Add proper error page for request timeouts	8 years ago
leopku	c46843c65c	🔧 S3 protocol from ENV ... add support for reading S3 protocol from ENV also add S3_HOSTNAME in .env.production.sample	8 years ago
Eugen Rochko	2816b1bf8e	Federate header images, fix open-uri http->https redirection error	8 years ago
Eugen Rochko	02349b3269	Obfuscate filenames better, double rate limits	8 years ago
Eugen Rochko	1fb3e8988b	Revert earlier fix due to new bug reports	8 years ago
Eugen Rochko	ebc01bf0f6	Make the paperclip filename interpolator smarter about the :original style ... If an :original gets converted into another format, it would get saved as original_filename *anyway*, so generating the extension is pointless and yields bad results for when you change the style definition later. This way, old gifs will still have correct URLs	8 years ago
Eugen Rochko	138d21aea8	Update service timeout setting from 15s to 90s	8 years ago
Eugen	9d5fb49cd8	Merge pull request #603 from evanminto/activitypub-account ... Expose ActivityStreams 2.0 representation of accounts	8 years ago
Evan Minto	94e213c6c1	Reuse existing controller and route	8 years ago
Eugen Rochko	ccb8ac8573	Make the streaming API also handle websockets (because trying to get the browser EventSource interface to ... work flawlessly was a nightmare). WARNING: This commit makes the web UI connect to the streaming API instead of ActionCable like before. This means that if you are upgrading, you should set that up beforehand.	8 years ago
Eugen Rochko	f4bc9620a9	Update settings to re-use admin layout, one big navigation tree, improve settings forms	8 years ago
Eugen Rochko	76e970c856	Do not automatically login after password reset, as it would circumvent two-factor auth (if enabled) ... Do not require e-mail address changes to be re-confirmed, it's only trouble for no real benefit	8 years ago
Eugen Rochko	ba192f12e3	Added optional two-factor authentication	8 years ago
Eugen Rochko	f6a5977f0b	Fix key names in statsd	8 years ago
Eugen Rochko	d567f21d4f	Improve StatsD instrumentation	8 years ago
Eugen Rochko	7329fbd8a4	Fix up timeout, improve contrast on "show more", add responsive style ... for extremely wide monitors	8 years ago
Eugen	956da43e19	Fix error	8 years ago
Eugen Rochko	61aee0006e	Override Rack::Request to use the same trusted proxy settings as Rails	8 years ago
Eugen Rochko	f0de621e76	Fix #463 - Fetch and display previews of URLs using OpenGraph tags	8 years ago
Eugen Rochko	306eb6e9c9	Add optional StatsD performance tracking	8 years ago
Effy Elden	ab4f5f5da5	Add Heroku deployment support	8 years ago
Effy Elden	a097dd489b	Change default S3 ACL string used by Paperclip from 'public' (which is invalid) to 'public-read'	8 years ago