Merge remote-tracking branch 'upstream/master'

2017-06-27 20:46:13 +00:00 · 2017-06-27 20:46:13 +00:00 · ddafde942c
parent e6300de142 da42bfadb5
commit ddafde942c
91 changed files with 1274 additions and 751 deletions
--- a/.gitattributes
+++ b/.gitattributes
@ -0,0 +1,14 @@
+*                             text=auto eol=lf
+*.eot                         -text
+*.gif                         -text
+*.gz                          -text
+*.ico                         -text
+*.jpg                         -text
+*.mp3                         -text
+*.ogg                         -text
+*.png                         -text
+*.ttf                         -text
+*.webm                        -text
+*.woff                        -text
+*.woff2                       -text
+spec/fixtures/requests/**     -text !eol
--- a/1
+++ b/1
@ -20,6 +20,7 @@ gem 'paperclip-av-transcoder', '~> 0.6'

 gem 'addressable', '~> 2.5'
 gem 'bootsnap'
+gem 'browser'
 gem 'cld3', '~> 3.1'
 gem 'devise', '~> 4.2'
 gem 'devise-two-factor', '~> 3.0'
--- a/Gemfile.lock
+++ b/Gemfile.lock
@ -1,40 +1,40 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    actioncable (5.1.1)
-      actionpack (= 5.1.1)
+    actioncable (5.1.2)
+      actionpack (= 5.1.2)
      nio4r (~> 2.0)
      websocket-driver (~> 0.6.1)
-    actionmailer (5.1.1)
-      actionpack (= 5.1.1)
-      actionview (= 5.1.1)
-      activejob (= 5.1.1)
+    actionmailer (5.1.2)
+      actionpack (= 5.1.2)
+      actionview (= 5.1.2)
+      activejob (= 5.1.2)
      mail (~> 2.5, >= 2.5.4)
      rails-dom-testing (~> 2.0)
-    actionpack (5.1.1)
-      actionview (= 5.1.1)
-      activesupport (= 5.1.1)
+    actionpack (5.1.2)
+      actionview (= 5.1.2)
+      activesupport (= 5.1.2)
      rack (~> 2.0)
      rack-test (~> 0.6.3)
      rails-dom-testing (~> 2.0)
      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (5.1.1)
-      activesupport (= 5.1.1)
+    actionview (5.1.2)
+      activesupport (= 5.1.2)
      builder (~> 3.1)
      erubi (~> 1.4)
      rails-dom-testing (~> 2.0)
      rails-html-sanitizer (~> 1.0, >= 1.0.3)
    active_record_query_trace (1.5.4)
-    activejob (5.1.1)
-      activesupport (= 5.1.1)
+    activejob (5.1.2)
+      activesupport (= 5.1.2)
      globalid (>= 0.3.6)
-    activemodel (5.1.1)
-      activesupport (= 5.1.1)
-    activerecord (5.1.1)
-      activemodel (= 5.1.1)
-      activesupport (= 5.1.1)
+    activemodel (5.1.2)
+      activesupport (= 5.1.2)
+    activerecord (5.1.2)
+      activemodel (= 5.1.2)
+      activesupport (= 5.1.2)
      arel (~> 8.0)
-    activesupport (5.1.1)
+    activesupport (5.1.2)
      concurrent-ruby (~> 1.0, >= 1.0.2)
      i18n (~> 0.7)
      minitest (~> 5.1)
@ -70,6 +70,7 @@ GEM
    bootsnap (1.0.0)
      msgpack (~> 1.0)
    brakeman (3.6.2)
+    browser (2.4.0)
    builder (3.2.3)
    bullet (5.5.1)
      activesupport (>= 3.0.0)
@ -297,17 +298,17 @@ GEM
    rack-test (0.6.3)
      rack (>= 1.0)
    rack-timeout (0.4.2)
-    rails (5.1.1)
-      actioncable (= 5.1.1)
-      actionmailer (= 5.1.1)
-      actionpack (= 5.1.1)
-      actionview (= 5.1.1)
-      activejob (= 5.1.1)
-      activemodel (= 5.1.1)
-      activerecord (= 5.1.1)
-      activesupport (= 5.1.1)
+    rails (5.1.2)
+      actioncable (= 5.1.2)
+      actionmailer (= 5.1.2)
+      actionpack (= 5.1.2)
+      actionview (= 5.1.2)
+      activejob (= 5.1.2)
+      activemodel (= 5.1.2)
+      activerecord (= 5.1.2)
+      activesupport (= 5.1.2)
      bundler (>= 1.3.0, < 2.0)
-      railties (= 5.1.1)
+      railties (= 5.1.2)
      sprockets-rails (>= 2.0.0)
    rails-controller-testing (1.0.2)
      actionpack (~> 5.x, >= 5.0.1)
@ -323,9 +324,9 @@ GEM
      railties (~> 5.0)
    rails-settings-cached (0.6.5)
      rails (>= 4.2.0)
-    railties (5.1.1)
-      actionpack (= 5.1.1)
-      activesupport (= 5.1.1)
+    railties (5.1.2)
+      actionpack (= 5.1.2)
+      activesupport (= 5.1.2)
      method_source
      rake (>= 0.8.7)
      thor (>= 0.18.1, < 2.0)
@ -483,6 +484,7 @@ DEPENDENCIES
  binding_of_caller (~> 0.7)
  bootsnap
  brakeman (~> 3.6)
+  browser
  bullet (~> 5.5)
  bundler-audit (~> 0.5)
  capistrano (~> 3.8)
--- a/app/controllers/api/v1/reports_controller.rb
+++ b/app/controllers/api/v1/reports_controller.rb
@ -17,6 +17,9 @@ class Api::V1::ReportsController < Api::BaseController
      status_ids: reported_status_ids,
      comment: report_params[:comment]
    )
+
+    User.admins.includes(:account).each { |u| AdminMailer.new_report(u.account, @report).deliver_later }
+
    render :show
  end

--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@ -11,6 +11,7 @@ class ApplicationController < ActionController::Base
  include UserTrackingConcern

  helper_method :current_account
+  helper_method :current_session
  helper_method :single_user_mode?

  rescue_from ActionController::RoutingError, with: :not_found
@ -68,6 +69,10 @@ class ApplicationController < ActionController::Base
    @current_account ||= current_user.try(:account)
  end

+  def current_session
+    @current_session ||= SessionActivation.find_by(session_id: session['auth_id'])
+  end
+
  def cache_collection(raw, klass)
    return raw unless klass.respond_to?(:with_includes)

--- a/app/controllers/auth/registrations_controller.rb
+++ b/app/controllers/auth/registrations_controller.rb
@ -5,6 +5,7 @@ class Auth::RegistrationsController < Devise::RegistrationsController

  before_action :check_enabled_registrations, only: [:new, :create]
  before_action :configure_sign_up_params, only: [:create]
+  before_action :set_sessions, only: [:edit, :update]

  def destroy
    not_found
@ -41,4 +42,8 @@ class Auth::RegistrationsController < Devise::RegistrationsController
  def determine_layout
    %w(edit update).include?(action_name) ? 'admin' : 'auth'
  end
+
+  def set_sessions
+    @sessions = current_user.session_activations
+  end
 end
--- a/app/controllers/home_controller.rb
+++ b/app/controllers/home_controller.rb
@ -5,7 +5,7 @@ class HomeController < ApplicationController

  def index
    @body_classes           = 'app-body'
-    @token                  = find_or_create_access_token.token
+    @token                  = current_session.token
    @web_settings           = Web::Setting.find_by(user: current_user)&.data || {}
    @admin                  = Account.find_local(Setting.site_contact_username)
    @streaming_api_base_url = Rails.configuration.x.streaming_api_base_url
@ -16,14 +16,4 @@ class HomeController < ApplicationController
  def authenticate_user!
    redirect_to(single_user_mode? ? account_path(Account.first) : about_path) unless user_signed_in?
  end
-
-  def find_or_create_access_token
-    Doorkeeper::AccessToken.find_or_create_for(
-      Doorkeeper::Application.where(superapp: true).first,
-      current_user.id,
-      Doorkeeper::OAuth::Scopes.from_string('read write follow'),
-      Doorkeeper.configuration.access_token_expires_in,
-      Doorkeeper.configuration.refresh_token_enabled?
-    )
-  end
 end
--- a/app/controllers/settings/two_factor_authentications_controller.rb
+++ b/app/controllers/settings/two_factor_authentications_controller.rb
@ -7,7 +7,9 @@ module Settings
    before_action :authenticate_user!
    before_action :verify_otp_required, only: [:create]

-    def show; end
+    def show
+      @confirmation = Form::TwoFactorConfirmation.new
+    end

    def create
      current_user.otp_secret = User.generate_otp_secret(32)
@ -16,13 +18,23 @@ module Settings
    end

    def destroy
+      if current_user.validate_and_consume_otp!(confirmation_params[:code])
        current_user.otp_required_for_login = false
        current_user.save!
        redirect_to settings_two_factor_authentication_path
+      else
+        flash.now[:alert] = I18n.t('two_factor_authentication.wrong_code')
+        @confirmation = Form::TwoFactorConfirmation.new
+        render :show
+      end
    end

    private

+    def confirmation_params
+      params.require(:form_two_factor_confirmation).permit(:code)
+    end
+
    def verify_otp_required
      redirect_to settings_two_factor_authentication_path if current_user.otp_required_for_login?
    end
--- a/app/helpers/settings_helper.rb
+++ b/app/helpers/settings_helper.rb
@ -41,4 +41,16 @@ module SettingsHelper
  def hash_to_object(hash)
    HashObject.new(hash)
  end
+
+  def session_device_icon(session)
+    device = session.detection.device
+
+    if device.mobile?
+      'mobile'
+    elsif device.tablet?
+      'tablet'
+    else
+      'desktop'
+    end
+  end
 end
--- a/app/javascript/mastodon/actions/reports.js
+++ b/app/javascript/mastodon/actions/reports.js
@ -1,4 +1,5 @@
 import api from '../api';
+import { openModal, closeModal } from './modal';

 export const REPORT_INIT   = 'REPORT_INIT';
 export const REPORT_CANCEL = 'REPORT_CANCEL';
@ -11,10 +12,14 @@ export const REPORT_STATUS_TOGGLE  = 'REPORT_STATUS_TOGGLE';
 export const REPORT_COMMENT_CHANGE = 'REPORT_COMMENT_CHANGE';

 export function initReport(account, status) {
-  return {
+  return dispatch => {
+    dispatch({
      type: REPORT_INIT,
      account,
      status,
+    });
+
+    dispatch(openModal('REPORT'));
  };
 };

@ -40,7 +45,10 @@ export function submitReport() {
      account_id: getState().getIn(['reports', 'new', 'account_id']),
      status_ids: getState().getIn(['reports', 'new', 'status_ids']),
      comment: getState().getIn(['reports', 'new', 'comment']),
-    }).then(response => dispatch(submitReportSuccess(response.data))).catch(error => dispatch(submitReportFail(error)));
+    }).then(response => {
+      dispatch(closeModal());
+      dispatch(submitReportSuccess(response.data));
+    }).catch(error => dispatch(submitReportFail(error)));
  };
 };

--- a/app/javascript/mastodon/components/column_collapsable.js
+++ b/app/javascript/mastodon/components/column_collapsable.js
@ -1,50 +0,0 @@
-import React from 'react';
-import PropTypes from 'prop-types';
-
-export default class ColumnCollapsable extends React.PureComponent {
-
-  static propTypes = {
-    icon: PropTypes.string.isRequired,
-    title: PropTypes.string,
-    fullHeight: PropTypes.number.isRequired,
-    children: PropTypes.node,
-    onCollapse: PropTypes.func,
-  };
-
-  state = {
-    collapsed: true,
-    animating: false,
-  };
-
-  handleToggleCollapsed = () => {
-    const currentState = this.state.collapsed;
-
-    this.setState({ collapsed: !currentState, animating: true });
-
-    if (!currentState && this.props.onCollapse) {
-      this.props.onCollapse();
-    }
-  }
-
-  handleTransitionEnd = () => {
-    this.setState({ animating: false });
-  }
-
-  render () {
-    const { icon, title, fullHeight, children } = this.props;
-    const { collapsed, animating } = this.state;
-
-    return (
-      <div className={`column-collapsable ${collapsed ? 'collapsed' : ''}`} onTransitionEnd={this.handleTransitionEnd}>
-        <div role='button' tabIndex='0' title={`${title}`} className='column-collapsable__button column-icon' onClick={this.handleToggleCollapsed}>
-          <i className={`fa fa-${icon}`} />
-        </div>
-
-        <div className='column-collapsable__content' style={{ height: `${fullHeight}px` }}>
-          {(!collapsed || animating) && children}
-        </div>
-      </div>
-    );
-  }
-
-}
--- a/app/javascript/mastodon/components/column_header.js
+++ b/app/javascript/mastodon/components/column_header.js
@ -132,7 +132,7 @@ export default class ColumnHeader extends React.PureComponent {
        </div>

        <div className={collapsibleClassName} onTransitionEnd={this.handleTransitionEnd}>
-          <div>
+          <div className='column-header__collapsible-inner'>
            {(!collapsed || animating) && collapsedContent}
          </div>
        </div>
--- a/app/javascript/mastodon/components/media_gallery.js
+++ b/app/javascript/mastodon/components/media_gallery.js
@ -85,14 +85,24 @@ class Item extends React.PureComponent {
    let thumbnail = '';

    if (attachment.get('type') === 'image') {
+      const previewUrl = attachment.get('preview_url');
+      const previewWidth = attachment.getIn(['meta', 'small', 'width']);
+
+      const originalUrl = attachment.get('url');
+      const originalWidth = attachment.getIn(['meta', 'original', 'width']);
+
+      const srcSet = `${originalUrl} ${originalWidth}w, ${previewUrl} ${previewWidth}w`;
+      const sizes = `(min-width: 1025px) ${320 * (width / 100)}px, ${width}vw`;
+
      thumbnail = (
-        <a // eslint-disable-line jsx-a11y/anchor-has-content
+        <a
          className='media-gallery__item-thumbnail'
-          href={attachment.get('remote_url') || attachment.get('url')}
+          href={attachment.get('remote_url') || originalUrl}
          onClick={this.handleClick}
          target='_blank'
-          style={{ backgroundImage: `url(${attachment.get('preview_url')})` }}
-        />
+        >
+          <img src={previewUrl} srcSet={srcSet} sizes={sizes} alt='' />
+        </a>
      );
    } else if (attachment.get('type') === 'gifv') {
      const autoPlay = !isIOS() && this.props.autoPlayGif;
--- a/app/javascript/mastodon/components/permalink.js
+++ b/app/javascript/mastodon/components/permalink.js
@ -25,7 +25,7 @@ export default class Permalink extends React.PureComponent {
    const { href, children, className, ...other } = this.props;

    return (
-      <a href={href} onClick={this.handleClick} {...other} className={'permalink ' + className}>
+      <a href={href} onClick={this.handleClick} {...other} className={`permalink${className ? ' ' + className : ''}`}>
        {children}
      </a>
    );
--- a/app/javascript/mastodon/components/status.js
+++ b/app/javascript/mastodon/components/status.js
@ -149,7 +149,7 @@ class StatusUnextended extends ImmutablePureComponent {

  saveHeight = () => {
    if (this.node && this.node.children.length !== 0) {
-      this.height = this.node.clientHeight;
+      this.height = this.node.getBoundingClientRect().height;
    }
  }

--- a/app/javascript/mastodon/components/status_action_bar.js
+++ b/app/javascript/mastodon/components/status_action_bar.js
@ -88,7 +88,6 @@ export default class StatusActionBar extends ImmutablePureComponent {

  handleReport = () => {
    this.props.onReport(this.props.status);
-    this.context.router.history.push('/report');
  }

  handleConversationMuteClick = () => {
--- a/app/javascript/mastodon/features/account_timeline/components/header.js
+++ b/app/javascript/mastodon/features/account_timeline/components/header.js
@ -38,7 +38,6 @@ export default class Header extends ImmutablePureComponent {

  handleReport = () => {
    this.props.onReport(this.props.account);
-    this.context.router.history.push('/report');
  }

  handleMute = () => {
--- a/app/javascript/mastodon/features/compose/components/compose_form.js
+++ b/app/javascript/mastodon/features/compose/components/compose_form.js
@ -67,6 +67,12 @@ export default class ComposeForm extends ImmutablePureComponent {
  }

  handleSubmit = () => {
+    if (this.props.text !== this.autosuggestTextarea.textarea.value) {
+      // Something changed the text inside the textarea (e.g. browser extensions like Grammarly)
+      // Update the state to match the current text
+      this.props.onChange(this.autosuggestTextarea.textarea.value);
+    }
+
    this.props.onSubmit();
  }

--- a/app/javascript/mastodon/features/favourited_statuses/index.js
+++ b/app/javascript/mastodon/features/favourited_statuses/index.js
@ -1,6 +1,7 @@
 import React from 'react';
 import { connect } from 'react-redux';
 import PropTypes from 'prop-types';
+import ImmutablePropTypes from 'react-immutable-proptypes';
 import LoadingIndicator from '../../components/loading_indicator';
 import { fetchFavouritedStatuses, expandFavouritedStatuses } from '../../actions/favourites';
 import Column from '../ui/components/column';
@ -14,7 +15,9 @@ const messages = defineMessages({
 });

 const mapStateToProps = state => ({
+  statusIds: state.getIn(['status_lists', 'favourites', 'items']),
  loaded: state.getIn(['status_lists', 'favourites', 'loaded']),
+  me: state.getIn(['meta', 'me']),
 });

@connect(mapStateToProps)
@ -23,8 +26,10 @@ export default class Favourites extends ImmutablePureComponent {

  static propTypes = {
    dispatch: PropTypes.func.isRequired,
+    statusIds: ImmutablePropTypes.list.isRequired,
    loaded: PropTypes.bool,
    intl: PropTypes.object.isRequired,
+    me: PropTypes.number.isRequired,
  };

  componentWillMount () {
--- a/app/javascript/mastodon/features/notifications/index.js
+++ b/app/javascript/mastodon/features/notifications/index.js
@ -13,6 +13,7 @@ import ColumnSettingsContainer from './containers/column_settings_container';
 import { createSelector } from 'reselect';
 import Immutable from 'immutable';
 import LoadMore from '../../components/load_more';
+import { debounce } from 'lodash';

 const messages = defineMessages({
  title: { id: 'column.notifications', defaultMessage: 'Notifications' },
@ -50,19 +51,27 @@ export default class Notifications extends React.PureComponent {
    trackScroll: true,
  };

+  dispatchExpandNotifications = debounce(() => {
+    this.props.dispatch(expandNotifications());
+  }, 300, { leading: true });
+
+  dispatchScrollToTop = debounce((top) => {
+    this.props.dispatch(scrollTopNotifications(top));
+  }, 100);
+
  handleScroll = (e) => {
    const { scrollTop, scrollHeight, clientHeight } = e.target;
    const offset = scrollHeight - scrollTop - clientHeight;
    this._oldScrollPosition = scrollHeight - scrollTop;

-    if (250 > offset && !this.props.isLoading) {
-      if (this.props.hasMore) {
-        this.props.dispatch(expandNotifications());
+    if (250 > offset && this.props.hasMore && !this.props.isLoading) {
+      this.dispatchExpandNotifications();
    }
-    } else if (scrollTop < 100) {
-      this.props.dispatch(scrollTopNotifications(true));
+
+    if (scrollTop < 100) {
+      this.dispatchScrollToTop(true);
    } else {
-      this.props.dispatch(scrollTopNotifications(false));
+      this.dispatchScrollToTop(false);
    }
  }

@ -74,7 +83,7 @@ export default class Notifications extends React.PureComponent {

  handleLoadMore = (e) => {
    e.preventDefault();
-    this.props.dispatch(expandNotifications());
+    this.dispatchExpandNotifications();
  }

  handlePin = () => {
--- a/app/javascript/mastodon/features/status/components/action_bar.js
+++ b/app/javascript/mastodon/features/status/components/action_bar.js
@ -56,7 +56,6 @@ export default class ActionBar extends React.PureComponent {

  handleReport = () => {
    this.props.onReport(this.props.status);
-    this.context.router.history.push('/report');
  }

  render () {
--- a/app/javascript/mastodon/features/ui/components/image_loader.js
+++ b/app/javascript/mastodon/features/ui/components/image_loader.js
@ -1,5 +1,6 @@
 import React from 'react';
 import PropTypes from 'prop-types';
+import classNames from 'classnames';

 export default class ImageLoader extends React.PureComponent {

@ -20,31 +21,113 @@ export default class ImageLoader extends React.PureComponent {
    error: false,
  }

-  componentWillMount() {
-    this._loadImage(this.props.src);
+  removers = [];
+
+  get canvasContext() {
+    if (!this.canvas) {
+      return null;
+    }
+    this._canvasContext = this._canvasContext || this.canvas.getContext('2d');
+    return this._canvasContext;
  }

-  componentWillReceiveProps(props) {
-    this._loadImage(props.src);
+  componentDidMount () {
+    this.loadImage(this.props);
  }

-  _loadImage(src) {
+  componentWillReceiveProps (nextProps) {
+    if (this.props.src !== nextProps.src) {
+      this.loadImage(nextProps);
+    }
+  }
+
+  loadImage (props) {
+    this.removeEventListeners();
+    this.setState({ loading: true, error: false });
+    Promise.all([
+      this.loadPreviewCanvas(props),
+      this.loadOriginalImage(props),
+    ])
+      .then(() => {
+        this.setState({ loading: false, error: false });
+        this.clearPreviewCanvas();
+      })
+      .catch(() => this.setState({ loading: false, error: true }));
+  }
+
+  loadPreviewCanvas = ({ previewSrc, width, height }) => new Promise((resolve, reject) => {
    const image = new Image();
+    const removeEventListeners = () => {
+      image.removeEventListener('error', handleError);
+      image.removeEventListener('load', handleLoad);
+    };
+    const handleError = () => {
+      removeEventListeners();
+      reject();
+    };
+    const handleLoad = () => {
+      removeEventListeners();
+      this.canvasContext.drawImage(image, 0, 0, width, height);
+      resolve();
+    };
+    image.addEventListener('error', handleError);
+    image.addEventListener('load', handleLoad);
+    image.src = previewSrc;
+    this.removers.push(removeEventListeners);
+  })

-    image.onerror = () => this.setState({ loading: false, error: true });
-    image.onload  = () => this.setState({ loading: false, error: false });
+  clearPreviewCanvas () {
+    const { width, height } = this.canvas;
+    this.canvasContext.clearRect(0, 0, width, height);
+  }

+  loadOriginalImage = ({ src }) => new Promise((resolve, reject) => {
+    const image = new Image();
+    const removeEventListeners = () => {
+      image.removeEventListener('error', handleError);
+      image.removeEventListener('load', handleLoad);
+    };
+    const handleError = () => {
+      removeEventListeners();
+      reject();
+    };
+    const handleLoad = () => {
+      removeEventListeners();
+      resolve();
+    };
+    image.addEventListener('error', handleError);
+    image.addEventListener('load', handleLoad);
    image.src = src;
+    this.removers.push(removeEventListeners);
+  });

-    this.setState({ loading: true });
+  removeEventListeners () {
+    this.removers.forEach(listeners => listeners());
+    this.removers = [];
+  }
+
+  setCanvasRef = c => {
+    this.canvas = c;
  }

  render () {
-    const { alt, src, previewSrc, width, height } = this.props;
+    const { alt, src, width, height } = this.props;
    const { loading } = this.state;

+    const className = classNames('image-loader', {
+      'image-loader--loading': loading,
+    });
+
    return (
-      <div className='image-loader'>
+      <div className={className}>
+        <canvas
+          className='image-loader__preview-canvas'
+          width={width}
+          height={height}
+          ref={this.setCanvasRef}
+        />
+
+        {!loading && (
          <img
            alt={alt}
            className='image-loader__img'
@ -52,14 +135,7 @@ export default class ImageLoader extends React.PureComponent {
            width={width}
            height={height}
          />
-
-        {loading &&
-          <img
-            alt=''
-            src={previewSrc}
-            className='image-loader__preview-img'
-          />
-        }
+        )}
      </div>
    );
  }
--- a/app/javascript/mastodon/features/ui/components/modal_root.js
+++ b/app/javascript/mastodon/features/ui/components/modal_root.js
@ -5,6 +5,7 @@ import OnboardingModal from './onboarding_modal';
 import VideoModal from './video_modal';
 import BoostModal from './boost_modal';
 import ConfirmationModal from './confirmation_modal';
+import ReportModal from './report_modal';
 import TransitionMotion from 'react-motion/lib/TransitionMotion';
 import spring from 'react-motion/lib/spring';

@ -14,6 +15,7 @@ const MODAL_COMPONENTS = {
  'VIDEO': VideoModal,
  'BOOST': BoostModal,
  'CONFIRM': ConfirmationModal,
+  'REPORT': ReportModal,
 };

 export default class ModalRoot extends React.PureComponent {
--- a/app/javascript/mastodon/features/ui/components/onboarding_modal.js
+++ b/app/javascript/mastodon/features/ui/components/onboarding_modal.js
@ -3,6 +3,7 @@ import { connect } from 'react-redux';
 import PropTypes from 'prop-types';
 import ImmutablePropTypes from 'react-immutable-proptypes';
 import { defineMessages, injectIntl, FormattedMessage } from 'react-intl';
+import ReactSwipeable from 'react-swipeable';
 import classNames from 'classnames';
 import Permalink from '../../../components/permalink';
 import TransitionMotion from 'react-motion/lib/TransitionMotion';
@ -274,7 +275,7 @@ export default class OnboardingModal extends React.PureComponent {
      <div className='modal-root__modal onboarding-modal'>
        <TransitionMotion styles={styles}>
          {interpolatedStyles => (
-            <div className='onboarding-modal__pager'>
+            <ReactSwipeable onSwipedRight={this.handlePrev} onSwipedLeft={this.handleNext} className='onboarding-modal__pager'>
              {interpolatedStyles.map(({ key, data, style }, i) => {
                const className = classNames('onboarding-modal__page__wrapper', {
                  'onboarding-modal__page__wrapper--active': i === currentIndex,
@ -283,7 +284,7 @@ export default class OnboardingModal extends React.PureComponent {
                  <div key={key} style={style} className={className}>{data}</div>
                );
              })}
-            </div>
+            </ReactSwipeable>
          )}
        </TransitionMotion>

--- a/app/javascript/mastodon/features/ui/components/report_modal.js
+++ b/app/javascript/mastodon/features/ui/components/report_modal.js
@ -1,19 +1,17 @@
 import React from 'react';
 import { connect } from 'react-redux';
-import { changeReportComment, submitReport } from '../../actions/reports';
-import { refreshAccountTimeline } from '../../actions/timelines';
+import { changeReportComment, submitReport } from '../../../actions/reports';
+import { refreshAccountTimeline } from '../../../actions/timelines';
 import PropTypes from 'prop-types';
 import ImmutablePropTypes from 'react-immutable-proptypes';
-import Column from '../ui/components/column';
-import Button from '../../components/button';
-import { makeGetAccount } from '../../selectors';
+import { makeGetAccount } from '../../../selectors';
 import { defineMessages, FormattedMessage, injectIntl } from 'react-intl';
-import StatusCheckBox from './containers/status_check_box_container';
+import StatusCheckBox from '../../report/containers/status_check_box_container';
 import Immutable from 'immutable';
-import ColumnBackButtonSlim from '../../components/column_back_button_slim';
+import ImmutablePureComponent from 'react-immutable-pure-component';
+import Button from '../../../components/button';

 const messages = defineMessages({
-  heading: { id: 'report.heading', defaultMessage: 'New report' },
  placeholder: { id: 'report.placeholder', defaultMessage: 'Additional comments' },
  submit: { id: 'report.submit', defaultMessage: 'Submit' },
 });
@ -37,11 +35,7 @@ const makeMapStateToProps = () => {

@connect(makeMapStateToProps)
@injectIntl
-export default class Report extends React.PureComponent {
-
-  static contextTypes = {
-    router: PropTypes.object,
-  };
+export default class ReportModal extends ImmutablePureComponent {

  static propTypes = {
    isSubmitting: PropTypes.bool,
@ -52,17 +46,15 @@ export default class Report extends React.PureComponent {
    intl: PropTypes.object.isRequired,
  };

-  componentWillMount () {
-    if (!this.props.account) {
-      this.context.router.history.replace('/');
+  handleCommentChange = (e) => {
+    this.props.dispatch(changeReportComment(e.target.value));
  }
+
+  handleSubmit = () => {
+    this.props.dispatch(submitReport());
  }

  componentDidMount () {
-    if (!this.props.account) {
-      return;
-    }
-
    this.props.dispatch(refreshAccountTimeline(this.props.account.get('id')));
  }

@ -72,15 +64,6 @@ export default class Report extends React.PureComponent {
    }
  }

-  handleCommentChange = (e) => {
-    this.props.dispatch(changeReportComment(e.target.value));
-  }
-
-  handleSubmit = () => {
-    this.props.dispatch(submitReport());
-    this.context.router.history.replace('/');
-  }
-
  render () {
    const { account, comment, intl, statusIds, isSubmitting } = this.props;

@ -89,36 +72,33 @@ export default class Report extends React.PureComponent {
    }

    return (
-      <Column heading={intl.formatMessage(messages.heading)} icon='flag'>
-        <ColumnBackButtonSlim />
-
-        <div className='report scrollable'>
-          <div className='report__target'>
-            <FormattedMessage id='report.target' defaultMessage='Reporting' />
-            <strong>{account.get('acct')}</strong>
+      <div className='modal-root__modal report-modal'>
+        <div className='report-modal__target'>
+          <FormattedMessage id='report.target' defaultMessage='Report {target}' values={{ target: <strong>{account.get('acct')}</strong> }} />
        </div>

-          <div className='scrollable report__statuses'>
+        <div className='report-modal__container'>
+          <div className='report-modal__statuses'>
            <div>
              {statusIds.map(statusId => <StatusCheckBox id={statusId} key={statusId} disabled={isSubmitting} />)}
            </div>
          </div>

-          <div className='report__textarea-wrapper'>
+          <div className='report-modal__comment'>
            <textarea
-              className='report__textarea'
+              className='setting-text light'
              placeholder={intl.formatMessage(messages.placeholder)}
              value={comment}
              onChange={this.handleCommentChange}
              disabled={isSubmitting}
            />
+          </div>
+        </div>

-            <div className='report__submit'>
-              <div className='report__submit-button'><Button disabled={isSubmitting} text={intl.formatMessage(messages.submit)} onClick={this.handleSubmit} /></div>
+        <div className='report-modal__action-bar'>
+          <Button disabled={isSubmitting} text={intl.formatMessage(messages.submit)} onClick={this.handleSubmit} />
        </div>
      </div>
-        </div>
-      </Column>
    );
  }

--- a/app/javascript/mastodon/features/ui/index.js
+++ b/app/javascript/mastodon/features/ui/index.js
@ -15,7 +15,6 @@ import { refreshHomeTimeline } from '../../actions/timelines';
 import { refreshNotifications } from '../../actions/notifications';
 import UploadArea from './components/upload_area';
 import ColumnsAreaContainer from './containers/columns_area_container';
-
 import Status from '../../features/status';
 import GettingStarted from '../../features/getting_started';
 import PublicTimeline from '../../features/public_timeline';
@ -35,7 +34,6 @@ import GenericNotFound from '../../features/generic_not_found';
 import FavouritedStatuses from '../../features/favourited_statuses';
 import Blocks from '../../features/blocks';
 import Mutes from '../../features/mutes';
-import Report from '../../features/report';

 // Small wrapper to pass multiColumn to the route components
 const WrappedSwitch = ({ multiColumn, children }) => (
@ -222,7 +220,6 @@ export default class UI extends React.PureComponent {
            <WrappedRoute path='/follow_requests' component={FollowRequests} content={children} />
            <WrappedRoute path='/blocks' component={Blocks} content={children} />
            <WrappedRoute path='/mutes' component={Mutes} content={children} />
-            <WrappedRoute path='/report' component={Report} content={children} />

            <WrappedRoute component={GenericNotFound} content={children} />
          </WrappedSwitch>
--- a/app/javascript/mastodon/locales/defaultMessages.json
+++ b/app/javascript/mastodon/locales/defaultMessages.json
@ -1151,6 +1151,23 @@
    ],
    "path": "app/javascript/mastodon/features/ui/components/onboarding_modal.json"
  },
+  {
+    "descriptors": [
+      {
+        "defaultMessage": "Additional comments",
+        "id": "report.placeholder"
+      },
+      {
+        "defaultMessage": "Submit",
+        "id": "report.submit"
+      },
+      {
+        "defaultMessage": "Report {target}",
+        "id": "report.target"
+      }
+    ],
+    "path": "app/javascript/mastodon/features/ui/components/report_modal.json"
+  },
  {
    "descriptors": [
      {
--- a/app/javascript/mastodon/locales/en.json
+++ b/app/javascript/mastodon/locales/en.json
@ -140,10 +140,10 @@
  "privacy.unlisted.long": "Do not post to public timelines",
  "privacy.unlisted.short": "Unlisted",
  "reply_indicator.cancel": "Cancel",
-  "report.heading": "New report",
+  "report.heading": "Report {target}",
  "report.placeholder": "Additional comments",
  "report.submit": "Submit",
-  "report.target": "Reporting",
+  "report.target": "Reporting {target}",
  "search.placeholder": "Search",
  "search_results.total": "{count, number} {count, plural, one {result} other {results}}",
  "status.cannot_reblog": "This post cannot be boosted",
--- a/app/javascript/mastodon/locales/fr.json
+++ b/app/javascript/mastodon/locales/fr.json
@ -27,8 +27,8 @@
  "column.notifications": "Notifications",
  "column.public": "Fil public global",
  "column_back_button.label": "Retour",
-  "column_header.pin": "Pin",
-  "column_header.unpin": "Unpin",
+  "column_header.pin": "Épingler",
+  "column_header.unpin": "Retirer",
  "column_subheading.navigation": "Navigation",
  "column_subheading.settings": "Paramètres",
  "compose_form.lock_disclaimer": "Votre compte n'est pas {locked}. Tout le monde peut vous suivre et voir vos pouets restreints.",
@ -101,7 +101,7 @@
  "notifications.clear_confirmation": "Voulez-vous vraiment supprimer toutes vos notifications ?",
  "notifications.column_settings.alert": "Notifications locales",
  "notifications.column_settings.favourite": "Favoris :",
-  "notifications.column_settings.follow": "Nouveaux abonné⋅e⋅s :",
+  "notifications.column_settings.follow": "Nouveaux⋅elles abonn⋅é⋅s :",
  "notifications.column_settings.mention": "Mentions :",
  "notifications.column_settings.reblog": "Partages :",
  "notifications.column_settings.show": "Afficher dans la colonne",
--- a/app/javascript/mastodon/locales/pl.json
+++ b/app/javascript/mastodon/locales/pl.json
@ -136,10 +136,10 @@
  "privacy.unlisted.long": "Niewidoczne na publicznych osiach czasu",
  "privacy.unlisted.short": "Niewidoczne",
  "reply_indicator.cancel": "Anuluj",
-  "report.heading": "Nowe zgłoszenie",
+  "report.heading": "Zgłoś {target}",
  "report.placeholder": "Dodatkowe komentarze",
  "report.submit": "Wyślij",
-  "report.target": "Zgłaszanie",
+  "report.target": "Zgłaszanie {target}",
  "search.placeholder": "Szukaj",
  "search_results.total": "{count, number} {count, plural, one {wynik} more {wyniki}}",
  "status.cannot_reblog": "Ten post nie może zostać podbity",
--- a/app/javascript/styles/admin.scss
+++ b/app/javascript/styles/admin.scss
@ -129,6 +129,11 @@
        color: $ui-primary-color;
      }
    }
+
+    .positive-hint {
+      color: $valid-value-color;
+      font-weight: 500;
+    }
  }

  .simple_form {
--- a/app/javascript/styles/components.scss
+++ b/app/javascript/styles/components.scss
@ -58,37 +58,6 @@
  position: relative;
 }

-.column-collapsable {
-  position: relative;
-
-  .column-collapsable__content {
-    overflow: auto;
-    transition: 300ms ease;
-    opacity: 1;
-    max-height: 70vh;
-  }
-
-  &.collapsed .column-collapsable__content {
-    height: 0 !important;
-    opacity: 0;
-  }
-
-  .column-collapsable__button {
-    color: $primary-text-color;
-    background: lighten($ui-base-color, 8%);
-
-    &:hover {
-      color: $primary-text-color;
-      background: lighten($ui-base-color, 8%);
-    }
-  }
-
-  &.collapsed .column-collapsable__button {
-    color: $ui-primary-color;
-    background: lighten($ui-base-color, 4%);
-  }
-}
-
 .column-icon {
  background: lighten($ui-base-color, 4%);
  color: $ui-primary-color;
@ -670,13 +639,15 @@
 }

 .status-check-box {
-  border-bottom: 1px solid lighten($ui-base-color, 8%);
+  border-bottom: 1px solid $ui-secondary-color;
  display: flex;

  .status__content {
-    background: lighten($ui-base-color, 4%);
    flex: 1 1 auto;
    padding: 10px;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
  }
 }

@ -1233,20 +1204,22 @@

 .image-loader {
  position: relative;
+
+  &.image-loader--loading {
+    .image-loader__preview-canvas {
+      filter: blur(2px);
+    }
  }

-.image-loader__preview-img {
+  .image-loader__img {
    position: absolute;
    top: 0;
    left: 0;
+    right: 0;
    width: 100%;
    height: 100%;
-  filter: blur(2px);
+    background-image: none;
  }
-
-.media-modal img.image-loader__preview-img {
-  width: 100%;
-  height: 100%;
 }

 .navigation-bar {
@ -1980,6 +1953,17 @@
  @include limited-single-column('screen and (max-width: 600px)') {
    font-size: 16px;
  }
+
+  &.light {
+    color: $ui-base-color;
+    border-bottom: 2px solid lighten($ui-base-color, 27%);
+
+    &:focus,
+    &:active {
+      color: $ui-base-color;
+      border-bottom-color: $ui-highlight-color;
+    }
+  }
 }

@import 'boost';
@ -2231,11 +2215,6 @@ button.icon-button.active i.fa-retweet {
  transition: max-height 150ms ease-in-out, opacity 300ms linear;
  opacity: 1;

-  & > div {
-    background: lighten($ui-base-color, 8%);
-    padding: 15px;
-  }
-
  &.collapsed {
    max-height: 0;
    opacity: 0.5;
@ -2246,6 +2225,11 @@ button.icon-button.active i.fa-retweet {
  }
 }

+.column-header__collapsible-inner {
+  background: lighten($ui-base-color, 8%);
+  padding: 15px;
+}
+
 .column-header__setting-btn {
  &:hover {
    color: lighten($ui-primary-color, 4%);
@ -2437,67 +2421,6 @@ button.icon-button.active i.fa-retweet {
  vertical-align: middle;
 }

-.report.scrollable {
-  box-sizing: border-box;
-  display: flex;
-  flex-direction: column;
-  max-height: 100%;
-}
-
-.report__target {
-  border-bottom: 1px solid lighten($ui-base-color, 4%);
-  color: $ui-secondary-color;
-  flex: 0 0 auto;
-  padding: 10px;
-
-  strong {
-    display: block;
-    color: $primary-text-color;
-    font-weight: 500;
-  }
-}
-
-.report__statuses {
-  flex: 1 1 auto;
-}
-
-.report__textarea-wrapper {
-  flex: 0 0 100px;
-  padding: 10px;
-}
-
-.report__textarea {
-  background: transparent;
-  box-sizing: border-box;
-  border: 0;
-  border-bottom: 2px solid $ui-primary-color;
-  border-radius: 2px 2px 0 0;
-  color: $primary-text-color;
-  display: block;
-  font-family: inherit;
-  font-size: 14px;
-  margin-bottom: 10px;
-  outline: 0;
-  padding: 7px 4px;
-  resize: vertical;
-  width: 100%;
-
-  &:active,
-  &:focus {
-    border-bottom-color: $ui-highlight-color;
-    background: rgba($base-overlay-background, 0.1);
-  }
-}
-
-.report__submit {
-  margin-top: 10px;
-  overflow: hidden;
-}
-
-.report__submit-button {
-  float: right;
-}
-
 .empty-column-indicator {
  color: lighten($ui-base-color, 20%);
  background: $ui-base-color;
@ -3086,6 +3009,7 @@ button.icon-button.active i.fa-retweet {
  position: relative;

  img,
+  canvas,
  video {
    max-width: 80vw;
    max-height: 80vh;
@ -3093,7 +3017,8 @@ button.icon-button.active i.fa-retweet {
    height: auto;
  }

-  img {
+  img,
+  canvas {
    display: block;
    background: url('../images/void.png') repeat;
  }
@ -3279,6 +3204,7 @@ button.icon-button.active i.fa-retweet {
@media screen and (max-width: 400px) {
  .onboarding-modal__page-one {
    flex-direction: column;
+    align-items: normal;
  }

  .onboarding-modal__page-one__elephant-friend {
@ -3393,7 +3319,8 @@ button.icon-button.active i.fa-retweet {
 }

 .boost-modal,
-.confirmation-modal {
+.confirmation-modal,
+.report-modal {
  background: lighten($ui-secondary-color, 8%);
  color: $ui-base-color;
  border-radius: 8px;
@ -3429,7 +3356,8 @@ button.icon-button.active i.fa-retweet {
 }

 .boost-modal__action-bar,
-.confirmation-modal__action-bar {
+.confirmation-modal__action-bar,
+.report-modal__action-bar {
  display: flex;
  justify-content: space-between;
  background: $ui-secondary-color;
@ -3465,6 +3393,23 @@ button.icon-button.active i.fa-retweet {
  }
 }

+.report-modal__statuses,
+.report-modal__comment {
+  padding: 10px;
+}
+
+.report-modal__statuses {
+  min-height: 20vh;
+  overflow-y: auto;
+  overflow-x: hidden;
+}
+
+.report-modal__comment {
+  .setting-text {
+    margin-top: 10px;
+  }
+}
+
 .confirmation-modal__action-bar {
  .confirmation-modal__cancel-button {
    background-color: transparent;
@ -3480,7 +3425,8 @@ button.icon-button.active i.fa-retweet {
  }
 }

-.confirmation-modal__container {
+.confirmation-modal__container,
+.report-modal__target {
  padding: 30px;
  font-size: 16px;
  text-align: center;
@ -3601,11 +3547,16 @@ button.icon-button.active i.fa-retweet {
  background-repeat: no-repeat;
  background-size: cover;
  cursor: zoom-in;
-  display: block;
-  height: 100%;
+  display: flex;
+  align-items: center;
  text-decoration: none;
+  height: 100%;
+
+  &,
+  img {
    width: 100%;
  }
+}

 .media-gallery__gifv {
  height: 100%;
--- a/app/javascript/styles/forms.scss
+++ b/app/javascript/styles/forms.scss
@ -358,7 +358,6 @@ code {
 }

 .user_filtered_languages {
-
  & > label {
    font-family: inherit;
    font-size: 16px;
--- a/app/javascript/styles/lists.scss
+++ b/app/javascript/styles/lists.scss
@ -10,7 +10,6 @@
 .recovery-codes {
  list-style: none;
  margin: 0 auto;
-  text-align: center;

  li {
    font-size: 125%;
--- a/app/javascript/styles/tables.scss
+++ b/app/javascript/styles/tables.scss
@ -42,6 +42,18 @@
  strong {
    font-weight: 500;
  }
+
+  &.inline-table {
+    td,
+    th {
+      padding: 8px 0;
+    }
+
+    & > tbody > tr:nth-child(odd) > td,
+    & > tbody > tr:nth-child(odd) > th {
+      background: transparent;
+    }
+  }
 }

 samp {
--- a/app/mailers/admin_mailer.rb
+++ b/app/mailers/admin_mailer.rb
@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+class AdminMailer < ApplicationMailer
+  def new_report(recipient, report)
+    @report   = report
+    @me       = recipient
+    @instance = Rails.configuration.x.local_domain
+
+    locale_for_account(@me) do
+      mail to: @me.user_email, subject: I18n.t('admin_mailer.new_report.subject', instance: @instance, id: @report.id)
+    end
+  end
+end
--- a/app/mailers/application_mailer.rb
+++ b/app/mailers/application_mailer.rb
@ -4,4 +4,12 @@ class ApplicationMailer < ActionMailer::Base
  default from: ENV.fetch('SMTP_FROM_ADDRESS') { 'notifications@localhost' }
  layout 'mailer'
  helper :instance
+
+  protected
+
+  def locale_for_account(account)
+    I18n.with_locale(account.user_locale || I18n.default_locale) do
+      yield
+    end
+  end
 end
--- a/app/mailers/notification_mailer.rb
+++ b/app/mailers/notification_mailer.rb
@ -67,12 +67,4 @@ class NotificationMailer < ApplicationMailer
           )
    end
  end
-
-  private
-
-  def locale_for_account(account)
-    I18n.with_locale(account.user_locale || I18n.default_locale) do
-      yield
-    end
-  end
 end
--- a/app/models/session_activation.rb
+++ b/app/models/session_activation.rb
@ -8,31 +8,73 @@
 #  session_id      :string           not null
 #  created_at      :datetime         not null
 #  updated_at      :datetime         not null
+#  user_agent      :string           default(""), not null
+#  ip              :inet
+#  access_token_id :integer
 #

 class SessionActivation < ApplicationRecord
-  LIMIT = Rails.configuration.x.max_session_activations
+  belongs_to :access_token, class_name: 'Doorkeeper::AccessToken', dependent: :destroy

-  def self.active?(id)
+  delegate :token,
+           to: :access_token,
+           allow_nil: true
+
+  def detection
+    @detection ||= Browser.new(user_agent)
+  end
+
+  def browser
+    detection.id
+  end
+
+  def platform
+    detection.platform.id
+  end
+
+  before_create :assign_access_token
+  before_save   :assign_user_agent
+
+  class << self
+    def active?(id)
      id && where(session_id: id).exists?
    end

-  def self.activate(id)
-    activation = create!(session_id: id)
+    def activate(options = {})
+      activation = create!(options)
      purge_old
      activation
    end

-  def self.deactivate(id)
+    def deactivate(id)
      return unless id
      where(session_id: id).destroy_all
    end

-  def self.purge_old
-    order('created_at desc').offset(LIMIT).destroy_all
+    def purge_old
+      order('created_at desc').offset(Rails.configuration.x.max_session_activations).destroy_all
    end

-  def self.exclusive(id)
+    def exclusive(id)
      where('session_id != ?', id).destroy_all
    end
  end
+
+  private
+
+  def assign_user_agent
+    self.user_agent = '' if user_agent.nil?
+  end
+
+  def assign_access_token
+    superapp = Doorkeeper::Application.find_by(superapp: true)
+
+    return if superapp.nil?
+
+    self.access_token = Doorkeeper::AccessToken.create!(application_id: superapp.id,
+                                                        resource_owner_id: user_id,
+                                                        scopes: 'read write follow',
+                                                        expires_in: Doorkeeper.configuration.access_token_expires_in,
+                                                        use_refresh_token: Doorkeeper.configuration.refresh_token_enabled?)
+  end
+end
--- a/app/models/user.rb
+++ b/app/models/user.rb
@ -91,8 +91,10 @@ class User < ApplicationRecord
    settings.auto_play_gif
  end

-  def activate_session
-    session_activations.activate(SecureRandom.hex).session_id
+  def activate_session(request)
+    session_activations.activate(session_id: SecureRandom.hex,
+                                 user_agent: request.user_agent,
+                                 ip: request.ip).session_id
  end

  def exclusive_session(id)
--- a/app/services/send_interaction_service.rb
+++ b/app/services/send_interaction_service.rb
@ -13,7 +13,8 @@ class SendInteractionService < BaseService
    return if block_notification?

    envelope = salmon.pack(@xml, @source_account.keypair)
-    salmon.post(@target_account.salmon_url, envelope)
+    delivery = salmon.post(@target_account.salmon_url, envelope)
+    raise "Delivery failed for #{target_account.salmon_url}: HTTP #{delivery.code}" unless delivery.code > 199 && delivery.code < 300
  end

  private
--- a/app/views/admin_mailer/new_report.text.erb
+++ b/app/views/admin_mailer/new_report.text.erb
@ -0,0 +1,5 @@
+<%= display_name(@me) %>,
+
+<%= raw t('admin_mailer.new_report.body', target: @report.target_account.acct, reporter: @report.account.acct) %>
+
+<%= raw t('application_mailer.view')%> <%= admin_report_url(@report) %>
--- a/app/views/auth/registrations/_sessions.html.haml
+++ b/app/views/auth/registrations/_sessions.html.haml
@ -0,0 +1,23 @@
+%h6= t 'sessions.title'
+%p.muted-hint= t 'sessions.explanation'
+
+%table.table.inline-table
+  %thead
+    %tr
+      %th= t 'sessions.browser'
+      %th= t 'sessions.ip'
+      %th= t 'sessions.activity'
+  %tbody
+    - @sessions.each do |session|
+      %tr
+        %td
+          %span{ title: session.user_agent }= fa_icon session_device_icon(session)
+          = ' '
+          = t 'sessions.description', browser: t("sessions.browsers.#{session.browser}"), platform: t("sessions.platforms.#{session.platform}")
+        %td
+          %samp= session.ip
+        %td
+          - if request.session['auth_id'] == session.session_id
+            = t 'sessions.current_session'
+          - else
+            %time.time-ago{ datetime: session.updated_at.iso8601, title: l(session.updated_at) }= l(session.updated_at)
--- a/app/views/auth/registrations/edit.html.haml
+++ b/app/views/auth/registrations/edit.html.haml
@ -12,6 +12,10 @@
  .actions
    = f.button :button, t('generic.save_changes'), type: :submit

+%hr/
+
+= render 'sessions'
+
 - if open_deletion?
  %hr/

--- a/app/views/settings/two_factor_authentication/recovery_codes/index.html.haml
+++ b/app/views/settings/two_factor_authentication/recovery_codes/index.html.haml
@ -1,7 +1,7 @@
 - content_for :page_title do
  = t('settings.two_factor_authentication')

-%p.hint= t('two_factor_authentication.recovery_instructions')
+%p.hint= t('two_factor_authentication.recovery_instructions_html')

 %ol.recovery-codes
  - @recovery_codes.each do |code|
--- a/app/views/settings/two_factor_authentications/show.html.haml
+++ b/app/views/settings/two_factor_authentications/show.html.haml
@ -1,26 +1,34 @@
 - content_for :page_title do
  = t('settings.two_factor_authentication')

-.simple_form
-  %p.hint
-    = t('two_factor_authentication.description_html')
-
 - if current_user.otp_required_for_login
-    = link_to t('two_factor_authentication.disable'),
-      settings_two_factor_authentication_path,
-      data: { method: :delete },
-      class: 'block-button'
+  %p.positive-hint
+    = fa_icon 'check'
+    = ' '
+    = t 'two_factor_authentication.enabled'
+
+  %hr/
+
+  = simple_form_for @confirmation, url: settings_two_factor_authentication_path, method: :delete do |f|
+    = f.input :code, hint: t('two_factor_authentication.code_hint'), placeholder: t('simple_form.labels.defaults.otp_attempt')
+
+    .actions
+      = f.button :button, t('two_factor_authentication.disable'), type: :submit
+
+  %hr/
+
+  %h6= t('two_factor_authentication.recovery_codes')
+  %p.muted-hint
+    = t('two_factor_authentication.lost_recovery_codes')
+    = link_to t('two_factor_authentication.generate_recovery_codes'),
+      settings_two_factor_authentication_recovery_codes_path,
+      data: { method: :post }
+
 - else
+  .simple_form
+    %p.hint= t('two_factor_authentication.description_html')
+
    = link_to t('two_factor_authentication.setup'),
      settings_two_factor_authentication_path,
      data: { method: :post },
      class: 'block-button'
-
- if current_user.otp_required_for_login
-  .simple_form
-    %p.hint
-      = t('two_factor_authentication.lost_recovery_codes')
-    = link_to t('two_factor_authentication.generate_recovery_codes'),
-      settings_two_factor_authentication_recovery_codes_path,
-      data: { method: :post },
-      class: 'block-button'
--- a/app/views/user_mailer/password_change.en.html.erb
+++ b/app/views/user_mailer/password_change.en.html.erb
@ -1,3 +1,3 @@
 <p>Hello <%= @resource.email %>!</p>

-<p>We're contacting you to notify you that your password on Mastodon has been changed.</p>
+<p>We're contacting you to notify you that your password on <%= @instance %> has been changed.</p>
--- a/app/views/user_mailer/password_change.en.text.erb
+++ b/app/views/user_mailer/password_change.en.text.erb
@ -1,3 +1,3 @@
 Hello <%= @resource.email %>!

-We're contacting you to notify you that your password on Mastodon has been changed.
+We're contacting you to notify you that your password on <%= @instance %> has been changed.
--- a/app/views/user_mailer/reset_password_instructions.en.html.erb
+++ b/app/views/user_mailer/reset_password_instructions.en.html.erb
@ -1,6 +1,6 @@
 <p>Hello <%= @resource.email %>!</p>

-<p>Someone has requested a link to change your password on Mastodon. You can do this through the link below.</p>
+<p>Someone has requested a link to change your password on <%= @instance %>. You can do this through the link below.</p>

 <p><%= link_to 'Change my password', edit_password_url(@resource, reset_password_token: @token) %></p>

--- a/app/views/user_mailer/reset_password_instructions.en.text.erb
+++ b/app/views/user_mailer/reset_password_instructions.en.text.erb
@ -1,6 +1,6 @@
 Hello <%= @resource.email %>!

-Someone has requested a link to change your password on Mastodon. You can do this through the link below.
+Someone has requested a link to change your password on <%= @instance %>. You can do this through the link below.

 <%= edit_password_url(@resource, reset_password_token: @token) %>

--- a/app/workers/scheduler/doorkeeper_cleanup_scheduler.rb
+++ b/app/workers/scheduler/doorkeeper_cleanup_scheduler.rb
@ -0,0 +1,11 @@
+# frozen_string_literal: true
+require 'sidekiq-scheduler'
+
+class Scheduler::DoorkeeperCleanupScheduler
+  include Sidekiq::Worker
+
+  def perform
+    Doorkeeper::AccessToken.where('revoked_at IS NOT NULL').where('revoked_at < NOW()').delete_all
+    Doorkeeper::AccessGrant.where('revoked_at IS NOT NULL').where('revoked_at < NOW()').delete_all
+  end
+end
--- a/config/database.yml
+++ b/config/database.yml
@ -7,6 +7,10 @@ default: &default
 development:
  <<: *default
  database: mastodon_development
+  username: <%= ENV['DB_USER'] %>
+  password: <%= ENV['DB_PASS'] %>
+  host: <%= ENV['DB_HOST'] %>
+  port: <%= ENV['DB_PORT'] %>

 # Warning: The database defined as "test" will be erased and
 # re-generated from your development database when you run "rake".
@ -14,6 +18,10 @@ development:
 test:
  <<: *default
  database: mastodon_test<%= ENV['TEST_ENV_NUMBER'] %>
+  username: <%= ENV['DB_USER'] %>
+  password: <%= ENV['DB_PASS'] %>
+  host: <%= ENV['DB_HOST'] %>
+  port: <%= ENV['DB_PORT'] %>

 production:
  <<: *default
--- a/config/initializers/devise.rb
+++ b/config/initializers/devise.rb
@ -1,6 +1,6 @@
 Warden::Manager.after_set_user except: :fetch do |user, warden|
  SessionActivation.deactivate warden.raw_session['auth_id']
-  warden.raw_session['auth_id'] = user.activate_session
+  warden.raw_session['auth_id'] = user.activate_session(warden.request)
 end

 Warden::Manager.after_fetch do |user, warden|
--- a/config/locales/ca.yml
+++ b/config/locales/ca.yml
@ -360,7 +360,7 @@ ca:
    lost_recovery_codes: Els codis de recuperació et permeten recuperar l'accés al teu compte si perds el telèfon. Si has perdut els teus codis de recuperació els pots regenerar aquí. Els codis de recuperació anteriors seran anul·lats.
    manual_instructions: 'Si no pots escanejar el codi QR code i necessites introduir-lo manualment, aquí tens el secret en text plà:'
    recovery_codes_regenerated: Codis de recuperació regenerats amb èxit
-    recovery_instructions: Si alguna vegada perds l'accéss al telèfon pots utilitzar un dels codis de recuperació a continuació per recuperar l'accés al teu compte. Cal mantenir els codis de recuperació en lloc segur, per exemple imprimint-los i guardar-los amb altres documents importants.
+    recovery_instructions_html: Si alguna vegada perds l'accéss al telèfon pots utilitzar un dels codis de recuperació a continuació per recuperar l'accés al teu compte. Cal mantenir els codis de recuperació en lloc segur, per exemple imprimint-los i guardar-los amb altres documents importants.
    setup: Establir
    wrong_code: El codi introduït es invalid! Es correcta la hora del servidor i del dispositiu?
  users:
--- a/config/locales/de.yml
+++ b/config/locales/de.yml
@ -304,7 +304,7 @@ de:
    lost_recovery_codes: Wiederherstellungscodes erlauben dir, wieder den Zugang zu deinem Konto zu erlangen, falls du dein Telefon verlierst. Wenn du deine Wiederherstellungscodes verloren hast, kannst du sie hier regenerieren. Deine alten Wiederherstellungscodes werden damit ungültig gemacht.
    manual_instructions: 'Wenn du den QR-Code nicht einlesen kannst und ihn manuell eingeben musst, ist hier das Klartext-Geheimnis:'
    recovery_codes_regenerated: Wiederherstellungscodes erfolgreich regeneriert
-    recovery_instructions: Wenn du jemals den Zugang zu deinem Telefon verlierst, kannst du einen der Wiederherstellungscodes unten benutzen, um wieder auf dein Konto zugreifen zu können. Bewahre die Wiederherstellungscodes sicher auf, indem du sie beispielsweise ausdruckst und sie zusammen mit anderen wichtigen Dokumenten lagerst.
+    recovery_instructions_html: Wenn du jemals den Zugang zu deinem Telefon verlierst, kannst du einen der Wiederherstellungscodes unten benutzen, um wieder auf dein Konto zugreifen zu können. Bewahre die Wiederherstellungscodes sicher auf, indem du sie beispielsweise ausdruckst und sie zusammen mit anderen wichtigen Dokumenten lagerst.
    setup: Einrichten
    wrong_code: Der eingegebene Code war ungültig! Sind die Server- und die Gerätezeit korrekt?
  users:
--- a/config/locales/devise.pl.yml
+++ b/config/locales/devise.pl.yml
@ -3,8 +3,8 @@ pl:
  devise:
    confirmations:
      confirmed: Twój adres e-mail został poprawnie zweryfikowany.
-      send_instructions: W ciągu kilku minut otrzymasz wiadomosć e-mail z instrukcją jak potwierdzić Twój adres e-mail.
-      send_paranoid_instructions: Jeśli Twój adres e-mail już istnieje w naszej bazie danych, w ciągu kilku minut otrzymasz wiadomość e-mail z instrukcją jak potwierdzić Twój adres e-mail.
+      send_instructions: W ciągu kilku minut otrzymasz wiadomosć e-mail z instrukcją jak potwierdzić Twój adres e-mail. Jeżeli nie otrzymano wiadomości, sprawdź folder ze spamem.
+      send_paranoid_instructions: Jeśli Twój adres e-mail już istnieje w naszej bazie danych, w ciągu kilku minut otrzymasz wiadomość e-mail z instrukcją jak potwierdzić Twój adres e-mail. Jeżeli nie otrzymano wiadomości, sprawdź folder ze spamem.
    failure:
      already_authenticated: Jesteś już zalogowany/zalogowana.
      inactive: Twoje konto nie zostało jeszcze aktywowane.
@ -29,8 +29,8 @@ pl:
      success: Uwierzytelnienie przez %{kind} powiodło się.
    passwords:
      no_token: Dostęp do tej strony możliwy jest wyłącznie za pomocą odnośnika z e-maila z instrukcjami ustawienia nowego hasła. Jeśli skorzystałeś/aś z takiego odnośnika, upewnij się, że został wykorzystany/skopiowany cały odnośnik.
-      send_instructions: W ciągu kilku minut otrzymasz wiadomość e-mail z instrukcją ustawienia nowego hasła.
-      send_paranoid_instructions: Jeśli Twój adres e-mail już istnieje w naszej bazie danych, w ciągu kilku minut otrzymasz wiadomość e-mail zawierającą odnośnik pozwalający na ustawienie nowego hasła.
+      send_instructions: W ciągu kilku minut otrzymasz wiadomość e-mail z instrukcją ustawienia nowego hasła. Jeżeli nie otrzymano wiadomości, sprawdź folder ze spamem.
+      send_paranoid_instructions: Jeśli Twój adres e-mail już istnieje w naszej bazie danych, w ciągu kilku minut otrzymasz wiadomość e-mail zawierającą odnośnik pozwalający na ustawienie nowego hasła. Jeżeli nie otrzymano wiadomości, sprawdź folder ze spamem.
      updated: Twoje hasło zostało zmienione. Jesteś zalogowany/a.
      updated_not_active: Twoje hasło zostało zmienione.
    registrations:
@ -38,16 +38,16 @@ pl:
      signed_up: Twoje konto zostało utworzone. Witamy!
      signed_up_but_inactive: Twoje konto zostało utworzone. Nie mogliśmy Cię jednak zalogować, ponieważ konto nie zostało jeszcze aktywowane.
      signed_up_but_locked: Twoje konto zostało utworzone. Nie mogliśmy Cię jednak zalogować, ponieważ konto jest zablokowane.
-      signed_up_but_unconfirmed: Na Twój adres e-mail została wysłana wiadomosć z odnośnikiem potwierdzającym. Kliknij w odnośnik aby aktywować konto.
-      update_needs_confirmation: Konto zostało zaktualizowane, musimy jednak zweryfikować Twój nowy adres e-mail. Została na niego wysłana wiadomość z odnośnikiem potwierdzającym.
+      signed_up_but_unconfirmed: Na Twój adres e-mail została wysłana wiadomosć z odnośnikiem potwierdzającym. Kliknij w odnośnik aby aktywować konto. Jeżeli nie otrzymano wiadomości, sprawdź folder ze spamem.
+      update_needs_confirmation: Konto zostało zaktualizowane, musimy jednak zweryfikować Twój nowy adres e-mail. Została na niego wysłana wiadomość z odnośnikiem potwierdzającym. Jeżeli nie otrzymano wiadomości, sprawdź folder ze spamem.
      updated: Konto zostało zaktualizowane.
    sessions:
      already_signed_out: Zostałeś/aś wylogowany/a.
      signed_in: Zostałeś/aś zalogowany/a.
      signed_out: Zostałeś/aś wylogowany/a.
    unlocks:
-      send_instructions: W ciągu kilku minut otrzymasz wiadomość e-mail z instrukcjami odblokowania konta.
-      send_paranoid_instructions: Jeśli Twoje konto istnieje, instrukcje odblokowania go otrzymasz w wiadomości e-mail w ciągu kilku minut.
+      send_instructions: W ciągu kilku minut otrzymasz wiadomość e-mail z instrukcjami odblokowania konta. Jeżeli nie otrzymano wiadomości, sprawdź folder ze spamem.
+      send_paranoid_instructions: Jeśli Twoje konto istnieje, instrukcje odblokowania go otrzymasz w wiadomości e-mail w ciągu kilku minut. Jeżeli nie otrzymano wiadomości, sprawdź folder ze spamem.
      unlocked: Twoje konto zostało odblokowane. Zaloguj się aby kontynuować.
  errors:
    messages:
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@ -193,6 +193,10 @@ en:
      title: PubSubHubbub
      topic: Topic
    title: Administration
+  admin_mailer:
+    new_report:
+      body: "%{reporter} has reported %{target}"
+      subject: New report for %{instance} (#%{id})
  application_mailer:
    settings: 'Change e-mail preferences: %{link}'
    signature: Mastodon notifications from %{instance}
@ -200,7 +204,7 @@ en:
  applications:
    invalid_url: The provided URL is invalid
  auth:
-    change_password: Credentials
+    change_password: Security
    delete_account: Delete account
    delete_account_html: If you wish to delete your account, you can <a href="%{path}">proceed here</a>. You will be asked for confirmation.
    didnt_get_confirmation: Didn't receive confirmation instructions?
@ -320,6 +324,43 @@ en:
    missing_resource: Could not find the required redirect URL for your account
    proceed: Proceed to follow
    prompt: 'You are going to follow:'
+  sessions:
+    activity: Last activity
+    browser: Browser
+    browsers:
+      alipay: Alipay
+      blackberry: Blackberry
+      chrome: Chrome
+      edge: Microsoft Edge
+      firefox: Firefox
+      generic: Unknown browser
+      ie: Internet Explorer
+      micro_messenger: MicroMessenger
+      nokia: Nokia S40 Ovi Browser
+      opera: Opera
+      phantom_js: PhantomJS
+      qq: QQ Browser
+      safari: Safari
+      uc_browser: UCBrowser
+      weibo: Weibo
+    current_session: Current session
+    description: "%{browser} on %{platform}"
+    explanation: These are the web browsers currently logged in to your Mastodon account.
+    ip: IP
+    platforms:
+      adobe_air: Adobe Air
+      android: Android
+      blackberry: Blackberry
+      chrome_os: ChromeOS
+      firefox_os: Firefox OS
+      ios: iOS
+      linux: Linux
+      mac: Mac
+      other: unknown platform
+      windows: Windows
+      windows_mobile: Windows Mobile
+      windows_phone: Windows Phone
+    title: Sessions
  settings:
    authorized_apps: Authorized apps
    back: Back to Mastodon
@ -354,13 +395,15 @@ en:
    description_html: If you enable <strong>two-factor authentication</strong>, logging in will require you to be in possession of your phone, which will generate tokens for you to enter.
    disable: Disable
    enable: Enable
+    enabled: Two-factor authentication is enabled
    enabled_success: Two-factor authentication successfully enabled
-    generate_recovery_codes: Generate Recovery Codes
+    generate_recovery_codes: Generate recovery codes
    instructions_html: "<strong>Scan this QR code into Google Authenticator or a similiar TOTP app on your phone</strong>. From now on, that app will generate tokens that you will have to enter when logging in."
    lost_recovery_codes: Recovery codes allow you to regain access to your account if you lose your phone. If you've lost your recovery codes, you can regenerate them here. Your old recovery codes will be invalidated.
    manual_instructions: 'If you can''t scan the QR code and need to enter it manually, here is the plain-text secret:'
+    recovery_codes: Backup recovery codes
    recovery_codes_regenerated: Recovery codes successfully regenerated
-    recovery_instructions: If you ever lose access to your phone, you can use one of the recovery codes below to regain access to your account. Keep the recovery codes safe. (For example, you may print them and store them with other important documents.)
+    recovery_instructions_html: If you ever lose access to your phone, you can use one of the recovery codes below to regain access to your account. <strong>Keep the recovery codes safe</strong>. For example, you may print them and store them with other important documents.
    setup: Set up
    wrong_code: The entered code was invalid! Are server time and device time correct?
  users:
--- a/config/locales/fa.yml
+++ b/config/locales/fa.yml
@ -334,7 +334,7 @@ fa:
    lost_recovery_codes: با کدهای بازیابی می‌توانید اگر تلفن خود را گم کردید به حساب خود دسترسی داشته باشید. اگر کدهای بازیابی خود را گم کردید، آن‌ها را این‌جا دوباره بسازید. کدهای بازیابی قبلی شما نامعتبر خواهند شد.
    manual_instructions: 'اگر نمی‌توانید کدها را اسکن کنید و باید آن‌ها را دستی وارد کنید، متن کد امنیتی این‌جاست:'
    recovery_codes_regenerated: کدهای بازیابی با موفقیت ساخته شدند
-    recovery_instructions: اگر تلفن خود را گم کردید، می‌توانید با یکی از کدهای بازیابی زیر کنترل حساب خود را به دست بگیرید. این کدها را در جای امنی نگه دارید، مثلاً آن‌ها را چاپ کنید و کنار سایر مدارک مهم خود قرار دهید
+    recovery_instructions_html: اگر تلفن خود را گم کردید، می‌توانید با یکی از کدهای بازیابی زیر کنترل حساب خود را به دست بگیرید. این کدها را در جای امنی نگه دارید، مثلاً آن‌ها را چاپ کنید و کنار سایر مدارک مهم خود قرار دهید
    setup: راه اندازی
    wrong_code: کدی که وارد کردید نامعتبر بود! آیا ساعت سرور و ساعت دستگاه شما درست تنظیم شده‌اند؟
  users:
--- a/config/locales/fr.yml
+++ b/config/locales/fr.yml
@ -238,7 +238,7 @@ fr:
      mention: "%{name} vous a mentionné⋅e"
      new_followers_summary:
        one: Vous avez un⋅e nouvel⋅le abonné⋅e ! Youpi !
-        other: Vous avez %{count} nouveaux abonné⋅es ! Incroyable !
+        other: Vous avez %{count} nouveaux⋅elles abonné⋅e⋅s ! Incroyable !
      subject:
        one: "Une nouvelle notification depuis votre dernière visite \U0001F418"
        other: "%{count} nouvelles notifications depuis votre dernière visite \U0001F418"
@ -300,7 +300,7 @@ fr:
    lost_recovery_codes: Les codes de récupération vous permettent de retrouver les accès à votre comptre si vous perdez votre téléphone. Si vous perdez vos codes de récupération, vous pouvez les générer à nouveau ici. Vos anciens codes de récupération seront invalidés.
    manual_instructions: 'Si vous ne pouvez pas scanner ce QR code et devez l''entrer manuellement, voici le secret en clair :'
    recovery_codes_regenerated: Codes de récupération régénérés avec succès
-    recovery_instructions: Si vous perdez l'accès à votre téléphone, vous pouvez utiliser un des codes de récupération ci-dessous pour récupérer l'accès à votre compte. Conservez les codes de récupération en toute sécurité, par exemple, en les imprimant et en les stockant avec vos autres documents importants.
+    recovery_instructions_html: Si vous perdez l'accès à votre téléphone, vous pouvez utiliser un des codes de récupération ci-dessous pour récupérer l'accès à votre compte. Conservez les codes de récupération en toute sécurité, par exemple, en les imprimant et en les stockant avec vos autres documents importants.
    setup: Installer
    wrong_code: Les codes entrés sont incorrects ! L'heure du serveur et celle de votre appareil sont-elles correctes ?
  users:
--- a/config/locales/he.yml
+++ b/config/locales/he.yml
@ -342,7 +342,7 @@ he:
    lost_recovery_codes: קודי האחזור מאפשרים אחזור גישה לחשבון במידה ומכשירך אבד. במידה וקודי האחזור אבדו, ניתן לייצרם מחדש כאן. תוקף קודי האחזור הישנים יפוג.
    manual_instructions: 'במידה ולא ניתן לסרוק את קוד ה-QR אלא יש צורך להקליד אותו ידנית, להלן סוד כמוס בלתי מוצפן:'
    recovery_codes_regenerated: קודי האחזור יוצרו בהצלחה
-    recovery_instructions: במידה והגישה למכשירך תאבד, ניתן לייצר קודי אחזור למטה על מנת לאחזר גישה לחשבונך בכל עת. נא לשמור על קודי הגישה במקום בטוח )לדוגמא על ידי הדפסתם ושמירתם עם מסמכים חשובים אחרים, או שימוש בתוכנה ייעודית לניהול סיסמאות וסודות(
+    recovery_instructions_html: במידה והגישה למכשירך תאבד, ניתן לייצר קודי אחזור למטה על מנת לאחזר גישה לחשבונך בכל עת. נא לשמור על קודי הגישה במקום בטוח )לדוגמא על ידי הדפסתם ושמירתם עם מסמכים חשובים אחרים, או שימוש בתוכנה ייעודית לניהול סיסמאות וסודות(
    setup: הכנה
    wrong_code: הקוד שהוזן שגוי! האם הזמן בשרת והזמן במכשירך נכונים?
  users:
--- a/config/locales/id.yml
+++ b/config/locales/id.yml
@ -331,7 +331,7 @@ id:
    lost_recovery_codes: Kode pemulihan bisa anda gunakan untuk mendapatkan kembali akses pada akun anda jika anda kehilangan handphone anda. Jika anda kehilangan kode pemulihan, anda bisa membuatnya ulang disini. Kode pemulihan anda yang lama tidak akan bisa digunakan lagi.
    manual_instructions: 'Jika anda tidak bisa memindai kode QR dan harus memasukkannya secara manual, ini dia kode yang harus dimasukkan:'
    recovery_codes_regenerated: Kode Pemulihan berhasil dibuat ulang
-    recovery_instructions: Jika anda kehilangan akses pada handphone anda, anda bisa menggunakan kode pemulihan dibawah ini untuk mendapatkan kembali akses pada akun anda. Simpan kode pemulihan anda baik-baik, misalnya dengan mencetaknya atau menyimpannya bersama dokumen penting lainnya.
+    recovery_instructions_html: Jika anda kehilangan akses pada handphone anda, anda bisa menggunakan kode pemulihan dibawah ini untuk mendapatkan kembali akses pada akun anda. Simpan kode pemulihan anda baik-baik, misalnya dengan mencetaknya atau menyimpannya bersama dokumen penting lainnya.
    setup: Persiapan
    wrong_code: Kode yang dimasukkan tidak cocok! Apa waktu server dan waktu di handphone sudah cocok?
  users:
--- a/config/locales/io.yml
+++ b/config/locales/io.yml
@ -303,7 +303,7 @@ io:
    lost_recovery_codes: Recovery codes allow you to regain access to your account if you lose your phone. If you've lost your recovery codes, you can regenerate them here. Your old recovery codes will be invalidated.
    manual_instructions: 'If you can''t scan the QR code and need to enter it manually, here is the plain-text secret:'
    recovery_codes_regenerated: Recovery codes successfully regenerated
-    recovery_instructions: If you ever lose access to your phone, you can use one of the recovery codes below to regain access to your account. Keep the recovery codes safe, for example by printing them and storing them with other important documents.
+    recovery_instructions_html: If you ever lose access to your phone, you can use one of the recovery codes below to regain access to your account. Keep the recovery codes safe, for example by printing them and storing them with other important documents.
    setup: Set up
    wrong_code: The entered code was invalid! Are server time and device time correct?
  users:
--- a/config/locales/ja.yml
+++ b/config/locales/ja.yml
@ -360,7 +360,7 @@ ja:
    lost_recovery_codes: リカバリーコードを使用すると携帯電話を紛失した場合でもアカウントにアクセスできるようになります。 リカバリーコードを紛失した場合もここで再生成することができますが、古いリカバリーコードは無効になります。
    manual_instructions: 'QRコードがスキャンできず、手動での登録を希望の場合はこのシークレットコードを利用してください。:'
    recovery_codes_regenerated: リカバリーコードが再生成されました。
-    recovery_instructions: 携帯電話を紛失した場合、以下の内どれかのリカバリーコードを使用してアカウントへアクセスすることができます。 リカバリーコードは印刷して安全に保管してください。
+    recovery_instructions_html: 携帯電話を紛失した場合、以下の内どれかのリカバリーコードを使用してアカウントへアクセスすることができます。 リカバリーコードは印刷して安全に保管してください。
    setup: 初期設定
    wrong_code: コードが間違っています。サーバー上の時間とデバイス上の時間が一致していることを確認してください。
  users:
--- a/config/locales/nl.yml
+++ b/config/locales/nl.yml
@ -228,7 +228,7 @@ nl:
    lost_recovery_codes: Met herstelcodes kun je toegang tot jouw account krijgen wanneer je jouw telefoon bent kwijtgeraakt. Wanneer je jouw herstelcodes bent kwijtgeraakt, kan je ze hier opnieuw genereren. Jouw oude herstelcodes zijn daarna ongeldig.
    manual_instructions: 'Hieronder vind je de geheime code in platte tekst. Voor het geval je de QR-code niet kunt scannen en het handmatig moet invoeren.'
    recovery_codes_regenerated: Opnieuw genereren herstelcodes geslaagd
-    recovery_instructions: Wanneer je ooit de toegang verliest tot jouw telefoon, kan je met behulp van een van de herstelcodes hieronder opnieuw toegang krijgen tot jouw account. Zorg ervoor dat je de herstelcodes op een veilige plek bewaard. (Je kunt ze bijvoorbeeld printen en ze samen met andere belangrijke documenten bewaren.)
+    recovery_instructions_html: Wanneer je ooit de toegang verliest tot jouw telefoon, kan je met behulp van een van de herstelcodes hieronder opnieuw toegang krijgen tot jouw account. Zorg ervoor dat je de herstelcodes op een veilige plek bewaard. (Je kunt ze bijvoorbeeld printen en ze samen met andere belangrijke documenten bewaren.)
    setup: Instellen
    wrong_code: De ingevoerde code is ongeldig! Klopt de systeemtijd van de server en die van jouw apparaat?
  users:
--- a/config/locales/no.yml
+++ b/config/locales/no.yml
@ -335,7 +335,7 @@
    lost_recovery_codes: Gjenopprettingskoder lar deg gjenoppnå tilgang til din konto hvis du mister din telefon. Hvis du har mistet gjenopprettingskodene, kan du regenerere dem her. Dine gamle gjenopprettingskoder vil bli ugyldige.
    manual_instructions: 'Hvis du ikke får scannet QR-koden må du skrive inn følgende kode manuelt:'
    recovery_codes_regenerated: Generering av gjenopprettingskoder vellykket
-    recovery_instructions: Hvis du skulle miste tilgang til telefonen din, kan du bruke en av gjenopprettingskodene nedenfor til å gjenopprette tilgang til din konto. Oppbevar gjenopprettingskodene sikkert, for eksempel ved å skrive dem ut og lagre dem sammen med andre viktige dokumenter.
+    recovery_instructions_html: Hvis du skulle miste tilgang til telefonen din, kan du bruke en av gjenopprettingskodene nedenfor til å gjenopprette tilgang til din konto. Oppbevar gjenopprettingskodene sikkert, for eksempel ved å skrive dem ut og lagre dem sammen med andre viktige dokumenter.
    setup: Sett opp
    wrong_code: Den angitte koden var ugyldig! Stemmer instansens tid overalt med enhetens tid?
  users:
--- a/config/locales/oc.yml
+++ b/config/locales/oc.yml
@ -411,7 +411,7 @@ oc:
    lost_recovery_codes: Los còdi de recuperacion vos permeton d’accedir a vòstre compte se perdètz vòstre mobil. S’avètz perdut vòstres còdis de recuperacion los podètz tornar generar aquí. Los ancians còdis seràn pas mai valides.
    manual_instructions: 'Se podètz pas numerizar lo còdi QR e que vos cal picar lo còdi a la man, vaquí lo còdi en clar :'
    recovery_codes_regenerated: Los còdis de recuperacion son ben estats tornats generar
-    recovery_instructions: Se vos arriba de perdre vòstre mobil, podètz utilizar un dels còdis de recuperacion cai-jos per poder tornar accedir a vòstre compte. Gardatz los còdis en seguretat, per exemple, imprimissètz los e gardatz los amb vòstres documents importants.
+    recovery_instructions_html: Se vos arriba de perdre vòstre mobil, podètz utilizar un dels còdis de recuperacion cai-jos per poder tornar accedir a vòstre compte. Gardatz los còdis en seguretat, per exemple, imprimissètz los e gardatz los amb vòstres documents importants.
    setup: Paramètres
    wrong_code: Lo còdi picat es invalid ! L’ora es la bona sul servidor e lo mobil ?
  users:
--- a/config/locales/pl.yml
+++ b/config/locales/pl.yml
@ -193,14 +193,18 @@ pl:
      title: PubSubHubbub
      topic: Temat
    title: Administracja
+  admin_mailer:
+    new_report:
+      body: "Użytkownik %{reporter} zgłosił %{target}"
+      subject: Nowe zgłoszenie na %{instance} (#%{id})
  application_mailer:
    settings: 'Zmień ustawienia powiadamiania: %{link}'
-    signature: Powiadomienie Mastodona, wysłane przez %{instance}
+    signature: Powiadomienie Mastodona z instancji %{instance}
    view: 'Zobacz:'
  applications:
    invalid_url: Ten URL jest nieprawidłowy
  auth:
-    change_password: Uwierzytelnienie
+    change_password: Bezpieczeństwo
    delete_account: Usunięcie konta
    delete_account_html: Jeżeli próbowałeś usunąć konto, <a href="%{path}">przejdź tutaj</a>. Otrzymasz prośbę o potwierdzenie.
    didnt_get_confirmation: Nie otrzymałeś instrukcji weryfikacji?
@ -323,7 +327,44 @@ pl:
    acct: Podaj swój adres (nazwa@domena), z którego chcesz śledzić
    missing_resource: Nie udało się znaleźć adresu przekierowania z Twojej domeny
    proceed: Śledź
-    prompt: 'Śledzony będzie:'
+    prompt: 'Zamierzasz śledzić:'
+  sessions:
+    activity: Ostatnia aktywność
+    browser: Przeglądarka
+    browsers:
+      alipay: Alipay
+      blackberry: Blackberry
+      chrome: Chrome
+      edge: Microsoft Edge
+      firefox: Firefox
+      generic: nieznana przeglądarka
+      ie: Internet Explorer
+      micro_messenger: MicroMessenger
+      nokia: Nokia S40 Ovi Browser
+      opera: Opera
+      phantom_js: PhantomJS
+      qq: QQ Browser
+      safari: Safari
+      uc_browser: UCBrowser
+      weibo: Weibo
+    current_session: Obecna sesja
+    description: "%{browser} na %{platform}"
+    explanation: Przeglądarki z aktywną sesją Twojego konta.
+    ip: Adres IP
+    platforms:
+      adobe_air: Adobe Air
+      android: Android
+      blackberry: Blackberry
+      chrome_os: ChromeOS
+      firefox_os: Firefox OS
+      ios: iOS
+      linux: Linux
+      mac: macOS
+      other: nieznana platforma
+      windows: Windows
+      windows_mobile: Windows Mobile
+      windows_phone: Windows Phone
+    title: Sesje
  settings:
    authorized_apps: Uwierzytelnione aplikacje
    back: Powrót do Mastodona
@ -358,13 +399,15 @@ pl:
    description_html: Jeśli włączysz <strong>uwierzytelnianie dwuetapowe</strong>, logowanie się będzie wymagało podania tokenu wyświetlonego na Twoim telefonie.
    disable: Wyłącz
    enable: Włącz
+    enabled: Uwierzytelnianie dwuetapowe jest włączone
    enabled_success: Pomyślnie aktywowano uwierzytelnianie dwuetapowe
    generate_recovery_codes: Generuj kody zapasowe
    instructions_html: "<strong>Zeskanuj ten kod QR na swoim urządzeniu za pomocą Google Authenticator, FreeOTP lub podobnej aplikacji</strong>. Od teraz będzie ona generowała kody wymagane przy logowaniu."
    lost_recovery_codes: Kody zapasowe pozwolą uzyskać dostęp do portalu, jeżeli utracisz dostęp do telefonu. Jeżeli utracisz dostęp do nich, możesz wygenerować je ponownie tutaj. Poprzednie zostaną unieważnione.
    manual_instructions: 'Jeżeli nie możesz zeskanować kodu QR, musisz wprowadzić ten kod ręcznie:'
+    recovery_codes: Przywróć kody zapasowe
    recovery_codes_regenerated: Pomyślnie wygenerowano ponownie kody zapasowe
-    recovery_instructions: Jeżeli kiedykolwiek utracisz dostęp do telefonu, możesz wykorzystać jeden z kodów zapasowych, aby odzyskać dostęp do konta. Trzymaj je w bezpiecznym miejscu. (Na przykład, wydrukuj je i przechowuj z ważnymu dokumentami.)
+    recovery_instructions_html: Jeżeli kiedykolwiek utracisz dostęp do telefonu, możesz wykorzystać jeden z kodów zapasowych, aby odzyskać dostęp do konta. <strong>Trzymaj je w bezpiecznym miejscu</strong>. Na przykład, wydrukuj je i przechowuj z ważnymu dokumentami.
    setup: Skonfiguruj
    wrong_code: Wprowadzony kod jest niepoprawny! Czy czas serwera i urządzenia jest poprawny?
  users:
--- a/config/locales/pt-BR.yml
+++ b/config/locales/pt-BR.yml
@ -333,7 +333,7 @@ pt-BR:
    lost_recovery_codes: Códigos de recuperação permite que você recupere o acesso a sua conta se você perder seu telefone. Se você perder os códigos de recuperação, você pode regera-los aqui. Seus códigos antigos serão invalidados.
    manual_instructions: 'Se você não puder scanear o código QR e precisa digita-los manualmente, aqui está o segredo em texto.:'
    recovery_codes_regenerated: Códigos de recuperação foram gerados com sucesso
-    recovery_instructions: Se algum dia você perder o acesso ao seu telefone, você pode usar um dos códigos de abaixo para recupera o acesso a sua conta. Guarde os códigos de acesso em local seguro, por exemplo imprimindo ou guardados com documentos importantes.
+    recovery_instructions_html: Se algum dia você perder o acesso ao seu telefone, você pode usar um dos códigos de abaixo para recupera o acesso a sua conta. Guarde os códigos de acesso em local seguro, por exemplo imprimindo ou guardados com documentos importantes.
    setup: Configurar
    wrong_code: O código digitado é inválido! Os relógios do servidor e do dispositivo estão corretos?
  users:
--- a/config/locales/ru.yml
+++ b/config/locales/ru.yml
@ -332,7 +332,7 @@ ru:
    lost_recovery_codes: Коды восстановления позволяют вернуть доступ к аккаунту в случае утери телефона. Если Вы потеряли Ваши коды восстановления, вы можете заново сгенерировать их здесь. Ваши старые коды восстановления будут аннулированы.
    manual_instructions: 'Если Вы не можете отсканировать QR-код и хотите ввести его вручную, секрет представлен здесь открытым текстом:'
    recovery_codes_regenerated: Коды восстановления успешно сгенерированы
-    recovery_instructions: В случае утери доступа к Вашему телефону Вы можете использовать один из кодов восстановления, указанных ниже, чтобы вернуть доступ к аккаунту. Держите коды восстановления в безопасности, например, распечатав их и храня с другими важными документами.
+    recovery_instructions_html: В случае утери доступа к Вашему телефону Вы можете использовать один из кодов восстановления, указанных ниже, чтобы вернуть доступ к аккаунту. Держите коды восстановления в безопасности, например, распечатав их и храня с другими важными документами.
    setup: Настроить
    wrong_code: Введенный код неверен! Правильно ли установлены серверное время и время устройства?
  users:
--- a/config/locales/th.yml
+++ b/config/locales/th.yml
@ -335,7 +335,7 @@ th:
    lost_recovery_codes: Recovery codes allow you to regain access to your account if you lose your phone. If you've lost your recovery codes, you can regenerate them here. Your old recovery codes will be invalidated.
    manual_instructions: 'If you can''t scan the QR code and need to enter it manually, here is the plain-text secret:'
    recovery_codes_regenerated: Recovery codes successfully regenerated
-    recovery_instructions: If you ever lose access to your phone, you can use one of the recovery codes below to regain access to your account. Keep the recovery codes safe, for example by printing them and storing them with other important documents.
+    recovery_instructions_html: If you ever lose access to your phone, you can use one of the recovery codes below to regain access to your account. Keep the recovery codes safe, for example by printing them and storing them with other important documents.
    setup: ตั้งค่า
    wrong_code: รหัสที่กรอกไม่ถูกต้อง! Are server time and device time correct?
  users:
--- a/config/locales/tr.yml
+++ b/config/locales/tr.yml
@ -333,7 +333,7 @@ tr:
    lost_recovery_codes: Kurtarma kodları telefonunuzu kaybettiğiniz durumlarda hesabınıza erişim yapabilmenize olanak tanır. Eğer kurtarma kodlarınızı kaybettiyseniz burada tekrar oluşturabilirsiniz. Eski kurtarma kodlarınız geçersiz hale gelecektir.
    manual_instructions: 'Eğer QR kodunu taratamıyorsanız ve elle giriş yapmanız gerekiyorsa buradaki gizli düz metni girebilirsiniz:'
    recovery_codes_regenerated: Kurtarma kodları başarıyla oluşturuldu
-    recovery_instructions: 'Eğer telefonunuza erişiminizi kaybederseniz, aşağıdaki kurtarma kodlarından birini kullanarak hesabınıza giriş yapabilirsiniz. Kurtarma kodlarınızı güvenli halde tutunuz. Örneğin: kodların çıktısını alıp diğer önemli belgeleriniz ile birlikte saklayabilirsiniz.'
+    recovery_instructions_html: 'Eğer telefonunuza erişiminizi kaybederseniz, aşağıdaki kurtarma kodlarından birini kullanarak hesabınıza giriş yapabilirsiniz. Kurtarma kodlarınızı güvenli halde tutunuz. Örneğin: kodların çıktısını alıp diğer önemli belgeleriniz ile birlikte saklayabilirsiniz.'
    setup: Kuruluma başla
    wrong_code: Girdiğiniz kod geçersiz! Telefonunuzun saati geri/ileri kalmış olabilir.
  users:
--- a/config/locales/uk.yml
+++ b/config/locales/uk.yml
@ -319,7 +319,7 @@ uk:
    lost_recovery_codes: Коди відновлення дозволяють повернути доступ до акаунту у випадку втрати телефону. Якщо Ви втратили Ваші коди відновлення, Ви можете знову згенерувати їх тут. Ваші старі коди відновлення будуть анульовані.
    manual_instructions: 'Якщо Ви не можете відсканувати QR-код та хочете ввести його вручну, секрет представлений тут відкритим текстом:'
    recovery_codes_regenerated: Коди відновлення успішно згенеровані
-    recovery_instructions: У випадку втрати доступу до Вашого телефона Ви можете використати один з кодів відновлення, вказаних нижче, щоб повернути доступ до акаунту. Тримайте коди відновлення у безпеці, наприклад, роздрукувавши їх та тримаючи їх з іншими важливими документами.
+    recovery_instructions_html: У випадку втрати доступу до Вашого телефона Ви можете використати один з кодів відновлення, вказаних нижче, щоб повернути доступ до акаунту. Тримайте коди відновлення у безпеці, наприклад, роздрукувавши їх та тримаючи їх з іншими важливими документами.
    setup: Налаштувати
    wrong_code: Введений код неправильний! Чи правильно встановлені серверний час та час пристрою?
  users:
--- a/config/locales/zh-CN.yml
+++ b/config/locales/zh-CN.yml
@ -339,7 +339,7 @@ zh-CN:
    lost_recovery_codes: 如果你丢了手机，你可以用恢复代码重新访问你的账户。如果你丢了恢复代码，也可以在这里重新生成一个，不过以前的恢复代码就失效了。<del>（废话）</del>
    manual_instructions: 如果你无法扫描 QR 二维码，请手动输入这个文本密码︰
    recovery_codes_regenerated: 已成功重新生成恢复代码
-    recovery_instructions: 如果你的手机无法使用，你可以使用下面的任何恢复代码来恢复你的账号。请保管好你的恢复代码以防泄漏（例如你可以打印好它们并和重要文档一起保存）。
+    recovery_instructions_html: 如果你的手机无法使用，你可以使用下面的任何恢复代码来恢复你的账号。请保管好你的恢复代码以防泄漏（例如你可以打印好它们并和重要文档一起保存）。
    setup: 设置
    wrong_code: 你输入的认证码并不正确！可能服务器时间和你手机不一致，请检查你手机的时钟，或与本站管理员联系。
  users:
--- a/config/locales/zh-HK.yml
+++ b/config/locales/zh-HK.yml
@ -334,7 +334,7 @@ zh-HK:
    lost_recovery_codes: 讓你可以在遺失電話時，使用備用驗證碼登入。如果你遺失了備用驗證碼，可以在這裏產生一批新的，舊有的備用驗證碼將會失效。
    manual_instructions: 如果你無法掃描 QR 圖形碼，請手動輸入這個文字密碼︰
    recovery_codes_regenerated: 成功產生新的備用驗證碼
-    recovery_instructions: 如果你遺失了安裝認證器的裝置（如︰你的電話），你可以使用備用驗證碼進行登入。請確保將備用驗證碼收藏穩當，（如列印出來，和你其他重要文件一起存放）
+    recovery_instructions_html: 如果你遺失了安裝認證器的裝置（如︰你的電話），你可以使用備用驗證碼進行登入。請確保將備用驗證碼收藏穩當，（如列印出來，和你其他重要文件一起存放）
    setup: 設定
    wrong_code: 你輸入的認證碼並不正確！可能伺服器時間和你手機不一致，請檢查你手機的時鐘，或與本站管理員聯絡。
  users:
--- a/config/navigation.rb
+++ b/config/navigation.rb
@ -7,7 +7,7 @@ SimpleNavigation::Configuration.run do |navigation|
    primary.item :settings, safe_join([fa_icon('cog fw'), t('settings.settings')]), settings_profile_url do |settings|
      settings.item :profile, safe_join([fa_icon('user fw'), t('settings.edit_profile')]), settings_profile_url
      settings.item :preferences, safe_join([fa_icon('sliders fw'), t('settings.preferences')]), settings_preferences_url
-      settings.item :password, safe_join([fa_icon('cog fw'), t('auth.change_password')]), edit_user_registration_url, highlights_on: %r{/auth/edit|/settings/delete}
+      settings.item :password, safe_join([fa_icon('lock fw'), t('auth.change_password')]), edit_user_registration_url, highlights_on: %r{/auth/edit|/settings/delete}
      settings.item :two_factor_authentication, safe_join([fa_icon('mobile fw'), t('settings.two_factor_authentication')]), settings_two_factor_authentication_url, highlights_on: %r{/settings/two_factor_authentication}
      settings.item :import, safe_join([fa_icon('cloud-upload fw'), t('settings.import')]), settings_import_url
      settings.item :export, safe_join([fa_icon('cloud-download fw'), t('settings.export')]), settings_export_url
--- a/config/sidekiq.yml
+++ b/config/sidekiq.yml
@ -15,3 +15,6 @@
  feed_cleanup_scheduler:
    cron: '0 0 * * *'
    class: Scheduler::FeedCleanupScheduler
+  doorkeeper_cleanup_scheduler:
+    cron: '1 1 * * 0'
+    class: Scheduler::DoorkeeperCleanupScheduler
--- a/config/webpack/loaders/babel.js
+++ b/config/webpack/loaders/babel.js
@ -1,7 +1,10 @@
 module.exports = {
  test: /\.js$/,
  // include react-intl because transform-react-remove-prop-types needs to apply to it
-  exclude: /node_modules\/(?!react-intl)/,
+  exclude: {
+    test: /node_modules/,
+    exclude: /react-intl[\/\\](?!locale-data)/,
+  },
  loader: 'babel-loader',
  options: {
    forceEnv: process.env.NODE_ENV || 'development',
--- a/db/migrate/20170624134742_add_description_to_session_activations.rb
+++ b/db/migrate/20170624134742_add_description_to_session_activations.rb
@ -0,0 +1,7 @@
+class AddDescriptionToSessionActivations < ActiveRecord::Migration[5.1]
+  def change
+    add_column :session_activations, :user_agent, :string, null: false, default: ''
+    add_column :session_activations, :ip, :inet
+    add_foreign_key :session_activations, :users, on_delete: :cascade
+  end
+end
--- a/db/migrate/20170625140443_add_access_token_id_to_session_activations.rb
+++ b/db/migrate/20170625140443_add_access_token_id_to_session_activations.rb
@ -0,0 +1,6 @@
+class AddAccessTokenIdToSessionActivations < ActiveRecord::Migration[5.1]
+  def change
+    add_column :session_activations, :access_token_id, :integer
+    add_foreign_key :session_activations, :oauth_access_tokens, column: :access_token_id, on_delete: :cascade
+  end
+end
--- a/db/schema.rb
+++ b/db/schema.rb
@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.

-ActiveRecord::Schema.define(version: 20170623152212) do
+ActiveRecord::Schema.define(version: 20170625140443) do

  # These are extensions that must be enabled in order to support this database
  enable_extension "plpgsql"
@ -255,6 +255,9 @@ ActiveRecord::Schema.define(version: 20170623152212) do
    t.string "session_id", null: false
    t.datetime "created_at", null: false
    t.datetime "updated_at", null: false
+    t.string "user_agent", default: "", null: false
+    t.inet "ip"
+    t.integer "access_token_id"
    t.index ["session_id"], name: "index_session_activations_on_session_id", unique: true
    t.index ["user_id"], name: "index_session_activations_on_user_id"
  end
@ -404,6 +407,8 @@ ActiveRecord::Schema.define(version: 20170623152212) do
  add_foreign_key "reports", "accounts", column: "action_taken_by_account_id", on_delete: :nullify
  add_foreign_key "reports", "accounts", column: "target_account_id", on_delete: :cascade
  add_foreign_key "reports", "accounts", on_delete: :cascade
+  add_foreign_key "session_activations", "oauth_access_tokens", column: "access_token_id", on_delete: :cascade
+  add_foreign_key "session_activations", "users", on_delete: :cascade
  add_foreign_key "statuses", "accounts", column: "in_reply_to_account_id", on_delete: :nullify
  add_foreign_key "statuses", "accounts", on_delete: :cascade
  add_foreign_key "statuses", "statuses", column: "in_reply_to_id", on_delete: :nullify
--- a/lib/tasks/mastodon.rake
+++ b/lib/tasks/mastodon.rake
@ -42,6 +42,37 @@ namespace :mastodon do
    end
  end

+  desc 'Add a user by providing their email, username and initial password.' \
+       'The user will receive a confirmation email, then they must reset their password before logging in.'
+  task add_user: :environment do
+    print 'Enter email: '
+    email = STDIN.gets.chomp
+
+    print 'Enter username: '
+    username = STDIN.gets.chomp
+
+    print 'Create user and send them confirmation mail [y/N]: '
+    confirm = STDIN.gets.chomp
+    puts
+
+    if confirm.casecmp?('y')
+      password = SecureRandom.hex
+      user = User.new(email: email, password: password, account_attributes: { username: username })
+      if user.save
+        puts 'User added and confirmation mail sent to user\'s email address.'
+        puts "Here is the random password generated for the user: #{password}"
+      else
+        puts 'Following errors occured while creating new user:'
+        user.errors.each do |key, val|
+          puts "#{key}: #{val}"
+        end
+      end
+    else
+      puts 'Aborted by user.'
+    end
+    puts
+  end
+
  namespace :media do
    desc 'Removes media attachments that have not been assigned to any status for longer than a day'
    task clear: :environment do
--- a/package.json
+++ b/package.json
@ -3,10 +3,10 @@
  "license": "AGPL-3.0",
  "scripts": {
    "postversion": "git push --tags",
-    "build:development": "cross-env RAILS_ENV=development ASSET_HOST=http://0.0.0.0:8080 ./bin/webpack",
+    "build:development": "cross-env RAILS_ENV=development ./bin/webpack",
    "build:production": "cross-env RAILS_ENV=production ./bin/webpack",
    "manage:translations": "node ./config/webpack/translationRunner.js",
-    "start": "rimraf ./tmp/streaming && babel ./streaming/index.js --out-dir ./tmp && node ./tmp/streaming/index.js",
+    "start": "node ./streaming/index.js",
    "storybook": "cross-env NODE_ENV=test start-storybook -s ./public -p 9001 -c storybook",
    "test": "npm run test:lint && npm run test:mocha",
    "test:lint": "eslint -c .eslintrc.yml --ext=js app/javascript/ config/webpack/ spec/javascript/ storybook/ streaming/",
@ -24,7 +24,7 @@
    "axios": "^0.16.2",
    "babel-cli": "^6.24.1",
    "babel-core": "^6.25.0",
-    "babel-loader": "^7.0.0",
+    "babel-loader": "^7.1.0",
    "babel-plugin-lodash": "^3.2.11",
    "babel-plugin-react-intl": "^2.3.1",
    "babel-plugin-react-transform": "^2.0.2",
@ -35,7 +35,7 @@
    "babel-plugin-transform-object-rest-spread": "^6.23.0",
    "babel-plugin-transform-react-jsx-self": "^6.22.0",
    "babel-plugin-transform-react-jsx-source": "^6.22.0",
-    "babel-plugin-transform-react-remove-prop-types": "^0.4.5",
+    "babel-plugin-transform-react-remove-prop-types": "^0.4.6",
    "babel-plugin-transform-runtime": "^6.23.0",
    "babel-preset-env": "^1.5.2",
    "babel-preset-react": "^6.24.1",
@ -55,7 +55,7 @@
    "glob": "^7.1.1",
    "http-link-header": "^0.8.0",
    "immutable": "^3.8.1",
-    "intersection-observer": "^0.3.0",
+    "intersection-observer": "^0.3.2",
    "intl": "^1.2.5",
    "intl-relativeformat": "^1.3.0",
    "is-nan": "^1.2.1",
@ -65,71 +65,71 @@
    "marky": "^1.2.0",
    "mkdirp": "^0.5.1",
    "node-sass": "^4.5.2",
-    "npmlog": "^4.1.0",
+    "npmlog": "^4.1.2",
    "object-assign": "^4.1.1",
    "path-complete-extname": "^0.1.0",
-    "pg": "^6.2.4",
-    "postcss-loader": "^2.0.5",
+    "pg": "^6.4.0",
+    "postcss-loader": "^2.0.6",
    "postcss-smart-import": "^0.7.4",
    "precss": "^1.4.0",
    "prop-types": "^15.5.10",
    "punycode": "^2.1.0",
-    "rails-ujs": "^5.1.1",
-    "react": "^15.6.0",
+    "rails-ujs": "^5.1.2",
+    "react": "^15.6.1",
    "react-addons-perf": "^15.4.2",
-    "react-addons-shallow-compare": "^15.5.2",
-    "react-dom": "^15.6.0",
+    "react-addons-shallow-compare": "^15.6.0",
+    "react-dom": "^15.6.1",
    "react-immutable-proptypes": "^2.1.0",
    "react-immutable-pure-component": "^1.0.0",
    "react-intl": "^2.3.0",
    "react-motion": "^0.5.0",
-    "react-notification": "^6.7.0",
+    "react-notification": "^6.7.1",
    "react-redux": "^5.0.4",
    "react-redux-loading-bar": "^2.9.2",
    "react-router-dom": "^4.1.1",
    "react-router-scroll": "ytase/react-router-scroll#build",
    "react-simple-dropdown": "^3.0.0",
    "react-swipeable": "^4.0.1",
-    "react-textarea-autosize": "^5.0.6",
+    "react-textarea-autosize": "^5.0.7",
    "react-toggle": "^4.0.1",
    "redis": "^2.7.1",
-    "redux": "^3.6.0",
+    "redux": "^3.7.1",
    "redux-immutable": "^4.0.0",
    "redux-thunk": "^2.2.0",
    "requestidlecallback": "^0.3.0",
    "reselect": "^3.0.1",
-    "resolve-url-loader": "^2.0.2",
+    "resolve-url-loader": "^2.1.0",
    "rimraf": "^2.6.1",
-    "sass-loader": "^6.0.5",
-    "stringz": "^0.2.1",
+    "sass-loader": "^6.0.6",
+    "stringz": "^0.2.2",
    "style-loader": "^0.18.2",
    "throng": "^4.0.0",
    "tiny-queue": "^0.2.1",
-    "uuid": "^3.0.1",
+    "uuid": "^3.1.0",
    "uws": "^0.14.5",
    "webpack": "^3.0.0",
    "webpack-bundle-analyzer": "^2.8.2",
    "webpack-manifest-plugin": "^1.1.0",
    "webpack-merge": "^4.1.0",
-    "websocket.js": "^0.1.10"
+    "websocket.js": "^0.1.12"
  },
  "devDependencies": {
-    "@storybook/addon-actions": "^3.1.2",
-    "@storybook/react": "^3.1.3",
+    "@storybook/addon-actions": "^3.1.6",
+    "@storybook/react": "^3.1.6",
    "babel-eslint": "^7.2.3",
    "chai": "^4.0.1",
    "chai-enzyme": "^0.7.1",
-    "enzyme": "^2.8.2",
+    "enzyme": "^2.9.1",
    "eslint": "^3.19.0",
    "eslint-plugin-jsx-a11y": "^4.0.0",
    "eslint-plugin-react": "^6.10.3",
    "jsdom": "^10.1.0",
    "mocha": "^3.4.1",
    "react-intl-translations-manager": "^5.0.0",
-    "react-test-renderer": "^15.5.4",
-    "sinon": "^2.3.4",
+    "react-test-renderer": "^15.6.1",
+    "sinon": "^2.3.5",
    "webpack-dev-server": "lencioni/webpack-dev-server#patch-1",
-    "yargs": "^8.0.1"
+    "yargs": "^8.0.2"
  },
  "optionalDependencies": {
    "fsevents": "*"
--- a/spec/controllers/admin/domain_blocks_controller_spec.rb
+++ b/spec/controllers/admin/domain_blocks_controller_spec.rb
@ -8,17 +8,30 @@ RSpec.describe Admin::DomainBlocksController, type: :controller do
  end

  describe 'GET #index' do
-    it 'returns http success' do
-      get :index
+    around do |example|
+      default_per_page = DomainBlock.default_per_page
+      DomainBlock.paginates_per 1
+      example.run
+      DomainBlock.paginates_per default_per_page
+    end

+    it 'renders domain blocks' do
+      2.times { Fabricate(:domain_block) }
+
+      get :index, params: { page: 2 }
+
+      assigned = assigns(:domain_blocks)
+      expect(assigned.count).to eq 1
+      expect(assigned.klass).to be DomainBlock
      expect(response).to have_http_status(:success)
    end
  end

  describe 'GET #new' do
-    it 'returns http success' do
+    it 'assigns a new domain block' do
      get :new

+      expect(assigns(:domain_block)).to be_instance_of(DomainBlock)
      expect(response).to have_http_status(:success)
    end
  end
@ -33,13 +46,25 @@ RSpec.describe Admin::DomainBlocksController, type: :controller do
  end

  describe 'POST #create' do
-    it 'blocks the domain' do
+    it 'blocks the domain when succeeded to save' do
      allow(DomainBlockWorker).to receive(:perform_async).and_return(true)
+
      post :create, params: { domain_block: { domain: 'example.com', severity: 'silence' } }

      expect(DomainBlockWorker).to have_received(:perform_async)
+      expect(flash[:notice]).to eq I18n.t('admin.domain_blocks.created_msg')
      expect(response).to redirect_to(admin_domain_blocks_path)
    end
+
+    it 'renders new when failed to save' do
+      Fabricate(:domain_block, domain: 'example.com')
+      allow(DomainBlockWorker).to receive(:perform_async).and_return(true)
+
+      post :create, params: { domain_block: { domain: 'example.com', severity: 'silence' } }
+
+      expect(DomainBlockWorker).not_to have_received(:perform_async)
+      expect(response).to render_template :new
+    end
  end

  describe 'DELETE #destroy' do
@ -50,6 +75,7 @@ RSpec.describe Admin::DomainBlocksController, type: :controller do
      delete :destroy, params: { id: domain_block.id, domain_block: { retroactive: '1' } }

      expect(service).to have_received(:call).with(domain_block, true)
+      expect(flash[:notice]).to eq I18n.t('admin.domain_blocks.destroyed_msg')
      expect(response).to redirect_to(admin_domain_blocks_path)
    end
  end
--- a/spec/controllers/api/v1/reports_controller_spec.rb
+++ b/spec/controllers/api/v1/reports_controller_spec.rb
@ -21,12 +21,21 @@ RSpec.describe Api::V1::ReportsController, type: :controller do
  end

  describe 'POST #create' do
-    it 'creates a report' do
-      status = Fabricate(:status)
-      post :create, params: { status_ids: [status.id], account_id: status.account.id, comment: 'reasons' }
+    let!(:status) { Fabricate(:status) }
+    let!(:admin)  { Fabricate(:user, admin: true) }

+    before do
+      allow(AdminMailer).to receive(:new_report).and_return(double('email', deliver_later: nil))
+      post :create, params: { status_ids: [status.id], account_id: status.account.id, comment: 'reasons' }
+    end
+
+    it 'creates a report' do
      expect(status.reload.account.targeted_reports).not_to be_empty
      expect(response).to have_http_status(:success)
    end
+
+    it 'sends e-mails to admins' do
+      expect(AdminMailer).to have_received(:new_report).with(admin.account, Report)
+    end
  end
 end
--- a/spec/controllers/auth/registrations_controller_spec.rb
+++ b/spec/controllers/auth/registrations_controller_spec.rb
@ -3,39 +3,112 @@ require 'rails_helper'
 RSpec.describe Auth::RegistrationsController, type: :controller do
  render_views

+  shared_examples 'checks for enabled registrations' do |path|
+    around do |example|
+      open_registrations = Setting.open_registrations
+      example.run
+      Setting.open_registrations = open_registrations
+    end
+
+    it 'redirects if it is in single user mode while it is open for registration' do
+      Fabricate(:account)
+      Setting.open_registrations = true
+      expect(Rails.configuration.x).to receive(:single_user_mode).and_return(true)
+
+      get path
+
+      expect(response).to redirect_to '/'
+    end
+
+    it 'redirects if it is not open for registration while it is not in single user mode' do
+      Setting.open_registrations = false
+      expect(Rails.configuration.x).to receive(:single_user_mode).and_return(false)
+
+      get path
+
+      expect(response).to redirect_to '/'
+    end
+  end
+
+  describe 'GET #edit' do
+    it 'returns http success' do
+      request.env["devise.mapping"] = Devise.mappings[:user]
+      sign_in(Fabricate(:user))
+      get :edit
+      expect(response).to have_http_status(:success)
+    end
+  end
+
+  describe 'GET #update' do
+    it 'returns http success' do
+      request.env["devise.mapping"] = Devise.mappings[:user]
+      sign_in(Fabricate(:user), scope: :user)
+      post :update
+      expect(response).to have_http_status(:success)
+    end
+  end
+
  describe 'GET #new' do
    before do
-      Setting.open_registrations = true
      request.env["devise.mapping"] = Devise.mappings[:user]
    end

+    context do
+      around do |example|
+        open_registrations = Setting.open_registrations
+        example.run
+        Setting.open_registrations = open_registrations
+      end
+
      it 'returns http success' do
+        Setting.open_registrations = true
        get :new
        expect(response).to have_http_status(:success)
      end
    end

+    include_examples 'checks for enabled registrations', :new
+  end
+
  describe 'POST #create' do
    let(:accept_language) { Rails.application.config.i18n.available_locales.sample.to_s }

-    before do
+    before { request.env["devise.mapping"] = Devise.mappings[:user] }
+
+    context do
+      around do |example|
+        open_registrations = Setting.open_registrations
+        example.run
+        Setting.open_registrations = open_registrations
+      end
+
+      subject do
        Setting.open_registrations = true
-      request.env["devise.mapping"] = Devise.mappings[:user]
        request.headers["Accept-Language"] = accept_language
        post :create, params: { user: { account_attributes: { username: 'test' }, email: 'test@example.com', password: '12345678', password_confirmation: '12345678' } }
      end

      it 'redirects to login page' do
+        subject
        expect(response).to redirect_to new_user_session_path
      end

      it 'creates user' do
+        subject
        user = User.find_by(email: 'test@example.com')
        expect(user).to_not be_nil
        expect(user.locale).to eq(accept_language)
      end
    end

+    it 'does nothing if user already exists' do
+      Fabricate(:user, account: Fabricate(:account, username: 'test'))
+      subject
+    end
+
+    include_examples 'checks for enabled registrations', :create
+  end
+
  describe 'DELETE #destroy' do
    let(:user) { Fabricate(:user) }

--- a/spec/controllers/settings/two_factor_authentications_controller_spec.rb
+++ b/spec/controllers/settings/two_factor_authentications_controller_spec.rb
@ -79,15 +79,43 @@ describe Settings::TwoFactorAuthenticationsController do
      user.update(otp_required_for_login: true)
    end

-    it 'turns off otp requirement if signed in' do
+    context 'when signed in' do
+      before do
        sign_in user, scope: :user
-      post :destroy
+      end
+
+      it 'turns off otp requirement with correct code' do
+        expect_any_instance_of(User).to receive(:validate_and_consume_otp!) do |value, arg|
+          expect(value).to eq user
+          expect(arg).to eq '123456'
+          true
+        end
+
+        post :destroy, params: { form_two_factor_confirmation: { code: '123456' } }

        expect(response).to redirect_to(settings_two_factor_authentication_path)
        user.reload
        expect(user.otp_required_for_login).to eq(false)
      end

+      it 'does not turn off otp if code is incorrect' do
+        expect_any_instance_of(User).to receive(:validate_and_consume_otp!) do |value, arg|
+          expect(value).to eq user
+          expect(arg).to eq '057772'
+          false
+        end
+
+        post :destroy, params: { form_two_factor_confirmation: { code: '057772' } }
+
+        user.reload
+        expect(user.otp_required_for_login).to eq(true)
+      end
+
+      it 'raises ActionController::ParameterMissing if code is missing' do
+        expect { post :destroy }.to raise_error(ActionController::ParameterMissing)
+      end
+    end
+
    it 'redirects if not signed in' do
      get :show
      expect(response).to redirect_to '/auth/sign_in'
--- a/spec/fabricators/domain_block_fabricator.rb
+++ b/spec/fabricators/domain_block_fabricator.rb
@ -1,3 +1,3 @@
 Fabricator(:domain_block) do
-  domain "example.com"
+  domain { sequence(:domain) { |i| "#{i}#{Faker::Internet.domain_name}" } }
 end
--- a/spec/rails_helper.rb
+++ b/spec/rails_helper.rb
@ -23,7 +23,7 @@ Devise::Test::ControllerHelpers.module_eval do
    original_sign_in(resource, scope: scope)

    SessionActivation.deactivate warden.raw_session["auth_id"]
-    warden.raw_session["auth_id"] = resource.activate_session
+    warden.raw_session["auth_id"] = resource.activate_session(warden.request)
  end
 end

--- a/streaming/.babelrc
+++ b/streaming/.babelrc
@ -1,15 +0,0 @@
-{
-  "presets": [
-    [
-      "env",
-      {
-        "targets": {
-          "node": "current"
-        }
-      }
-    ]
-  ],
-  "plugins": [
-    "transform-object-rest-spread"
-  ]
-}
--- a/streaming/index.js
+++ b/streaming/index.js
@ -1,14 +1,14 @@
-import os from 'os';
-import throng from 'throng';
-import dotenv from 'dotenv';
-import express from 'express';
-import http from 'http';
-import redis from 'redis';
-import pg from 'pg';
-import log from 'npmlog';
-import url from 'url';
-import WebSocket from 'uws';
-import uuid from 'uuid';
+const os = require('os');
+const throng = require('throng');
+const dotenv = require('dotenv');
+const express = require('express');
+const http = require('http');
+const redis = require('redis');
+const pg = require('pg');
+const log = require('npmlog');
+const url = require('url');
+const WebSocket = require('uws');
+const uuid = require('uuid');

 const env = process.env.NODE_ENV || 'development';

@ -78,7 +78,11 @@ const startWorker = (workerId) => {

  const pgConfigs = {
    development: {
+      user:     process.env.DB_USER || pg.defaults.user,
+      password: process.env.DB_PASS || pg.defaults.password,
      database: 'mastodon_development',
+      host:     process.env.DB_HOST || pg.defaults.host,
+      port:     process.env.DB_PORT || pg.defaults.port,
      max:      10,
    },

@ -242,7 +246,7 @@ const startWorker = (workerId) => {
    accountFromRequest(req, next);
  };

-  const errorMiddleware = (err, req, res, next) => {  // eslint-disable-line no-unused-vars
+  const errorMiddleware = (err, req, res, {}) => {
    log.error(req.requestId, err.toString());
    res.writeHead(err.statusCode || 500, { 'Content-Type': 'application/json' });
    res.end(JSON.stringify({ error: err.statusCode ? err.toString() : 'An unexpected error occurred' }));
--- a/yarn.lock
+++ b/yarn.lock