Commit Graph

1012 Commits (3343de96a04b62b23a8ef5429e31f381076535f2)

Author SHA1 Message Date
ThibG 8b552d6f0c Fix unpermitted operations on custom emojis leading to cryptic errors ()
* Display appropriate error when performing unpermitted operation on custom emoji

Fixes 

* Remove links to custom emoji actions not performable by moderators
2020-06-05 15:23:27 +02:00
Eugen Rochko 9de5c70980 Fix wrong route helper in encrypted messages controller ()
And add `created_at` to encrypted message serializer
2020-06-03 20:32:15 +02:00
ThibG 8d57f6c4b4 Fix account redirect confirmation message talking about moved followers ()
Fixes 
2020-06-03 20:18:19 +02:00
Eugen Rochko b864e78db8 Add E2EE API () 2020-06-02 19:24:53 +02:00
ThibG 60bb6ac6f4 Fix webfinger returning wrong status code on malformed or missing param ()
Fixes 
2020-05-14 23:28:06 +02:00
ThibG f48e191e8e Fix sr locale being selected over sr-Latn ()
* Fix sr locale being selected over sr-Latn

* Update tests
2020-05-11 01:09:21 +02:00
Eugen Rochko fc7cad8b2d Add ability to remove identity proofs from account ()
Fix 
2020-05-10 11:21:10 +02:00
Takeshi Umeda 861661100c Add remote only to public timeline ()
* Add remote only to public timeline

* Fix code style
2020-05-10 10:36:18 +02:00
ThibG e9227d8c10 Remove confusing “You are already signed in.” flash message ()
When attempting to access the log-in page while already logged in,
Devise's `require_no_authentication` kicks in and sets a flash
message “You are already signed in.”

In almost all cases, this also causes a redirect to /web, which
does not display or clear flash messages, thus leaving the message
to a potentially much later date, like for instance, accessing
/preferences several minutes after being redirected to /web.
2020-05-10 10:16:39 +02:00
ThibG 5479d33843 Fix own following/followers not showing muted users ()
Fixes 
2020-05-08 20:36:34 +02:00
Eugen Rochko e80d4479c7 Add more ActivityPub controller tests () 2020-05-03 22:19:24 +02:00
Eugen Rochko 0ca06d0ba9 Add more tests for ActivityPub controllers () 2020-05-03 16:30:36 +02:00
sternenseemann 674005c08e Allow users to delete their header and avatar ()
This is achieved by sending a DELETE request to
/settings/profile/pictures/{avatar,header} via a link that is part of
the upload form's hint of the respective picture.
2020-04-20 14:03:03 +02:00
Takeshi Umeda f5606cdab4 Add local only to hashtag timeline () 2020-04-18 21:52:39 +02:00
Eugen Rochko 2d3219549b Change delivery failure tracking to work with hostnames instead of URLs () 2020-04-15 20:33:24 +02:00
Eugen Rochko 50fa554899 Add rate limit for reporting () 2020-04-05 14:40:08 +02:00
Eugen Rochko 6932e0e2af Add ability to filter audit log in admin UI () 2020-04-03 13:06:34 +02:00
Takeshi Umeda 1c2a286244 Fix ImportsController param to permit :mode () 2020-03-31 12:43:42 +02:00
ThibG 1a993f9675 Fix 404 and 410 API errors being silently discarded in WebUI ()
* Fix 404 and 410 API errors being silently discarded in WebUI

Fixes 

* Return more appropriate error when user replies to a deleted toot

* Please CodeClimate

* Fix 404/410 errors on fetching account timelines & identity proofs

* Refactor error handling

* Move error message string to statuses.errors
2020-03-28 17:59:45 +01:00
Eugen Rochko 9ced8b6dd5 Add option to include resolved DNS records when blacklisting e-mail domains in admin UI ()
* Add shortcuts to blacklist a user's e-mail domain in admin UI

* Add option to blacklist resolved MX and IP records for e-mail domains
2020-03-12 22:35:20 +01:00
Eugen Rochko da9d81c4ac Add titles to warning presets in admin UI () 2020-03-12 17:57:59 +01:00
ThibG cd7c22da32 Add federation support for the "hide network" preference ()
* Change ActivityPub follower/following collections to not link first page

* Add support for hiding followers and following of remote users

* Switch to using a single `hide_collections` column

* Address code style remarks
2020-03-09 00:10:29 +01:00
Eugen Rochko f459919552 Change local media attachments to perform heavy processing asynchronously ()
Fix 
2020-03-08 23:56:18 +01:00
ThibG cb93be3b88 Add ability to delete files uploaded for settings in admin UI ()
* Allow deleting site uploads

* Refactor and move links into hints

* Fix i18n tests

* Fix HTML output of site_upload_delete_hint
2020-03-08 16:00:24 +01:00
Eugen Rochko a4668d994b Add specific rate limits for posting and following () 2020-03-08 15:17:39 +01:00
Eugen Rochko 9619521459 Remove useless `respond_to` calls () 2020-03-06 01:29:38 +01:00
Eugen Rochko e0db9f37f5 Fix leak of arbitrary statuses through unfavourite action in REST API () 2020-02-27 12:32:54 +01:00
ThibG c004399975 Fix dismissing an announcement twice raising an obscure error () 2020-02-24 22:21:40 +01:00
ThibG 8e8d9b3727 Fix account JSON/RSS not being cacheable due to wrong mime type comparison ()
`request.format` is not a symbol but a `Mime::Type`, so the condition actually
never matched, and a session was created even for those requests, preventing
caching.
2020-02-19 22:31:53 +01:00
ThibG ddd9bad7f1 Fix sign-ups without checked user agreement being accepted through the web form ()
* Fix user agreement not being verified

* Fix tests

* Fix up agreement field being dismissed
2020-02-16 12:56:53 +01:00
Eugen Rochko f1317633b5 Fix unfiltered params error when generating ActivityPub tag pagination () 2020-02-08 17:29:40 +01:00
Eugen Rochko bf4fb26b9d Fix malformed HTML causing uncaught error ()
Fix OEmbed preview API leaking existence of private statuses (see )
2020-02-07 15:24:22 +01:00
Eugen Rochko 5c4b1db54a Change signature verification to ignore signatures with invalid host ()
Instead of returning a signature verification error, pretend there
was no signature (i.e., this does not allow access to resources that
need a valid signature), so public resources can still be fetched

Fix 
2020-02-03 17:48:23 +01:00
ThibG 99cf92a3cf Change how unread announcements are handled ()
* Change meaning of /api/v1/announcements/:id/dismiss to mark an announcement as read

* Change how unread announcements are counted in UI

* Add unread marker to announcements and mark announcements as unread as they are displayed

* Fixups
2020-02-03 01:53:09 +01:00
Eugen Rochko 9fb8165712 Add publish/unpublish controls to announcements in admin UI () 2020-01-27 11:05:33 +01:00
Eugen Rochko dd68e44cfa Add streaming API updates for announcements being modified or deleted ()
Change `all_day` to be a visual client-side cue only

Publish immediately if `scheduled_at` is in the past

Add `published_at` and `updated_at` to announcements JSON
2020-01-26 20:07:26 +01:00
Eugen Rochko 669f1f5e7f Fix OEmbed leaking information about existence of non-public statuses () 2020-01-24 00:20:51 +01:00
Eugen Rochko e4aa4a1c28 Fix password change/reset not immediately invalidating other sessions ()
While making browser requests in the other sessions after a password
change or reset does not allow you to be logged in and correctly
invalidates the session making the request, sessions have API tokens
associated with them, which can still be used until that session
is invalidated.

This is a security issue for accounts that were already compromised
some other way because it makes it harder to throw out the hijacker.
2020-01-24 00:20:38 +01:00
Eugen Rochko 36b1dd934d Fix relationships page not showing results in admin UI ()
Follow-up to 
2020-01-24 00:20:23 +01:00
Eugen Rochko f95fd62bac Add announcements ()
* Add announcements

Fix 

* Add reactions to announcements

* Add admin UI for announcements

* Add unit tests

* Fix issues

- Add `with_dismissed` param to announcements API
- Fix end date not being formatted when time range is given
- Fix announcement delete causing reactions to send streaming updates
- Fix announcements container growing too wide and mascot too small
- Fix `all_day` being settable when no time range is given
- Change text "Update" to "Announcement"

* Fix scheduler unpublishing announcements before they are due

* Fix filter params not being passed to announcements filter
2020-01-23 22:00:13 +01:00
Eugen Rochko 67172aa4f9 Change followers page to relationships page in admin UI ()
Allow browsing and filtering all relationships instead of just
followers, unify the codebase with the user-facing relationship
manager, add ability to see who the user invited
2020-01-23 20:33:20 +01:00
Eugen Rochko 9ebfb23e87 Various fixes and improvements ()
* Fix unused role routes being generated

* Remove unused JavaScript code

* Refactor filters code to be DRYer

* Fix `.count == 0` comparisons to `.empty?` in views

* Fix filters in views
2020-01-20 15:55:03 +01:00
Eugen Rochko 61320da638 Fix access to OEmbed endpoint in secure mode () 2020-01-14 08:52:32 +01:00
Eugen Rochko 413cb7e861 Fix base64-encoded file uploads not being possible ()
Fix , Fix 
2020-01-04 01:54:07 +01:00
Eugen Rochko e066de9a3c Fix missing authentication call in filters controller () 2020-01-03 05:29:08 +01:00
Eugen Rochko 91422d35ed Fix uncaught unknown format errors in host meta controller () 2020-01-03 05:28:56 +01:00
ThibG f0cca7a79f Hide blocked users from more places ()
* Hide blocked, muted, and blocked-by users from toot favourite lists

* Hide blocked, muted, and blocked-by users from toot reblog lists

* Hide blocked, muted, and blocked-by users from followers/following (API)

* Fix tests

* Hide blocked, muted, and blocked-by users from followers/following on public pages
2019-12-31 00:55:32 +01:00
Eugen Rochko c3ef5d7628 Fix error when fetching followers/following from REST API when user has network hidden ()
Fix 
2019-12-31 00:54:38 +01:00
ThibG 6b20921c88 Remove unused AccountRelationshipsPresenter call in public pages ()
Those were used to show a “follow” or “unfollow” button on account grid on
public pages, but that got removed a while ago.
2019-12-30 19:13:02 +01:00
Eugen Rochko 49b6881379 Fix settings pages being cacheable by the browser ()
Fix 
2019-12-30 04:38:30 +01:00