You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Claire 6da135a493 Fix reviving revoked sessions and invalidating login (#16943) ... Up until now, we have used Devise's Rememberable mechanism to re-log users after the end of their browser sessions. This mechanism relies on a signed cookie containing a token. That token was stored on the user's record, meaning it was shared across all logged in browsers, meaning truly revoking a browser's ability to auto-log-in involves revoking the token itself, and revoking access from *all* logged-in browsers. We had a session mechanism that dynamically checks whether a user's session has been disabled, and would log out the user if so. However, this would only clear a session being actively used, and a new one could be respawned with the `remember_user_token` cookie. In practice, this caused two issues: - sessions could be revived after being closed from /auth/edit (security issue) - auto-log-in would be disabled for *all* browsers after logging out from one of them This PR removes the `remember_token` mechanism and treats the `_session_id` cookie/token as a browser-specific `remember_token`, fixing both issues.		3 years ago
..
activitypub	Fix followers synchronization mechanism not working when URI has empty path (#16744)	4 years ago
admin	Fix statuses order in account's statuses admin page (#16937)	3 years ago
api	Add remove from followers api (#16864)	4 years ago
auth	Fix reviving revoked sessions and invalidating login (#16943)	3 years ago
concerns	Fix authentication failures after going halfway through a sign-in attempt (#16607)	4 years ago
oauth	Refactor settings controllers (#14767)	5 years ago
settings	Explicitly set userVerification to discoraged (#16545)	4 years ago
well_known	Fix anonymous access to outbox not being cached by the reverse proxy (#16458)	4 years ago
about_controller.rb	Add server rules (#15769)	4 years ago
account_follow_controller.rb	Add specific rate limits for posting and following (#13172)	5 years ago
account_unfollow_controller.rb	…
accounts_controller.rb	Further improve the media attached status query for accounts (#16106)	4 years ago
application_controller.rb	Add logging of S3-related errors (#16381)	4 years ago
authorize_interactions_controller.rb	Add specific rate limits for posting and following (#13172)	5 years ago
custom_css_controller.rb	Remove set-cookie header on custom.css (#16314)	4 years ago
directories_controller.rb	Change trending hashtags to be affected be reblogs (#16164)	4 years ago
emojis_controller.rb	…
filters_controller.rb	Sort filters by “keyword or phrase” in Settings (#15050)	4 years ago
follower_accounts_controller.rb	Fix serialization of followers/following counts when user hides their network (#16418)	4 years ago
following_accounts_controller.rb	Fix serialization of followers/following counts when user hides their network (#16418)	4 years ago
health_controller.rb	Change health check (#15988)	4 years ago
home_controller.rb	Change routing paths to use usernames in web UI (#16171)	4 years ago
instance_actors_controller.rb	Create instance actor if it hasn't been properly seeded (#15693)	4 years ago
intents_controller.rb	…
invites_controller.rb	…
manifests_controller.rb	Fix redirecting non-functional accounts on public pages (#11978)	6 years ago
media_controller.rb	Fix error when rendering public pages with media attachments (#16763)	4 years ago
media_proxy_controller.rb	Fix media proxy RedisLocks auto-releasing too fast (#16291)	4 years ago
public_timelines_controller.rb	…
relationships_controller.rb	Add interrelationship icon (#15149)	4 years ago
remote_follow_controller.rb	Fix redirecting non-functional accounts on public pages (#11978)	6 years ago
remote_interaction_controller.rb	Fix functional user requirements in whitelist mode (#14093)	5 years ago
shares_controller.rb	…
statuses_cleanup_controller.rb	Add feature to automatically delete old toots (#16529)	4 years ago
statuses_controller.rb	Fix error when trying to render component for media without meta (#16112)	4 years ago
tags_controller.rb	Refactor how public and tag timelines are queried (#14728)	5 years ago