59 Commits (e4f8679eaeea062e1f9ca9f58703b51ff8162c35)

Author	SHA1	Message	Date
Thibaut Girka	de5cc20dd8	Merge branch 'master' into glitch-soc/merge-upstream ... Conflicts: - `app/controllers/concerns/sign_in_token_authentication_concern.rb`: Conflict caused because of glitch-soc's theming system. Took upstream's new code and applied the theming system changes on top of it. - `app/controllers/concerns/two_factor_authentication_concern.rb`: Conflict caused because of glitch-soc's theming system. Took upstream's new code and applied the theming system changes on top of it.	5 years ago
Eugen Rochko	8532429af7	Fix 2FA/sign-in token sessions being valid after password change (#14802) ... If someone tries logging in to an account and is prompted for a 2FA code or sign-in token, even if the account's password or e-mail is updated in the meantime, the session will show the prompt and allow the login process to complete with a valid 2FA code or sign-in token	5 years ago
Thibaut Girka	8c3c27bf06	Merge branch 'master' into glitch-soc/merge-upstream ... Conflicts: - `app/controllers/accounts_controller.rb`: Upstream change too close to a glitch-soc change related to instance-local toots. Merged upstream changes. - `app/services/fan_out_on_write_service.rb`: Minor conflict due to glitch-soc's handling of Direct Messages, merged upstream changes. - `yarn.lock`: Not really a conflict, caused by glitch-soc-only dependencies being textually too close to updated upstream dependencies. Merged upstream changes.	5 years ago
santiagorodriguez96	e8d41bc2fe	Add WebAuthn as an alternative 2FA method (#14466) ... * feat: add possibility of adding WebAuthn security keys to use as 2FA This adds a basic UI for enabling WebAuthn 2FA. We did a little refactor to the Settings page for editing the 2FA methods – now it will list the methods that are available to the user (TOTP and WebAuthn) and from there they'll be able to add or remove any of them. Also, it's worth mentioning that for enabling WebAuthn it's required to have TOTP enabled, so the first time that you go to the 2FA Settings page, you'll be asked to set it up. This work was inspired by the one donde by Github in their platform, and despite it could be approached in different ways, we decided to go with this one given that we feel that this gives a great UX. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add request for WebAuthn as second factor at login if enabled This commits adds the feature for using WebAuthn as a second factor for login when enabled. If users have WebAuthn enabled, now a page requesting for the use of a WebAuthn credential for log in will appear, although a link redirecting to the old page for logging in using a two-factor code will also be present. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add possibility of deleting WebAuthn Credentials Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: disable WebAuthn when an Admin disables 2FA for a user Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: remove ability to disable TOTP leaving only WebAuthn as 2FA Following examples form other platforms like Github, we decided to make Webauthn 2FA secondary to 2FA with TOTP, so that we removed the possibility of removing TOTP authentication only, leaving users with just WEbAuthn as 2FA. Instead, users will have to click on 'Disable 2FA' in order to remove second factor auth. The reason for WebAuthn being secondary to TOPT is that in that way, users will still be able to log in using their code from their phone's application if they don't have their security keys with them – or maybe even lost them. * We had to change a little the flow for setting up TOTP, given that now it's possible to setting up again if you already had TOTP, in order to let users modify their authenticator app – given that now it's not possible for them to disable TOTP and set it up again with another authenticator app. So, basically, now instead of storing the new `otp_secret` in the user, we store it in the session until the process of set up is finished. This was because, as it was before, when users clicked on 'Edit' in the new two-factor methods lists page, but then went back without finishing the flow, their `otp_secret` had been changed therefore invalidating their previous authenticator app, making them unable to log in again using TOTP. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * refactor: fix eslint errors The PR build was failing given that linting returning some errors. This commit attempts to fix them. * refactor: normalize i18n translations The build was failing given that i18n translations files were not normalized. This commits fixes that. * refactor: avoid having the webauthn gem locked to a specific version * refactor: use symbols for routes without '/' * refactor: avoid sending webauthn disabled email when 2FA is disabled When an admins disable 2FA for users, we were sending two mails to them, one notifying that 2FA was disabled and the other to notify that WebAuthn was disabled. As the second one is redundant since the first email includes it, we can remove it and send just one email to users. * refactor: avoid creating new env variable for webauthn_origin config * refactor: improve flash error messages for webauthn pages Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>	5 years ago
Thibaut Girka	3f60b096b5	Merge branch 'master' into glitch-soc/merge-upstream ... Conflicts: - `config/routes.rb`: Upstream disabled E2EE routes, which we did earlier, but slightly differently. Took upstream's version.	5 years ago
abcang	6a96af4d20	Fix rubocop warning (#14288) ... * Fix rubocop warning * use limit variable * use ContextCreatingMethods option	5 years ago
Thibaut Girka	12c8ac9e14	Merge branch 'master' into glitch-soc/merge-upstream ... Conflicts: - `app/controllers/activitypub/collections_controller.rb`: Conflict due to glitch-soc having to take care of local-only pinned toots in that controller. Took upstream's changes and restored the local-only special handling. - `app/controllers/auth/sessions_controller.rb`: Minor conflicts due to the theming system, applied upstream changes, adapted the following two files for glitch-soc's theming system: - `app/controllers/concerns/sign_in_token_authentication_concern.rb` - `app/controllers/concerns/two_factor_authentication_concern.rb` - `app/services/backup_service.rb`: Minor conflict due to glitch-soc having to handle local-only toots specially. Applied upstream changes and restored the local-only special handling. - `app/views/admin/custom_emojis/index.html.haml`: Minor conflict due to the theming system. - `package.json`: Upstream dependency updated, too close to a glitch-soc-only dependency in the file. - `yarn.lock`: Upstream dependency updated, too close to a glitch-soc-only dependency in the file.	5 years ago
Eugen Rochko	72a7cfaa39	Add e-mail-based sign in challenge for users with disabled 2FA (#14013)	5 years ago
Thibaut Girka	4a70792b4a	Merge branch 'master' into glitch-soc/merge-upstream ... Conflicts: - `Gemfile.lock`: Not a real conflict, just a glitch-soc-only dependency too close to a dependency that got updated upstream. Updated as well. - `app/models/status.rb`: Not a real conflict, just a change too close to glitch-soc-changed code for optionally showing boosts in public timelines. Applied upstream changes. - `app/views/layouts/application.html.haml`: Upstream a new, static CSS file, conflict due to glitch-soc's theming system, include the file regardless of the theme. - `config/initializers/content_security_policy.rb`: Upstream dropped 'unsafe-inline' from the 'style-src' directive, but both files are very different. Removed 'unsafe-inline' as well.	5 years ago
ThibG	45202f79ef	Remove confusing “You are already signed in.” flash message (#13547) ... When attempting to access the log-in page while already logged in, Devise's `require_no_authentication` kicks in and sets a flash message “You are already signed in.” In almost all cases, this also causes a redirect to /web, which does not display or clear flash messages, thus leaving the message to a potentially much later date, like for instance, accessing /preferences several minutes after being redirected to /web.	5 years ago
Thibaut Girka	bc0399d54d	Ensure pack is set when rendering OTP prompt ... Fixes #1230	6 years ago
Thibaut Girka	16ff7c5627	Merge branch 'master' into glitch-soc/merge-upstream ... Conflicts: - Gemfile - Gemfile.lock - app/controllers/about_controller.rb - app/controllers/auth/sessions_controller.rb	6 years ago
Eugen Rochko	a1f04c1e34	Fix authentication before 2FA challenge (#11943) ... Regression from #11831	6 years ago
Thibaut Girka	5cadb47238	Merge branch 'master' into glitch-soc/merge-upstream ... Conflicts: - app/controllers/auth/sessions_controller.rb Minor conflict due to glitch-soc's theming code	6 years ago
Eugen Rochko	e1066cd431	Add password challenge to 2FA settings, e-mail notifications (#11878) ... Fix #3961	6 years ago
Eugen Rochko	c707ef49d9	Fix 2FA challenge and password challenge for non-database users (#11831) ... * Fix 2FA challenge not appearing for non-database users Fix #11685 * Fix account deletion not working when using external login Fix #11691	6 years ago
Thibaut Girka	444796b69b	Merge branch 'master' into glitch-soc/merge-upstream ... Conflicts: - app/controllers/application_controller.rb - app/controllers/auth/confirmations_controller.rb - app/controllers/auth/sessions_controller.rb - app/controllers/settings/deletes_controller.rb - app/controllers/settings/two_factor_authentication/recovery_codes_controller.rb	6 years ago
Eugen Rochko	964ae8eee5	Change unconfirmed user login behaviour (#11375) ... Allow access to account settings, 2FA, authorized applications, and account deletions to unconfirmed and pending users, as well as users who had their accounts disabled. Suspended users cannot update their e-mail or password or delete their account. Display account status on account settings page, for example, when an account is frozen, limited, unconfirmed or pending review. After sign up, login users straight away and show a simple page that tells them the status of their account with links to account settings and logout, to reduce onboarding friction and allow users to correct wrongly typed e-mail addresses. Move the final sign-up step of SSO integrations to be the same as above to reduce code duplication.	6 years ago
Thibaut Girka	1c448d6474	Merge branch 'master' into glitch-soc/merge-upstream ... Conflicts: - app/controllers/auth/sessions_controller.rb Upstream reverted something we partially reverted already. Reverted the rest to match upstream.	7 years ago
Eugen Rochko	5c8e7f0e1d	Revert "feat(auth/session_controller): Send Clear-Site-Data when logging out (8627)" (#9161) ... This reverts commit 10680f93e7.	7 years ago
Thibaut Girka	91bef4759f	Merge branch 'master' into glitch-soc/merge-upstream ... Conflicts: Vagrantfile app/javascript/packs/public.js app/views/admin/settings/edit.html.haml app/views/settings/preferences/show.html.haml app/views/settings/profiles/show.html.haml config/locales/es.yml config/locales/simple_form.en.yml config/webpack/configuration.js config/webpack/loaders/babel.js package.json yarn.lock Split new additions to app/javascript/packs/public.js to app/javascript/core/settings.js	7 years ago
luzpaz	40dd19be37	Misc. typos (#8694) ... Found via `codespell -q 3 --skip="./app/javascript/mastodon/locales,./config/locales"`	7 years ago
Thibaut Girka	f1214f00d9	Do not clear local storage on log out	7 years ago
Thibaut Girka	cd99255698	Merge branch 'master' into glitch-soc/merge-upstream ... Conflicts: app/controllers/oauth/authorizations_controller.rb Just two changes being too close to one another. Took both.	7 years ago
Eugen Rochko	2288d50a7b	Add force_login option to OAuth authorize page (#8655) ... * Add force_login option to OAuth authorize page For when a user needs to sign into an app from multiple accounts on the same server * When logging out from modal header, redirect back after re-login	7 years ago
Sorin Davidoi	10680f93e7	feat(auth/session_controller): Send Clear-Site-Data when logging out (#8627) ... Will clear the browser's cache, cookies and storage. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data https://w3c.github.io/webappsec-clear-site-data/	7 years ago
Thibaut Girka	246c313d45	Merge branch 'master' into glitch-soc/merge-upstream ... Conflicts: app/controllers/application_controller.rb Changed instance theme selection by instance flavour selection.	7 years ago
Eugen Rochko	2f34b747b3	Allow mods to disable login, improve message when login disabled (#8329) ... * Allow moderators to disable/enable login * Instead of rejecting login, show forbidden error when login disabled Avoid confusion because when login is rejected, the message is that the account is not activated, which is wrong. * Fix tests	7 years ago
Thibaut Girka	c1c514ca70	Merge branch 'master' into glitch-soc/merge-upstream ... Manually-resolved conflicts: .circleci/config.yml app/controllers/accounts_controller.rb app/controllers/auth/passwords_controller.rb app/controllers/statuses_controller.rb app/javascript/packs/public.js app/models/media_attachment.rb app/views/stream_entries/_content_spoiler.html.haml app/views/stream_entries/_media.html.haml config/locales/en.yml config/locales/ja.yml config/locales/pl.yml lib/mastodon/version.rb Some content from app/javascript/packs/public.js has been split to app/javascript/core/settings.js. Translation strings for glitch-soc's keyword mutes were dropped. Everything else was mostly “take both”.	7 years ago
Eugen Rochko	60df87f6f0	Compensate for scrollbar disappearing when media modal visible (#8100) ... * Compensate for scrollbar disappearing when media modal visible Make auth pages backgrounds lighter * Fix typo	7 years ago
Jenkins	447d7e6127	Merge remote-tracking branch 'tootsuite/master' into glitchsoc/master	7 years ago
Eugen Rochko	a29d409e20	If login redirects to omniauth, redirect logout to root_path (#6694) ... Fix #6670	7 years ago
David Yip	1b8fcd4df5	Merge remote-tracking branch 'origin/master' into merge-upstream ... Conflicts: README.md app/controllers/follower_accounts_controller.rb app/controllers/following_accounts_controller.rb app/serializers/rest/instance_serializer.rb app/views/stream_entries/_simple_status.html.haml config/locales/simple_form.ja.yml	7 years ago
Eugen Rochko	47bdb9b33b	Fix #942: Seamless LDAP login (#6556)	7 years ago
imncls	bb6988a7ac	Merge branch 'master' of https://github.com/tootsuite/mastodon ... # Conflicts: # app/controllers/settings/exports_controller.rb # app/models/media_attachment.rb # app/models/status.rb # app/views/about/show.html.haml # docker_entrypoint.sh # spec/views/about/show.html.haml_spec.rb	7 years ago
Ghislain Loaec	e668180044	New variable OAUTH_REDIRECT_AT_SIGN_IN + Ref #6538 (not only SAML strategies) (#6540)	7 years ago
David Yip	4c1fd9a19c	Merge remote-tracking branch 'tootsuite/master' into merge-upstream ... Conflicts: app/javascript/styles/mastodon/components.scss	7 years ago
Alexander	04fef7b888	pam authentication (#5303) ... * add pam support, without extra column * bugfixes for pam login * document options * fix code style * fix codestyle * fix tests * don't call remember_me without password * fix codestyle * improve checks for pam usage (should fix tests) * fix remember_me part 1 * add remember_token column because :rememberable requires either a password or this column. * migrate db for remember_token * move pam_authentication to the right place, fix logic bug in edit.html.haml * fix tests * fix pam authentication, improve username lookup, add comment * valid? is sometimes not honored, return nil instead trying to authenticate with pam * update devise_pam_authenticatable2 and adjust code. Fixes sideeffects observed in tests * update devise_pam_authenticatable gem, fixes for codeconventions, fix finding user * codeconvention fixes * code convention fixes * fix idention * update dependency, explicit conflict check * fix disabled password updates if in pam mode * fix check password if password is present, fix templates * block registration if account is maintained by pam * Revert "block registration if account is maintained by pam" This reverts commit 8e7a083d650240b6fac414926744b4b90b435f20. * fix identation error introduced by rebase * block usernames maintained by pam * document pam settings better * fix code style	7 years ago
David Yip	bf1eb0912c	Set packs on 2FA-related pages. Fixes #271. ... Specifically, this commit: - changes S::TFA::{Confirmations,RecoveryCodes}Controller to derive from S::BaseController, because this gives us the necessary actions and packs - prepends set_pack to Auth::SessionsController's action chain so that it takes effect in time for render :two_factor	8 years ago
kibigo!	bdbbd06dad	Finalized theme loading and stuff	8 years ago
Eugen Rochko	3e90987c8b	Fix some rubocop style issues (#5730)	8 years ago
takayamaki	552d22bec9	sign_in and sign_up views present og meta infos (#5308)	8 years ago
René Klačan	dcf0530218	Make sure email is case insensitive on all places (#3688) ... When case insensitivity is enabled via devise's `config.case_insensitive_keys` then `.find_for_authentication` method needs to be used instead of `.find_by` because second mentioned returns `nil` when valid email with different cases is passed. More info https://github.com/plataformatec/devise/wiki/How-To:-Use-case-insensitive-emails	8 years ago
unarist	ecef03bb15	Fix empty flash message on the settings page (#3345)	8 years ago
Akinori MUSHA	f6a93fc150	Go to root after login in single user mode (#3289) ... In single user mode, visitors are redirected to the single user's profile page. So, if you are the owner without a session, you start from that page, click the login button and authenticate yourself expecting you'll soon get started with the home page, but in reality you'll get redirected back to where you started from -- your own profile page. This fixes the behavior by redirecting you home after login if you have started from your own profile page.	8 years ago
Matt Jankowski	268dd32d76	Auth sign out (#2511) ... * Add a spec for signing out * Add spec showing that suspended user gets a 403 forbidden on sign out * Allow suspended account users to sign out	8 years ago
yhirano	3988f2dade	Fix Rubocop offences (#2630) ... * disable Bundler/OrderedGems * fix rubocop Lint/UselessAssignment * fix rubocop Style/BlockDelimiters * fix rubocop Style/AlignHash * fix rubocop Style/AlignParameters, Style/EachWithObject * fix rubocop Style/SpaceInLambdaLiteral	8 years ago
Matt Jankowski	b48f2cbc8b	Catch error when server decryption fails on 2FA (#2512)	8 years ago
Patrick Figel	df4ff9a8e1	Add recovery code support for two-factor auth (#1773) ... * Add recovery code support for two-factor auth When users enable two-factor auth, the app now generates ten single-use recovery codes. Users are encouraged to print the codes and store them in a safe place. The two-factor prompt during login now accepts both OTP codes and recovery codes. The two-factor settings UI allows users to regenerated lost recovery codes. Users who have set up two-factor auth prior to this feature being added can use it to generate recovery codes for the first time. Fixes #563 and fixes #987 * Set OTP_SECRET in test enviroment * add missing .html to view file names	8 years ago
Eugen Rochko	23b997ae55	Split 2FA login into two prompts	8 years ago