Commit Graph
141 Commits
Author SHA1 Message Date
Matt JankowskiandGitHub d562fb8459 Specs for minimal CSP policy in Api:: controllers (#27845) 2023-11-14 14:34:30 +00:00
Ricardo TrindadeandGitHub 33f8c1c5eb Remove version check from update cache_concern.rb (#27592) 2023-10-30 14:04:12 +00:00
ClaireandGitHub 379115e601 Add SELF_DESTRUCT env variable to process self-destructions in the background (#26439) 2023-10-23 15:46:21 +00:00
Matt JankowskiandGitHub d4c2dca874 Fix haml-lint InstanceVariables rule for auth/sessions/two_factor/o… (#27372) 2023-10-12 09:44:20 +02:00
ClaireandGitHub 40ba6e119b Fix Vary headers not being set on some redirects (#27272) 2023-10-05 09:50:08 +02:00
Matt JankowskiandGitHub 340f1a68be Simplify instance presenter view access (#26046) 2023-09-28 16:52:37 +02:00
CSDUMMIandGitHub 9a70cac9de Fix #26849 by adding the domain of the current SSO provider to the form-action CSP (#26857) 2023-09-12 13:04:51 +02:00
ClaireandGitHub 09ec9c6aa5 Downgrade signature verification debug logging from warn to debug (#26812) 2023-09-06 12:17:22 +02:00
ClaireandGitHub 25bf640629 Add debug logging on signature verification failure (#26637) 2023-08-29 10:29:07 +02:00
ClaireandGitHub 8b37dd2c86 Fix Content Security Policy sometimes unnecessarily allowing hCaptcha scripts (#26388) 2023-08-08 15:41:38 +02:00
CSDUMMIandGitHub 120f5802c0 Add direct link to the Single-Sign On provider if there is only one sign up method available (#26083) 2023-08-03 16:43:15 +02:00
Emelia SmithandGitHub e258b4cb64 Refactor: replace whitelist_mode mentions with limited_federation_mode (#26252) 2023-08-02 19:32:48 +02:00
Matt JankowskiandGitHub 2e1391fdd2 Fix Naming/MemoizedInstanceVariableName cop (#25928) 2023-07-12 10:08:51 +02:00
Matt JankowskiandGitHub 5134fc65e2 Fix Naming/AccessorMethodName cop (#25924) 2023-07-12 10:03:19 +02:00
Eugen RochkoandGitHub 39110d1d0a Fix CAPTCHA page not following design pattern of sign-up flow (#25395) 2023-06-13 22:30:40 +02:00
ClaireandGitHub bec6a1cad4 Add hCaptcha support (#25019) 2023-05-16 23:27:35 +02:00
Nick SchonningandGitHub d5a185d721 Autofix Rubocop Style/CaseLikeIf (#23756) 2023-05-04 05:51:18 +02:00
Matt JankowskiandGitHub 668a19a2f3 Fix Performance/DeletePrefix cop (#24796) 2023-05-02 21:07:45 +02:00
ClaireandGitHub b0bf6216e6 Fix /api/v1/instance/domain_blocks being unconditionally cached (#24662) 2023-04-26 11:42:47 +02:00
ClaireandGitHub 276c39361b Fix anonymous visitors getting a session cookie on first visit (#24584) 2023-04-25 16:51:38 +02:00
Eugen RochkoandGitHub 6084461cd0 Change unauthenticated responses to be cached in REST API (#24348) 2023-04-25 15:41:34 +02:00
ClaireandGitHub 58a1b2e330 Fix caching logic with regards to Accept-Language, Cookie, and Signature (#24604) 2023-04-23 22:27:24 +02:00
Eugen RochkoandGitHub e98c86050a Refactor Cache-Control and Vary definitions (#24347) 2023-04-19 16:07:29 +02:00
Matt JankowskiandGitHub 0663803348 Move link header setting to after_action (#24251) 2023-03-26 00:40:01 +01:00
ClaireandGitHub 2626097869 Fix Rails cache namespace being overriden with v2 for cached statuses (#24202) 2023-03-22 15:47:44 +01:00
160f38f03d Workaround the ActiveRecord / Marshal serialization bug on Ruby 3.2 (#24142)
Co-authored-by: Jean Boussier <[email protected]>
2023-03-17 14:37:30 +01:00
Nick SchonningandGitHub 25d36b6edd Autofix Rubocop Style/RedundantArgument (#23798) 2023-03-16 10:34:00 +09:00
Nick SchonningandGitHub 717683d1c3 Autofix Rubocop remaining Layout rules (#23679) 2023-02-20 06:58:28 +01:00
Nick SchonningandGitHub aef0051fd0 Enable Rubocop HTTP status rules (#23717) 2023-02-20 11:16:40 +09:00
Nick SchonningandGitHub 2177daeae9 Autofix Rubocop Style/RedundantBegin (#23703) 2023-02-19 07:09:40 +09:00
Nick SchonningandGitHub a6f77aa28a Autofix Rubocop Lint/AmbiguousOperatorPrecedence (#23681) 2023-02-18 04:30:23 +01:00
Nick SchonningandGitHub 2e652aa81c Apply Rubocop Performance/RedundantSplitRegexpArgument (#23443)
* Apply Rubocop Performance/RedundantSplitRegexpArgument

* Update app/controllers/concerns/signature_verification.rb
2023-02-08 02:25:20 +01:00
ClaireandGitHub 68dcbcb7bf Add more specific error messages to HTTP signature verification (#21617)
* Return specific error on failure to parse Date header

* Add error message when preferredUsername is not set

* Change error report to be JSON and include more details

* Change error report to differentiate unknown account and failed refresh

* Add tests
2023-01-18 16:47:56 +01:00
ClaireandGitHub fcc4c9b34a Change domain block CSV parsing to be more robust and handle more lists (#21470)
* Change domain block CSV parsing to be more robust and handle more lists

* Add some tests

* Improve domain block import validation and reporting
2023-01-18 16:20:52 +01:00
ClaireandGitHub aefefc74c4 Change referrer-policy to no-referrer application-wide (#23014) 2023-01-10 05:18:43 +01:00
ClaireandGitHub 42f9693d00 Fix PermalinkRedirector not applying to users with moved accounts (#22497)
Fixes #22262
2023-01-05 13:40:27 +01:00
1b5d207131 Fix single name variables on controller folder (#20092)
Co-authored-by: petrokoriakin1 <[email protected]>

Co-authored-by: petrokoriakin1 <[email protected]>
Co-authored-by: Effy Elden <[email protected]>
2022-12-15 17:11:58 +01:00
c373148b3d Support for import/export of instance-level domain blocks/allows for 4.x w/ additional fixes (#20597)
* Allow import/export of instance-level domain blocks/allows (#1754)

* Allow import/export of instance-level domain blocks/allows.
Fixes #15095

* Pacify circleci

* Address simple code review feedback

* Add headers to exported CSV

* Extract common import/export functionality to
AdminExportControllerConcern

* Add additional fields to instance-blocked domain export

* Address review feedback

* Split instance domain block/allow import/export into separate pages/controllers

* Address code review feedback

* Pacify DeepSource

* Work around Paperclip::HasAttachmentFile for Rails 6

* Fix deprecated API warning in export tests

* Remove after_commit workaround

(cherry picked from commit 94e98864e39c010635e839fea984f2b4893bef1a)

* Add confirmation page when importing blocked domains (#1773)

* Move glitch-soc-specific strings to glitch-soc-specific locale files

* Add confirmation page when importing blocked domains

(cherry picked from commit b91196f4b73fff91997b8077619ae25b6d04a59e)

* Fix authorization check in domain blocks controller

(cherry picked from commit 75279377583c6e2aa04cc8d7380c593979630b38)

* Fix error strings for domain blocks and email-domain blocks

Corrected issue with non-error message used for Mastodon:NotPermittedError in Domain Blocks
Corrected issue Domain Blocks using the Email Domain Blocks message on ActionContoller::ParameterMissing
Corrected issue with Email Domain Blocks using the not_permitted string from "custom emojii's"

* Ran i18n-tasks normalize to address test failure

* Removed unused admin.export_domain_blocks.not_permitted string

Removing unused string as indicated by Check i18n

* Fix tests

(cherry picked from commit 9094c2f52c24e1c00b594e7c11cd00e4a07eb431)

* Fix domain block export not exporting blocks with only media rejection

(cherry picked from commit 26ff48ee48a5c03a2a4b0bd03fd322529e6bd960)

* Fix various issues with domain block import

- stop using Paperclip for processing domain allow/block imports
- stop leaving temporary files
- better error handling
- assume CSV files are UTF-8-encoded

(cherry picked from commit cad824d8f501b95377e4f0a957e5a00d517a1902)

Co-authored-by: Levi Bard <[email protected]>
Co-authored-by: Claire <[email protected]>
2022-11-17 11:05:09 +01:00
ClaireandGitHub 86f6631d28 Remove dead code and refactor status threading code (#20357)
* Remove dead code

* Remove unneeded/broken parameters and refactor descendant computation
2022-11-10 22:30:00 +01:00
Eugen RochkoandGitHub 839f893168 Change public accounts pages to mount the web UI (#19319)
* Change public accounts pages to mount the web UI

* Fix handling of remote usernames in routes

- When logged in, serve web app
- When logged out, redirect to permalink
- Fix `app-body` class not being set sometimes due to name conflict

* Fix missing `multiColumn` prop

* Fix failing test

* Use `discoverable` attribute to control indexing directives

* Fix `<ColumnLoading />` not using `multiColumn`

* Add `noindex` to accounts in REST API

* Change noindex directive to not be rendered by default before a route is mounted

* Add loading indicator for detailed status in web UI

* Fix missing indicator appearing while account is loading in web UI
2022-10-20 14:35:29 +02:00
Eugen RochkoandGitHub 62782babd0 Change public statuses pages to mount the web UI (#19301) 2022-10-06 02:26:34 +02:00
ClaireandGitHub 8cf7006d4e Refactor ActivityPub handling to prepare for non-Account actors (#19212)
* Move ActivityPub::FetchRemoteAccountService to ActivityPub::FetchRemoteActorService

ActivityPub::FetchRemoteAccountService is kept as a wrapper for when the actor is
specifically required to be an Account

* Refactor SignatureVerification to allow non-Account actors

* fixup! Move ActivityPub::FetchRemoteAccountService to ActivityPub::FetchRemoteActorService

* Refactor ActivityPub::FetchRemoteKeyService to potentially return non-Account actors

* Refactor inbound ActivityPub payload processing to accept non-Account actors

* Refactor inbound ActivityPub processing to accept activities relayed through non-Account

* Refactor how Account key URIs are built

* Refactor Request and drop unused key_id_format parameter

* Rename ActivityPub::Dereferencer `signature_account` to `signature_actor`
2022-09-21 22:45:57 +02:00
ClaireandGitHub 84aff598ea Fix typo in SignatureVerification (#19209)
Fix regression from #15605
2022-09-21 14:48:35 +02:00
ClaireandGitHub 1145dbd327 Improve error reporting and logging when processing remote accounts (#15605)
* Add a more descriptive PrivateNetworkAddressError exception class

* Remove unnecessary exception class to rescue clause

* Remove unnecessary include to JsonLdHelper

* Give more neutral error message when too many webfinger redirects

* Remove unnecessary guard condition

* Rework how “ActivityPub::FetchRemoteAccountService” handles errors

Add “suppress_errors” keyword argument to avoid raising errors in
ActivityPub::FetchRemoteAccountService#call (default/previous behavior).

* Rework how “ActivityPub::FetchRemoteKeyService” handles errors

Add “suppress_errors” keyword argument to avoid raising errors in
ActivityPub::FetchRemoteKeyService#call (default/previous behavior).

* Fix Webfinger::RedirectError not being a subclass of Webfinger::Error

* Add suppress_errors option to ResolveAccountService

Defaults to true (to preserve previous behavior). If set to false,
errors will be raised instead of caught, allowing the caller to be
informed of what went wrong.

* Return more precise error when failing to fetch account signing AP payloads

* Add tests

* Fixes

* Refactor error handling a bit

* Fix various issues

* Add specific error when provided Digest is not 256 bits of base64-encoded data

* Please CodeClimate

* Improve webfinger error reporting
2022-09-20 23:30:26 +02:00
Eugen RochkoandGitHub 0396acf39e Add audit log entries for user roles (#19040)
* Refactor audit log schema

* Add audit log entries for user roles
2022-08-25 20:39:40 +02:00
Eugen RochkoandGitHub 6221b36b27 Remove sign-in token authentication, instead send e-mail about new sign-in (#17970) 2022-04-06 20:58:12 +02:00
Eugen RochkoandGitHub 50ea54b3ed Change authorized applications page (#17656)
* Change authorized applications page

* Hide revoke button for superapps and suspended accounts

* Clean up db/schema.rb
2022-03-01 16:48:58 +01:00
Eugen RochkoandGitHub 27965ce5ed Add trending statuses (#17431)
* Add trending statuses

* Fix dangling items with stale scores in localized sets

* Various fixes and improvements

- Change approve_all/reject_all to approve_accounts/reject_accounts
- Change Trends::Query methods to not mutate the original query
- Change Trends::Query#skip to offset
- Change follow recommendations to be refreshed in a transaction

* Add tests for trending statuses filtering behaviour

* Fix not applying filtering scope in controller
2022-02-25 00:34:14 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Yamagishi Kazutoshi
2e89067d21 Bump pundit from 2.1.1 to 2.2.0 (#17543)
* Bump pundit from 2.1.1 to 2.2.0

Bumps [pundit](https://github.com/varvet/pundit) from 2.1.1 to 2.2.0.
- [Release notes](https://github.com/varvet/pundit/releases)
- [Changelog](https://github.com/varvet/pundit/blob/main/CHANGELOG.md)
- [Commits](https://github.com/varvet/pundit/compare/v2.1.1...v2.2.0)

---
updated-dependencies:
- dependency-name: pundit
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

* `include Pundit` is deprecated

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yamagishi Kazutoshi <[email protected]>
2022-02-19 13:30:06 +09:00
Eugen RochkoandGitHub de448ab1b5 Change global locale param to lang to avoid conflicts (#17592) 2022-02-19 03:12:28 +01:00