Commit Graph

82 Commits (1b1ecf8ee2f7a032b67f333d9e2f2d809e3ff50c)

Author SHA1 Message Date
Eugen Rochko 1dd243cc09 Add time zone preference (#25342) 2023-06-10 03:29:37 +02:00
Eugen Rochko ef0c6a43ed Change user backups to use expiring URLs for download when possible (#24136) 2023-03-16 22:46:52 +01:00
Nick Schonning 994cb73f56 Fix more haml-lint Rubocop (#24107) 2023-03-15 20:07:43 +01:00
Matt Jankowski 471346fd3a User mailer spec coverage improvements (#23905) 2023-03-04 17:16:11 +01:00
Eugen Rochko e6bd4125b8 Remove unnecessary sections from welcome e-mail (#19299) 2022-10-06 00:03:52 +02:00
Eugen Rochko c04359a63b Change path of privacy policy page (#19249) 2022-09-29 06:22:12 +02:00
Eugen Rochko 03d2cb5146 Change brand color and logotypes (#18592)
- Add rake task for generating Apple/Android icons and favicons from SVG
- Add rake task for generating PNG icons and logos for e-mails from SVG
- Remove obsolete Microsoft icons and configuration
- Remove PWA shortcut icons
2022-06-09 22:25:23 +02:00
Eugen Rochko f982d56b4e Remove sign-in token authentication, instead send e-mail about new sign-in (#17970) 2022-04-06 20:58:12 +02:00
Eugen Rochko 5a7219e532 Refactor formatter (#17828)
* Refactor formatter

* Move custom emoji pre-rendering logic to view helpers

* Move more methods out of Formatter

* Fix code style issues

* Remove Formatter

* Add inline poll options to RSS feeds

* Remove unused helper method

* Fix code style issues

* Various fixes and improvements

* Fix test
2022-03-26 02:53:34 +01:00
Claire c8f4894518 Change text version of warning mail to mention appeals instead of mails (#17725)
Also, the instruction to reply to e-mail would probably not work in many cases
where the notifications e-mail address is not able to receive incoming emails
or the mailbox is not actively monitored.
2022-03-09 12:11:11 +01:00
Eugen Rochko 82f8d19424 Add appeals (#17364)
* Add appeals

* Add ability to reject appeals and ability to browse pending appeals in admin UI

* Add strikes to account page in settings

* Various fixes and improvements

- Add separate notification setting for appeals, separate from reports
- Fix style of links in report/strike header
- Change approving an appeal to not restore statuses (due to federation complexities)
- Change style of successfully appealed strikes on account settings page
- Change account settings page to only show unappealed or recently appealed strikes

* Change appealed_at to overruled_at

* Fix missing method error
2022-02-14 21:27:53 +01:00
Eugen Rochko 2fb76550a9 Add notifications for statuses deleted by moderators (#17204) 2022-01-17 09:41:33 +01:00
Eugen Rochko 6d78b064e3 Fix missing source strings and inconsistent lead text style in admin UI (#16052) 2021-04-17 11:12:49 +02:00
santiagorodriguez96 f142983484 Add WebAuthn as an alternative 2FA method (#14466)
* feat: add possibility of adding WebAuthn security keys to use as 2FA

This adds a basic UI for enabling WebAuthn 2FA. We did a little refactor
to the Settings page for editing the 2FA methods – now it will list the
methods that are available to the user (TOTP and WebAuthn) and from
there they'll be able to add or remove any of them.
Also, it's worth mentioning that for enabling WebAuthn it's required to
have TOTP enabled, so the first time that you go to the 2FA Settings
page, you'll be asked to set it up.
This work was inspired by the one donde by Github in their platform, and
despite it could be approached in different ways, we decided to go with
this one given that we feel that this gives a great UX.

Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>

* feat: add request for WebAuthn as second factor at login if enabled

This commits adds the feature for using WebAuthn as a second factor for
login when enabled.
If users have WebAuthn enabled, now a page requesting for the use of a
WebAuthn credential for log in will appear, although a link redirecting
to the old page for logging in using a two-factor code will also be
present.

Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>

* feat: add possibility of deleting WebAuthn Credentials

Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>

* feat: disable WebAuthn when an Admin disables 2FA for a user

Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>

* feat: remove ability to disable TOTP leaving only WebAuthn as 2FA

Following examples form other platforms like Github, we decided to make
Webauthn 2FA secondary to 2FA with TOTP, so that we removed the
possibility of removing TOTP authentication only, leaving users with
just WEbAuthn as 2FA. Instead, users will have to click on 'Disable 2FA'
in order to remove second factor auth.
The reason for WebAuthn being secondary to TOPT is that in that way,
users will still be able to log in using their code from their phone's
application if they don't have their security keys with them – or maybe
even lost them.

* We had to change a little the flow for setting up TOTP, given that now
  it's possible to setting up again if you already had TOTP, in order to
  let users modify their authenticator app – given that now it's not
  possible for them to disable TOTP and set it up again with another
  authenticator app.
  So, basically, now instead of storing the new `otp_secret` in the
  user, we store it in the session until the process of set up is
  finished.
  This was because, as it was before, when users clicked on 'Edit' in
  the new two-factor methods lists page, but then went back without
  finishing the flow, their `otp_secret` had been changed therefore
  invalidating their previous authenticator app, making them unable to
  log in again using TOTP.

Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>

* refactor: fix eslint errors

The PR build was failing given that linting returning some errors.
This commit attempts to fix them.

* refactor: normalize i18n translations

The build was failing given that i18n translations files were not
normalized.
This commits fixes that.

* refactor: avoid having the webauthn gem locked to a specific version

* refactor: use symbols for routes without '/'

* refactor: avoid sending webauthn disabled email when 2FA is disabled

When an admins disable 2FA for users, we were sending two mails
to them, one notifying that 2FA was disabled and the other to notify
that WebAuthn was disabled.
As the second one is redundant since the first email includes it, we can
remove it and send just one email to users.

* refactor: avoid creating new env variable for webauthn_origin config

* refactor: improve flash error messages for webauthn pages

Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>
2020-08-24 16:46:27 +02:00
Eugen Rochko 2dbf6bc5ad Add e-mail-based sign in challenge for users with disabled 2FA (#14013) 2020-06-09 10:23:06 +02:00
ThibG add34dd132 Fix “Email changed” notification sometimes having wrong e-mail (#13475)
* Fix “Email changed” notification sometimes having wrong e-mail

Fixes #6778

The root of the issue is that `send_devise_notification` was called before
the changes were properly commited to the database, causing the mailer to
pick previous values if running too early.

Devise's documentation provides guidance on how to handle that[1][2], however,
I have found it to not be working, as the following happens, in that order:
- `send_devise_notification` is called for the `email_changed` notification.
  In that case, `changed?` is false and `saved_changes?` is true, so
  if we use the former, we have the same issue.
- the `after_commit` hook is called
- `send_devise_notification` is called for the `confirmation_instructions`
  notification.
  In that case, `changed?` is still false, and `saved_changes?` still true,
  so if we use the latter, that second notification email is simply not
  going to be sent (as we would be queuing the notification *after*
  executing the after_commit hook).

This is because it may be called from either an `after_update` or
`after_commit` hook, the difference not being a call to `save` but the
transaction actually being committed to the database. This may arguably
be a bug in Devise, or Devise's notification.

The proposed workaround is inspired by Devise's documentation but checks
whether a transaction is open to make the call whether to immediately
send the notification or defer it to the `after_commit` hook.

[1]: https://www.rubydoc.info/github/plataformatec/devise/Devise%2FModels%2FAuthenticatable:send_devise_notification
[2]: 406915cb78/lib/devise/models/authenticatable.rb (L133-L194)

* Fix cases when sending notifications without changing the model

* Defer sending if and only if in transaction including current record
2020-04-15 16:13:44 +02:00
Eugen Rochko 1781358bd9 Add password challenge to 2FA settings, e-mail notifications (#11878)
Fix #3961
2019-09-18 16:37:27 +02:00
Eugen Rochko a74b17635b Fix nil error in warning e-mail template (#11812) 2019-09-12 01:51:01 +02:00
Eugen Rochko 97beb5d3de Fix error in user warning template (#11741) 2019-09-03 05:57:30 +02:00
Eugen Rochko 35242b7dc2 Fix error in warning e-mail template (#11698) 2019-08-30 01:34:59 +02:00
Eugen Rochko 9959cdc79f Add option to include reported statuses in warning e-mail (#11639) 2019-08-23 22:37:23 +02:00
Yamagishi Kazutoshi e0e72c90b6 Bump webpacker from 3.5.5 to 4.0.2 (#10277)
Bumps [webpacker](https://github.com/rails/webpacker) from 3.5.5 to 4.0.2.
- [Release notes](https://github.com/rails/webpacker/releases)
- [Changelog](https://github.com/rails/webpacker/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rails/webpacker/compare/v3.5.5...v4.0.2)

Signed-off-by: dependabot[bot] <support@dependabot.com>
Co-authored-by: Yamagishi Kazutoshi <ykzts@desire.sh>
2019-03-15 15:05:31 +01:00
Eugen Rochko 73fb7bfa0f Admission-based registrations mode (#10250)
Fix #6856
Fix #6951
2019-03-14 05:28:30 +01:00
Eugen Rochko bbf9f4f93b Add REST API for creating an account (#9572)
* Add REST API for creating an account

The method is available to apps with a token obtained via the client
credentials grant. It creates a user and account records, as well as
an access token for the app that initiated the request. The user is
unconfirmed, and an e-mail is sent as usual.

The method returns the access token, which the app should save for
later. The REST API is not available to users with unconfirmed
accounts, so the app must be smart to wait for the user to click a
link in their e-mail inbox.

The method is rate-limited by IP to 5 requests per 30 minutes.

* Redirect users back to app from confirmation if they were created with an app

* Add tests

* Return 403 on the method if registrations are not open

* Require agreement param to be true in the API when creating an account
2018-12-24 19:12:38 +01:00
Eugen Rochko eb2994d454 Remove links to bridge.joinmastodon.org (non-functional) (#9608)
Add link to profile directory
2018-12-22 23:32:00 +01:00
Eugen Rochko 2e0d617b8b Add moderation warnings (#9519)
* Add moderation warnings

Replace individual routes for disabling, silencing, and suspending
a user, as well as the report update route, with a unified account
action controller that allows you to select an action (none,
disable, silence, suspend) as well as whether it should generate an
e-mail notification with optional custom text. That notification,
with the optional custom text, is saved as a warning.

Additionally, there are warning presets you can configure to save
time when performing the above.

* Use Account#local_username_and_domain
2018-12-22 20:02:09 +01:00
ThibG 720a45e99f Fix e-mail changed notification (fixes #6778) (#6835)
In Devise::Mailer#email_changed, the new email might be in the email attr.
See: https://github.com/plataformatec/devise/blob/master/app/views/devise/mailer/email_changed.html.erb
2018-03-19 20:07:47 +01:00
Eugen Rochko f6884555d7 Account archive download (#6460)
* Fix #201: Account archive download

* Export actor and private key in the archive

* Optimize BackupService

- Add conversation to cached associations of status, because
  somehow it was forgotten and is source of N+1 queries
- Explicitly call GC between batches of records being fetched
  (Model class allocations are the worst offender)
- Stream media files into the tar in 1MB chunks
  (Do not allocate media file (up to 8MB) as string into memory)
- Use #bytesize instead of #size to calculate file size for JSON
  (Fix FileOverflow error)
- Segment media into subfolders by status ID because apparently
  GIF-to-MP4 media are all named "media.mp4" for some reason

* Keep uniquely generated filename in Paperclip::GifTranscoder

* Ensure dumped files do not overwrite each other by maintaing directory partitions

* Give tar archives a good name

* Add scheduler to remove week-old backups

* Fix code style issue
2018-02-21 23:21:32 +01:00
Eugen Rochko 896cadceed Improve HTML e-mails based on Litmus tests (#6301)
* Use PNG images in HTML e-mails

* Make webpack use URLs with host so fonts load inside HTML e-mails

Convert this back to a relative URL in the premailer CSS loader
since local requests are quicker

* Improve responsive design

* Add missing PNG icon
2018-01-20 01:32:21 +01:00
Eugen Rochko 5f9c017c01 Make text e-mails consistent with HTML ones in UserMailer (#6291)
* Make text e-mails consistent with HTML ones in UserMailer

* Fix UserMailer specs
2018-01-20 01:32:05 +01:00
Eugen Rochko b0f2bff481 Replace tutorial modal with welcome e-mail (#6273)
* Remove onboarding modal

* Welcome e-mail

* Send welcome e-mail after confirmation

* Remove obsolete translations
2018-01-18 19:17:25 +01:00
Yamagishi Kazutoshi d60d5fbd26 Change image URL in mailer to full path (#6264) 2018-01-16 06:26:46 +01:00
Eugen Rochko 9613c3238c HTML e-mails for UserMailer (#6256)
- premailer gem to turn CSS into inline styles automatically
- rework UserMailer templates
- reword UserMailer templates
2018-01-16 03:29:11 +01:00
SerCom_KC 154bd8db56 Update Simplified Chinese translations (#6215)
* i18n: (zh-CN) Add translations of #6125

* i18n: (zh-CN) Add translations of #6132

* i18n: (zh-CN) Add translations of #6099

* i18n: (zh-CN) Add translations of #6071

* i18n: (zh-CN) Improve translations
2018-01-07 17:32:50 +09:00
Quenty31 cf9323449e l10n Occitan language: mailer update (#6193)
* Create email_changed.oc.html.erb

* Create email_changed.oc.text.erb

* Update email_changed.oc.html.erb

* Update email_changed.oc.html.erb

* Create reconfirmation_instructions.oc.html.erb

* Create reconfirmation_instructions.oc.text.erb

* Update confirmation_instructions.oc.html.erb

* Update confirmation_instructions.oc.text.erb

* Update confirmation_instructions.oc.html.erb

* Update reconfirmation_instructions.oc.html.erb

* Update reconfirmation_instructions.oc.text.erb

* Update reconfirmation_instructions.oc.html.erb
2018-01-05 18:59:43 +09:00
Marcin Mikołajczak b83fb8b107 i18n: Update Polish translation (#6168)
Signed-off-by: Marcin Mikołajczak <me@m4sk.in>
2018-01-03 22:45:24 +09:00
Yamagishi Kazutoshi d50d61a90c Add Japanese translations #5997, #6003, #6004, #6071, #6099, #6125 and #6132 (#6167)
* yarn manage:translations

* Add Japanese translation for #5997

* Add Japanese translation for #6003

* Add Japanese translation for #6004

* Add Japanese translation for #6071

* Add Japanese translation for #6099

* Add Japanese translation for #6125

* Add Japanese translation for #6132
2018-01-03 21:00:39 +09:00
Patrick Figel 3c20cfd734 Add confirmation step for email changes (#6071)
* Add confirmation step for email changes

This adds a confirmation step for email changes of existing users.
Like the initial account confirmation, a confirmation link is sent
to the new address.

Additionally, a notification is sent to the existing address when
the change is initiated. This message includes instruction to reset
the password immediately or to contact the instance admin if the
change was not initiated by the account owner.

Fixes #3871

* Add review fixes
2018-01-02 16:55:00 +01:00
Branko Kokanovic 1c4142da5b Adding Serbian latin translations (#6146)
Serbian latin (sr-Latn) is generated automatically from Serbian (sr) translation. Also changed some wording in original (Serbian) translation.
2018-01-02 20:39:12 +09:00
Branko Kokanovic 34a90dc266 Adding Serbian translation (#6133)
* Adding Serbian translation

* i18n-tasks normalize
2017-12-31 17:28:20 +09:00
Anna e só c4c9003f84 l10n: PT-BR translation updated (#5681)
* Improved e-mail messages; delted repeated words

* pt-BR.json translations updated

* Revert "pt-BR.json translations updated"

This reverts commit 108c460531196fed6e6d14f93e8d8d047c835ffd.

* Updated pt-BR.json

* pt-BR.yml updated
2017-11-14 11:07:38 +09:00
Quenty31 a7db7bdd96 i10n OC: Memorial (#5615) + #5467 (#5623)
* Changed ĩ => ï

* Changed ĩ => ï

* Add ability to disable login and mark accounts as memorial (#5615)
2017-11-08 15:19:49 +01:00
SerCom_KC 282f0d7479 Updating Chinese (Simplified) translations (#5508)
* i18n: (zh-CN) fix punctuations and spaces
Spaces are fixed according to https://github.com/sparanoid/chinese-copywriting-guidelines

* i18n: (zh-CN) fix punctuation

* i18n: (zh-CN) Adapt official translation of Discourse Privacy Policy from GitHub, with minor fixes
https://github.com/discourse/discourse/blob/master/config/locales/server.zh_CN.yml#L2677

* i18n: (zh-CN) Update missing translations

* i18n: (zh-CN) Fixing errors

* i18n: (zh-CN) Fix indent error

* i18n: (zh-CN) Fix language tag

* i18n: (zh-CN) Remove quotes

* i18n: (zh-CN) Update translation (#5485)

* i18n: (zh-CN) Remove whitespaces, x -> ×

* i18n: (zh-CN) Rewording on time distance

* i18n: (zh-CN) Overall improvements

* i18n: (zh-CN) i18n-tasks normalization

* i18n: (zh-CN) Add missing translation
2017-10-30 12:34:58 +09:00
Håkan Eriksson c06052b7cf Swedish translation (#5406)
* Swedish file added

* Swedish file added

* Swedish file updated

* Swedish languagefile added

* Add Swedish translation

* Add Swedish translation

* Started the Swedish translation

* Added Swedish lang settings

* Updating Swedish language

* Updating Swedish language

* Updating Swedish language

* Updating Swedish language

* Updating Swedish language

* Updating Swedish language

* Swedish language completed and added

* Swedish language Simple_form added

* Swedish language Divise added

* Swedish language doorkeeper added

* Swedish language - now all file complete
2017-10-17 13:41:36 +09:00
Jeong Arm 985832e241 Fix stupid typo (#5184) 2017-10-02 23:27:52 +02:00
Jeong Arm ee21576c19 Korean translation (#5185)
* Add missing Korean translations

* Add Korean email confirmation template

* Fix Korean typo
2017-10-02 23:26:28 +02:00
Jeong Arm 0ddea5765c Append confirmation link as plain text (#5146)
* Append confirmation link as plain text

Some mail application is malfunctioning with links.

* Change description text
2017-10-02 07:21:46 +02:00
BruWalfas f4d0774877 A few updates to the Spanish translation and some typos fixing (#4997)
* So Spanish. Much changes. Wow.

* Some little fixes

* Updated es.yml, and fixed some ortographical errors

* Some little changes to simple_form.es.yml

* Yeah, so much translations

* Spanish e-mail messages

* Remove unused message
2017-09-19 07:47:48 +09:00
Mingye Wang 9b85c3a13f Minor Chinese check & jsx addition (#4973)
* zh-*: transition from "like" back to "fav"

This commit reverts the translation for the yellow-star "fav" button
back to "fav" in Chinese. Some ambuiguity between "like" and "fav" is
deliberately used in zh-TW/HK by using the existing phrase "最爱"
(favorite (adj.), lit. love-most) instead of "收藏" (favourite (v.),
"collect") in some instances.

Fixes #3511.

* zh-*: apply suggestions for PR #4557

* zh-cn: de-monetize ya account

In Chinese two separate characters, 账 and 帐, can be used to spell the
word for account (账/帐户). However, the one with a 贝 on the left is
evolved from the latter specifically for monetary purposes. Since
people usually can't figure out which one to use, it might be a good
idea to use the original not-so-money one.

* zh-*: complete jsx translation
2017-09-16 18:48:38 +02:00
Anna e só d639474d8c l10n: Full PT-BR translation (#4882)
* devise.pt-BR.yml now fully translated

* pt-BR.json now fully translated

* pt-BR.yml partially translated; 46 lines left

* pt-BR.yml now fully translated

* simple_form.pt-BR.yml fully translated

* doorkeeper.pt-BR.yml now fully translated

* E-mail instructions on app/views/user_mailer added and fully translated

* PT-BR translation for #4871

* Deleted an unwanted caracter on pt-BR.yml

* Fixing typos on pt-BR.yml

* Added translation for Pinned toots tab on pt-BR.json

* Added missing translation for navigation_bar.pins
2017-09-11 08:40:29 +09:00