mastodon

Commit Graph

Author	SHA1	Message	Date
CSDUMMI	d75a1e5054	Link to the Identity provider's account settings from the account settings (#24100 ) Co-authored-by: Claire <claire.github-309c@sitedethib.com>	2 years ago
Nick Schonning	65669d3c57	Fix more haml-lint Rubocop (#24107 )	2 years ago
Nick Schonning	75131e7bf7	Setup haml-lint CI with todo config (#23524 )	2 years ago
Claire	dd58db64d8	Change email address input to be disabled for logged-in users when requesting a new confirmation e-mail (#23247 ) Fixes #23093	2 years ago
Claire	bbc49f15e0	Add explanation text to log-in page (#20946 )	2 years ago
Rose	4f15fd0ba1	Fix style for hashes (#20518 ) * Fix style for hashes Make the style for hashes consistent. * New style More consistency	2 years ago
Claire	9f4930ec11	Add password autocomplete hints (#20071 ) Fixes #20067 Our password autocomplete hints were “off” but that does not prevent current browsers from trying to autocomplete them anyway, so use `current-password` and `new-password` so they don't put a newly-generated password in a password confirmation prompt, or the old password for a password renewal prompt.	2 years ago
Chris Rose	a70e2cd649	Tag the OTP field with autocomplete for password managers (#19946 ) This is modeled on #19833, and based on the attribute values documented in https://developer.apple.com/documentation/security/password_autofill/enabling_password_autofill_on_an_html_input_element?language=objc	2 years ago
rcombs	e53fc34e9a	Set autocomplete attr for email field on signup page (#19833 ) The email address will be used as the "username" for sign-in purposes, so it's the value that should be stored in password managers. We can inform the password manager of this by setting `autocomplete="email"`. Without this hint, password managers may instead store the `username` field, which isn't valid for sign-in (this happens with iCloud Keychain in Safari, for instance).	2 years ago
Claire	a529d6d93e	Fix invites (#19560 ) Fixes #19507 Fix regression from #19296	2 years ago
Eugen Rochko	93f340a4bf	Remove setting that disables account deletes (#17683 )	2 years ago
Eugen Rochko	679274465b	Add server rules to sign-up flow (#19296 )	2 years ago
Eugen Rochko	6221b36b27	Remove sign-in token authentication, instead send e-mail about new sign-in (#17970 )	3 years ago
Eugen Rochko	392b367835	Fix IDN domains not being rendered correctly in a few left-over places (#17848 )	3 years ago
Claire	14919fe11e	Change old moderation strikes to be displayed in a separate page (#17566 ) * Change old moderation strikes to be displayed in a separate page Fixes #17552 This changes the moderation strikes displayed on `/auth/edit` to be those from the past 3 months, and make all moderation strikes targeting the current user available in `/disputes`. * Add short description of what the strikes page is for * Move link to list of strikes to “Account status” instead of navigation item * Normalize i18n file * Fix layout and styling of strikes link * Revert highlights_on regexp * Reintroduce account status summary - this way, “Account status” is never empty - account status is not necessarily bound to strikes, or recent strikes	3 years ago
Eugen Rochko	564efd0651	Add appeals (#17364 ) * Add appeals * Add ability to reject appeals and ability to browse pending appeals in admin UI * Add strikes to account page in settings * Various fixes and improvements - Add separate notification setting for appeals, separate from reports - Fix style of links in report/strike header - Change approving an appeal to not restore statuses (due to federation complexities) - Change style of successfully appealed strikes on account settings page - Change account settings page to only show unappealed or recently appealed strikes * Change appealed_at to overruled_at * Fix missing method error	3 years ago
Claire	bddd9ba36d	Add OMNIAUTH_ONLY environment variable to enforce externa log-in (#17288 ) * Remove support for OAUTH_REDIRECT_AT_SIGN_IN Fixes #15959 Introduced in #6540, OAUTH_REDIRECT_AT_SIGN_IN allowed skipping the log-in form to instead redirect to the external OmniAuth login provider. However, it did not prevent the log-in form on /about introduced by #10232 from appearing, and completely broke with the introduction of #15228. As I restoring that previous log-in flow without introducing a security vulnerability may require extensive care and knowledge of how OmniAuth works, this commit removes support for OAUTH_REDIRECT_AT_SIGN_IN instead for the time being. * Add OMNIAUTH_ONLY environment variable to enforce external log-in only * Disable user registration when OMNIAUTH_ONLY is set to true * Replace log-in links When OMNIAUTH_ONLY is set with exactly one OmniAuth provider	3 years ago
Eugen Rochko	d174d12c83	Add authentication history (#16408 )	4 years ago
ThibG	47e507fa61	Add ability to require invite request text (#15326 ) Fixes #15273 Co-authored-by: Claire <claire.github-309c@sitedethib.com>	4 years ago
ThibG	49eb4d4ddf	Add honeypot fields and minimum fill-out time for sign-up form (#15276 ) * Add honeypot fields to limit non-specialized spam Add two honeypot fields: a fake website input and a fake password confirmation one. The label/placeholder/aria-label tells not to fill them, and they are hidden in CSS, so legitimate users should not fall into these. This should cut down on some non-Mastodon-specific spambots. * Require a 3 seconds delay before submitting the registration form * Fix tests * Move registration form time check to model validation * Give people a chance to clear the honeypot fields * Refactor honeypot translation strings Co-authored-by: Claire <claire.github-309c@sitedethib.com>	4 years ago
Eugen Rochko	13b07b88f1	Fix omniauth (SAML/CAS) sign-in routes not having CSRF protection (#15228 )	4 years ago
Eugen Rochko	9b1f2a4b61	Add subresource integrity for JS and CSS assets (#15096 ) Fix #2744	4 years ago
Eugen Rochko	4e4b3a0c8e	Refactor settings controllers (#14767 ) - Disallow suspended accounts from revoking sessions and apps - Allow suspended accounts to access exports	5 years ago
santiagorodriguez96	e8d41bc2fe	Add WebAuthn as an alternative 2FA method (#14466 ) * feat: add possibility of adding WebAuthn security keys to use as 2FA This adds a basic UI for enabling WebAuthn 2FA. We did a little refactor to the Settings page for editing the 2FA methods – now it will list the methods that are available to the user (TOTP and WebAuthn) and from there they'll be able to add or remove any of them. Also, it's worth mentioning that for enabling WebAuthn it's required to have TOTP enabled, so the first time that you go to the 2FA Settings page, you'll be asked to set it up. This work was inspired by the one donde by Github in their platform, and despite it could be approached in different ways, we decided to go with this one given that we feel that this gives a great UX. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add request for WebAuthn as second factor at login if enabled This commits adds the feature for using WebAuthn as a second factor for login when enabled. If users have WebAuthn enabled, now a page requesting for the use of a WebAuthn credential for log in will appear, although a link redirecting to the old page for logging in using a two-factor code will also be present. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add possibility of deleting WebAuthn Credentials Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: disable WebAuthn when an Admin disables 2FA for a user Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: remove ability to disable TOTP leaving only WebAuthn as 2FA Following examples form other platforms like Github, we decided to make Webauthn 2FA secondary to 2FA with TOTP, so that we removed the possibility of removing TOTP authentication only, leaving users with just WEbAuthn as 2FA. Instead, users will have to click on 'Disable 2FA' in order to remove second factor auth. The reason for WebAuthn being secondary to TOPT is that in that way, users will still be able to log in using their code from their phone's application if they don't have their security keys with them – or maybe even lost them. * We had to change a little the flow for setting up TOTP, given that now it's possible to setting up again if you already had TOTP, in order to let users modify their authenticator app – given that now it's not possible for them to disable TOTP and set it up again with another authenticator app. So, basically, now instead of storing the new `otp_secret` in the user, we store it in the session until the process of set up is finished. This was because, as it was before, when users clicked on 'Edit' in the new two-factor methods lists page, but then went back without finishing the flow, their `otp_secret` had been changed therefore invalidating their previous authenticator app, making them unable to log in again using TOTP. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * refactor: fix eslint errors The PR build was failing given that linting returning some errors. This commit attempts to fix them. * refactor: normalize i18n translations The build was failing given that i18n translations files were not normalized. This commits fixes that. * refactor: avoid having the webauthn gem locked to a specific version * refactor: use symbols for routes without '/' * refactor: avoid sending webauthn disabled email when 2FA is disabled When an admins disable 2FA for users, we were sending two mails to them, one notifying that 2FA was disabled and the other to notify that WebAuthn was disabled. As the second one is redundant since the first email includes it, we can remove it and send just one email to users. * refactor: avoid creating new env variable for webauthn_origin config * refactor: improve flash error messages for webauthn pages Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>	5 years ago
ThibG	62a45ae26e	Fix client-side form validation not accepting handles with uppercase letters (#14599 )	5 years ago
ThibG	7dc4c74265	Add client-side validation in password change forms (#14564 ) * Fix client-side username validation at registration It used the Account::USERNAME_RE regexp which is for remote users, local user validation is stricter. Also take into account max username length. * Add client-side form validation for password change * Add client-side form validation to dedicated registration form Previous changes only applied to the /about page, not the dedicated form on /auth	5 years ago
Eugen Rochko	72a7cfaa39	Add e-mail-based sign in challenge for users with disabled 2FA (#14013 )	5 years ago
ThibG	0e362b7678	Fix end-user-facing uses of inline CSS (#13438 ) * Move some inline styles to CSS files * Move default_account_display_name span to fix useless tags with duplicate id * Change handling of public pages spoiler text from inline CSS to dataset attribute * Use the `dir` HTML attribute instead of inline CSS * Move status action bar inline CSS to CSS file * Hide logo resources from CSS file, not inline CSS Fixes #11601 * Move translation prompt styling from inline CSS to CSS file * Move “invited by” styling on registration form from inline to CSS file * Use the progress tag to display poll results in JS fallback * Fix poll results JS-less fallback when the user has voted for an option * Change account public page “moved” notice to use img tags instead of inline CSS * Move OTP hint inline CSS to SCSS file * Hide JS-less fallback vote progressbars from accessibility tools Co-authored-by: Eugen Rochko <eugen@zeonfederated.com>	5 years ago
ThibG	cb28f61a6c	Fix invite request input not being shown on sign-up error if left empty (#13089 ) If the “Why do you want to join?” textarea is left empty and the entered params do not validate, the textarea isn't shown again, unlike other fields. This commit fixes that by populating an empty `UserInviteRequest` when needed.	5 years ago
Eugen Rochko	163ed91af3	Add (back) option to set redirect notice on account without moving followers (#11994 ) Fix #11913	6 years ago
Eugen Rochko	3ed94dcc1a	Add account migration UI (#11846 ) Fix #10736 - Change data export to be available for non-functional accounts - Change non-functional accounts to include redirecting accounts	6 years ago
Eugen Rochko	e1066cd431	Add password challenge to 2FA settings, e-mail notifications (#11878 ) Fix #3961	6 years ago
Eugen Rochko	43f56f1291	Change account deletion page to have better explanations (#11753 ) Fix deletion of unconfirmed account not freeing up the username Add prefill of logged-in user's email in the reconfirmation form	6 years ago
Eugen Rochko	3221f998dd	Change OpenGraph description on sign-up page to reflect invite (#11744 )	6 years ago
Eugen Rochko	24552b5160	Add whitelist mode (#11291 )	6 years ago
Eugen Rochko	964ae8eee5	Change unconfirmed user login behaviour (#11375 ) Allow access to account settings, 2FA, authorized applications, and account deletions to unconfirmed and pending users, as well as users who had their accounts disabled. Suspended users cannot update their e-mail or password or delete their account. Display account status on account settings page, for example, when an account is frozen, limited, unconfirmed or pending review. After sign up, login users straight away and show a simple page that tells them the status of their account with links to account settings and logout, to reduce onboarding friction and allow users to correct wrongly typed e-mail addresses. Move the final sign-up step of SSO integrations to be the same as above to reduce code duplication.	6 years ago
Eugen Rochko	041fb0e840	Fix sign up button not saying sign up when invite is used (#10623 ) Fix #10616	6 years ago
Eugen Rochko	8b69a66380	Add "why do you want to join" field to invite requests (#10524 ) * Add "why do you want to join" field to invite requests Fix #10512 * Remove unused translations * Fix broken registrations when no invite request text is submitted	6 years ago
Eugen Rochko	51e154f5e8	Admission-based registrations mode (#10250 ) Fix #6856 Fix #6951	6 years ago
mayaeh	bdd3c8c255	Change the password form order (#9267 ) * Change order of password. * Update Japanese translation for "Show thread". * Separate the translation PR.	6 years ago
Eugen Rochko	cc45a8f9f7	Fix td instead of th in sessions table header (#9162 ) Fix #9130	6 years ago
Eugen Rochko	f4d549d300	Redesign forms, verify link ownership with rel="me" (#8703 ) * Verify link ownership with rel="me" * Add explanation about verification to UI * Perform link verifications * Add click-to-copy widget for verification HTML * Redesign edit profile page * Redesign forms * Improve responsive design of settings pages * Restore landing page sign-up form * Fix typo * Support <link> tags, add spec * Fix links not being verified on first discovery and passive updates	7 years ago
Eugen Rochko	69ba8f063c	When registrations closed, link "Sign up" to joinmastodon.org (#8395 ) Fix #8393	7 years ago
Eugen Rochko	bb71538bb5	Redesign public profiles and toots (#8068 )	7 years ago
Eugen Rochko	ca85658975	Add autofollow option to invites (#7805 ) * Add autofollow option to invites * Trigger CodeClimate rebuild	7 years ago
Eugen Rochko	b611dbac79	Add contact e-mail hint to 2FA login form (#7376 )	7 years ago
Sylvhem	cb74c0cfe4	Add headings to the security settings page (#6661 ) * Changes the headings' rank of the security settings section This commit changes the existing headings' rank of the security settings section from level 6 to level 4. * Renames the auth.change_password string into auth.security The "Security" preferences' section used to be called "Change password". When it was renamed, the string name wasn't changed. This commits changes auth.change_password to auth.security. * Adds a heading to the password change form There was previously no heading for the part of the "Security" page that contain the password change form. This commit adds a rank 4 heading to this section and reintroduces an "auth.change_password" string to be used inside it. * Removes useless HR elements The various sections of the "Security" settings page were previously separated by HR elements. Now that there is proper headings, they're not required anymore. * Updates CSS This commit updates CSS in such a way that the same style is applied to all the H4 elements of the settings. * Correct a mistake A character went missing on one of the previous commits, broking the CSS. This new commit fixes it.	7 years ago
Eugen Rochko	b66ec3bf95	Fix #6611 : Typo in change password template (#6616 )	7 years ago
Eugen Rochko	47bdb9b33b	Fix #942 : Seamless LDAP login (#6556 )	7 years ago
ThibG	411c9ecb4b	Fix password recovery (#6459 ) * Fix password recovery * Use “resource” instead of “current_user”	7 years ago

1 2

85 Commits (b9efca65e387cdce66e7786acdd64281fe97272d)