50 Commits (e4e752c26e526d0d29e3fe5e2cf5ca9d915546ef)

Author	SHA1	Message	Date
Matt Jankowski	bcd0171e5e	Fix `Lint/UselessAssignment` cop (#27472)	1 year ago
Claire	94893cf24f	Merge pull request from GHSA-hcqf-fw2r-52g4 ... * Revert "Fix request URL normalisation for bare domain and 8-bit characters (#26285)" This reverts commit 8891d8945d. * Revert "Do not normalize URL before fetching it (#26219)" This reverts commit fd284311e7.	1 year ago
Claire	60b9fa641d	Fix cached posts including stale stats (#26409)	2 years ago
Christian Schmidt	fd284311e7	Do not normalize URL before fetching it (#26219)	2 years ago
Matt Jankowski	f48d345de1	Use correct naming on controller concern specs (#26197)	2 years ago
Matt Jankowski	d2e5430d4a	Fix RSpec/ExpectChange cop (#25101)	2 years ago
Nick Schonning	99e2e9b81f	Fix minor typos in comments and spec names (#21831)	2 years ago
Nick Schonning	da3bd913ae	Autofix Rubocop Style/HashSyntax (#23754)	2 years ago
Matt Jankowski	c97b611b6b	Fix RSpec/InferredSpecType cop (#24736)	2 years ago
Matt Jankowski	710745e16b	Fix RSpec/ContextWording cop (#24739)	2 years ago
Matt Jankowski	3df665fd23	Fix Lint/ConstantDefinitionInBlock cop (#24763)	2 years ago
Nick Schonning	aef0051fd0	Enable Rubocop HTTP status rules (#23717)	2 years ago
Claire	68dcbcb7bf	Add more specific error messages to HTTP signature verification (#21617) ... * Return specific error on failure to parse Date header * Add error message when preferredUsername is not set * Change error report to be JSON and include more details * Change error report to differentiate unknown account and failed refresh * Add tests	2 years ago
Claire	8cf7006d4e	Refactor ActivityPub handling to prepare for non-Account actors (#19212) ... * Move ActivityPub::FetchRemoteAccountService to ActivityPub::FetchRemoteActorService ActivityPub::FetchRemoteAccountService is kept as a wrapper for when the actor is specifically required to be an Account * Refactor SignatureVerification to allow non-Account actors * fixup! Move ActivityPub::FetchRemoteAccountService to ActivityPub::FetchRemoteActorService * Refactor ActivityPub::FetchRemoteKeyService to potentially return non-Account actors * Refactor inbound ActivityPub payload processing to accept non-Account actors * Refactor inbound ActivityPub processing to accept activities relayed through non-Account * Refactor how Account key URIs are built * Refactor Request and drop unused key_id_format parameter * Rename ActivityPub::Dereferencer `signature_account` to `signature_actor`	2 years ago
Eugen Rochko	3917353645	Fix single Redis connection being used across all threads (#18135) ... * Fix single Redis connection being used across all Sidekiq threads * Fix tests	3 years ago
Claire	f5639e1cbe	Change public profile pages to be disabled for unconfirmed users (#17385) ... Fixes #17382 Note that unconfirmed and unapproved accounts can still be searched for and their (empty) account retrieved using the REST API.	3 years ago
Claire	e38fc319dc	Refactor and improve tests (#17386) ... * Change account and user fabricators to simplify and improve tests - `Fabricate(:account)` implicitly fabricates an associated `user` if no `domain` attribute is given (an account with `domain: nil` is considered a local account, but no user record was created), unless `user: nil` is passed - `Fabricate(:account, user: Fabricate(:user))` should still be possible but is discouraged. * Fix and refactor tests - avoid passing unneeded attributes to `Fabricate(:user)` or `Fabricate(:account)` - avoid embedding `Fabricate(:user)` into a `Fabricate(:account)` or the other way around - prefer `Fabricate(:user, account_attributes: …)` to `Fabricate(:user, account: Fabricate(:account, …)` - also, some tests were using remote accounts with local user records, which is not representative of production code.	3 years ago
Claire	5027abecd1	Fix cache_collection crashing when given an empty collection (#15921) ... * Fix cache_collection crashing when given an empty collection * Add tests	4 years ago
Claire	43eff898a0	Prepare Mastodon for Rails 6 (#15911) ... * Fix misuse of foreign_type * Fix use of removed "add_template_helper" * Use response.media_type instead of response.content_type in tests * Fix CSV export controller test on Rails 6 Rails 6 sets a "filename*" field in the Content-Disposition header to explicitly encode the filename as UTF-8. This changes checks the first part of the Content-Disposition header so it matches in both Rails 5 and Rails 6. * Fix emoji formatting with Rails 6 * Make emoji output more idiomatic and robust * Switch from redis-rails gem to built-in Rails redis cache storage	4 years ago
Eugen Rochko	ed099d8bdc	Change account suspensions to be reversible by default (#14726)	5 years ago
ThibG	4bcef12bad	Fix sr locale being selected over sr-Latn (#13693) ... * Fix sr locale being selected over sr-Latn * Update tests	5 years ago
Eugen Rochko	5265df0a8a	Change signature verification to ignore signatures with invalid host (#13033) ... Instead of returning a signature verification error, pretend there was no signature (i.e., this does not allow access to resources that need a valid signature), so public resources can still be fetched Fix #13011	5 years ago
Eugen Rochko	49b2f7c0a2	Fix base64-encoded file uploads not being possible (#12748) ... Fix #3804, Fix #5776	5 years ago
Eugen Rochko	e1066cd431	Add password challenge to 2FA settings, e-mail notifications (#11878) ... Fix #3961	6 years ago
Eugen Rochko	bd1545de5e	Change locale detection to run once per session (#8657) ... Fix #6462	6 years ago
Eugen Rochko	4e8dcc5dbb	Add HTTP signatures to all outgoing ActivityPub GET requests (#11284)	6 years ago
Eugen Rochko	63c7fe8e48	Refactor controllers for statuses, accounts, and more (#11249)	6 years ago
Eugen Rochko	51e154f5e8	Admission-based registrations mode (#10250) ... Fix #6856 Fix #6951	6 years ago
ysksn	dd85700a3e	Add spec for AccountableConcern#log_action (#9559)	6 years ago
Eugen Rochko	21ad21cb50	Improve signature verification safeguards (#8959) ... * Downcase signed_headers string before building the signed string The HTTP Signatures draft does not mandate the “headers” field to be downcased, but mandates the header field names to be downcased in the signed string, which means that prior to this patch, Mastodon could fail to process signatures from some compliant clients. It also means that it would not actually check the Digest of non-compliant clients that wouldn't use a lowercased Digest field name. Thankfully, I don't know of any such client. * Revert "Remove dead code (#8919)" This reverts commit a00ce8c92c. * Restore time window checking, change it to 12 hours By checking the Date header, we can prevent replaying old vulnerable signatures. The focus is to prevent replaying old vulnerable requests from software that has been fixed in the meantime, so a somewhat long window should be fine and accounts for timezone misconfiguration. * Escape users' URLs when formatting them Fixes possible HTML injection * Escape all string interpolations in Formatter class Slightly improve performance by reducing class allocations from repeated Formatter#encode calls * Fix code style issues	6 years ago
aus-social	0a4739c732	lint pass 2 (#8878) ... * Code quality pass * Typofix * Update applications_controller_spec.rb * Update applications_controller_spec.rb	7 years ago
luzpaz	40dd19be37	Misc. typos (#8694) ... Found via `codespell -q 3 --skip="./app/javascript/mastodon/locales,./config/locales"`	7 years ago
S.H	2aeeffc3ec	Update Rails (#8141) ... * Update Rails * fix Update Rails	7 years ago
Yamagishi Kazutoshi	648d645c2f	Fix randomly fail (similar #7219) (#7225)	7 years ago
Yamagishi Kazutoshi	d10447c3a8	Use raw status code on have_http_status (#7214)	7 years ago
Akihiko Odaki	51d760960c	Set the default locale in config (#6580) ... Previously the default locale was set by Localized concern for controllers, but it was not enforced for mailers. config is enforced throughout the application and an appropriate place to set the default locale.	7 years ago
Eugen Rochko	9b3b40df66	Fix regeneration marker not expiring (#6290) ... * Fix regeneration key not getting expired * Add rake task to remove old regeneration markers	7 years ago
Eugen Rochko	7badad7797	Fix home regeneration (#6251) ... * Fix regeneration marker not being removed after completion * Return HTTP 206 from /api/v1/timelines/home if regeneration in progress Prioritize RegenerationWorker by putting it into default queue * Display loading indicator and poll home timeline while it regenerates * Add graphic to regeneration message * Make "not found" indicator consistent with home regeneration	7 years ago
Eugen Rochko	a865b62efc	Rate limit by user instead of IP when API user is authenticated (#5923) ... * Fix #668 - Rate limit by user instead of IP when API user is authenticated * Fix code style issue * Use request decorator provided by Doorkeeper	7 years ago
Eugen Rochko	3283868e28	Improve spec of Feed and UserTrackingConcern (#5367)	7 years ago
Eugen Rochko	a2aeacbfee	Add alternate links to ActivityPub resources from HTML/HEAD variants (#4586)	8 years ago
Eugen Rochko	fdea173237	Add Digest header to requests with body, handle acct and URI keyId (#4565)	8 years ago
Eugen Rochko	1618b68bfa	HTTP signatures (#4146) ... * Add Request class with HTTP signature generator Spec: https://tools.ietf.org/html/draft-cavage-http-signatures-06 * Add HTTP signature verification concern * Add test for SignatureVerification concern * Add basic test for Request class * Make PuSH subscribe/unsubscribe requests use new Request class Accidentally fix lease_seconds not being set and sent properly, and change the new minimum subscription duration to 1 day * Make all PuSH workers use new Request class * Make Salmon sender use new Request class * Make FetchLinkService use new Request class * Make FetchAtomService use the new Request class * Make Remotable use the new Request class * Make ResolveRemoteAccountService use the new Request class * Add more tests * Allow +-30 seconds window for signed request to remain valid * Disable time window validation for signed requests, restore 7 days as PuSH subscription duration (which was previous default due to a bug)	8 years ago
unarist	abbdacedc5	Fix locale related specs (#3707) ... * Use I18n.locale instead of ":en" * Reset I18n.locale value after locale changing tests	8 years ago
Akihiko Odaki (@fn_aki@pawoo.net)	4919b89ab8	Improve default language decision and spec (#3351) ... * Improve default language decision This change allows to takes account of accepted language determined by the user agent even if the custom default locale of the instance is configured. * Cover Localized more * Fix code style	8 years ago
Matt Jankowski	f0634ba876	Coverage improvement and concern extraction for rate limit headers in API controller (#3625) ... * Coverage for rate limit headers * Move rate limit headers methods to concern * Move throttle check to condition on before_action * Move match_data variable into method * Move utc timestamp to separate method * Move header setting into smaller methods * specs cleanup	8 years ago
Matt Jankowski	0ebe7d6d23	Remove exports/base controller in favor of shared concern (#3444)	8 years ago
Akihiko Odaki	922fb74197	Remove methods from ObfuscateFilename and spec (#3347) ... * Remove methods from ObfuscateFilename * Spec ObfuscateFilename	8 years ago
Akihiko Odaki	11e5c965c3	Spec AccountControllerConcern (#3349)	8 years ago
Matt Jankowski	fdcf884cf7	Extract user tracking into concern (#2600)	8 years ago