a07fff079b
Merge pull request from GHSA-jhrq-qvrm-qr36
...
* Fix insufficient Content-Type checking of fetched ActivityStreams objects
* Allow JSON-LD documents with multiple profiles
2024-02-16 11:56:12 +01:00
9e5af6bb58
Fix user creation failure handling in OAuth paths ( #29207 )
...
Co-authored-by: Matt Jankowski <matt@jankowski.online>
2024-02-14 23:16:39 +01:00
6f36b633a7
Merge pull request from GHSA-vm39-j3vx-pch3
...
* Prevent different identities from a same SSO provider from accessing a same account
* Lock auth provider changes behind `ALLOW_UNSAFE_AUTH_PROVIDER_REATTACH=true`
* Rename methods to avoid confusion between OAuth and OmniAuth
2024-02-14 15:16:07 +01:00
d807b3960e
Merge pull request from GHSA-7w3c-p9j8-mq3x
...
* Ensure destruction of OAuth Applications notifies streaming
Due to doorkeeper using a dependent: delete_all relationship, the destroy of an OAuth Application bypassed the existing AccessTokenExtension callbacks for announcing destructing of access tokens.
* Ensure password resets revoke access to Streaming API
* Improve performance of deleting OAuth tokens
---------
Co-authored-by: Emelia Smith <ThisIsMissEm@users.noreply.github.com>
2024-02-14 15:15:34 +01:00
cdbe2855f3
Disable administrative doorkeeper routes ( #29187 )
2024-02-14 11:34:46 +01:00
5799bc4af7
Merge pull request from GHSA-3fjr-858r-92rw
...
* Fix insufficient origin validation
* Bump version to v4.1.13
2024-02-01 15:56:46 +01:00
2e8943aecd
Add rate-limit of TOTP authentication attempts at controller level ( #28801 )
2024-01-24 15:31:06 +01:00
460e4fbdd6
Fix processing of compacted single-item JSON-LD collections ( #28816 )
2024-01-24 15:31:06 +01:00
9292d998fe
Fix Mastodon not correctly processing HTTP Signatures with query strings ( #28476 )
2024-01-24 15:31:06 +01:00
92643f48de
Convert signature verification specs to request specs ( #28443 )
2024-01-24 15:31:06 +01:00
458620bdd4
Fix potential redirection loop of streaming endpoint ( #28665 )
2024-01-24 15:31:06 +01:00
4c5575e8e0
Fix Undo Announce activity is not sent, when not followed by the reblogged post author ( #18482 )
...
Co-authored-by: Claire <claire.github-309c@sitedethib.com>
2024-01-24 15:31:06 +01:00
2e4d43933d
Fix SQL query in `/api/v1/directory` ( #28412 )
2023-12-18 11:03:20 +01:00
803e15a3cf
Fix incoming status creation date not being restricted to standard ISO8601 ( #27655 )
2023-12-04 15:28:02 +01:00
ab68df9af0
Fix hashtag matching pattern matching some URLs ( #27584 )
2023-12-04 15:28:02 +01:00
a89a25714d
Fix some link anchors being recognized as hashtags ( #27271 )
2023-12-04 15:28:02 +01:00
1210524a3d
Fix processing LDSigned activities from actors with unknown public keys ( #27474 )
2023-12-04 15:28:02 +01:00
ff3a9dad0d
Fix error and incorrect URLs in `/api/v1/accounts/:id/featured_tags` for remote accounts ( #27459 )
2023-12-04 15:28:02 +01:00
335982325e
Dont match mention in url query string ( #25656 )
...
Co-authored-by: Claire <claire.github-309c@sitedethib.com>
2023-10-10 13:51:56 +02:00
f2fff6be66
Fix crash when filtering for “dormant” relationships ( #27306 )
2023-10-10 13:51:56 +02:00
d6c0ae995c
Fix post edits not being forwarded as expected ( #26936 )
2023-09-19 17:01:44 +02:00
5fd89e53d2
Fix moderator rights inconsistencies ( #26729 )
2023-09-19 17:01:44 +02:00
34959eccd2
Fix cached posts including stale stats ( #26409 )
2023-09-19 17:01:44 +02:00
cf80d54cba
Allow reports with long comments from remote instances, but truncate ( #25028 )
2023-09-05 19:16:09 +02:00
ea7fa048f3
Fix `/api/v1/timelines/tag/:hashtag` allowing for unauthenticated access when public preview is disabled ( #26237 )
2023-09-05 19:16:09 +02:00
889102013f
Fix CSP headers being unintendedly wide ( #26105 )
2023-07-21 16:07:43 +02:00
53b979d5c7
Fix processing of media files with unusual names ( #25788 )
2023-07-07 19:37:21 +02:00
0aa0b71f2c
Merge pull request from GHSA-9928-3cp5-93fm
...
* Fix attachments getting processed despite failing content-type validation
* Add a restrictive ImageMagick security policy tailored for Mastodon
* Fix misdetection of MP3 files with large cover art
* Reject unprocessable audio/video files instead of keeping them unchanged
2023-07-06 15:05:05 +02:00
8eb1bb8ba6
Allow carets in URL search params ( #25216 )
2023-07-06 13:45:40 +02:00
79f5b8f156
Fix ResolveURLService not resolving local URLs for remote content ( #25637 )
2023-07-06 13:45:40 +02:00
f8930a67a0
Change /api/v1/statuses/:id/history to always return at least one item ( #25510 )
2023-07-06 13:45:40 +02:00
fd1ffd72eb
Fix incorrect pagination headers in `/api/v2/admin/accounts` ( #25477 )
2023-07-06 13:45:40 +02:00
7bd34f8b23
Fix infinite loop in AccountsStatusesCleanupScheduler ( #24840 )
2023-07-06 13:45:40 +02:00
7012bf6ed3
Improve automatic post cleanup worker performances ( #24785 )
2023-07-06 13:45:40 +02:00
d9e45f2fa9
Fix AccountsStatusesCleanupScheduler not spreading deletes across accounts correctly ( #24607 )
2023-07-06 13:45:40 +02:00
2779bce9a2
Add fallback redirection when getting a webfinger query `LOCAL_DOMAIN@LOCAL_DOMAIN` ( #23600 )
...
Co-authored-by: Eugen Rochko <eugen@zeonfederated.com>
2023-07-06 13:45:40 +02:00
210ff36860
Change AccessTokensVacuum to also delete expired tokens ( #24868 )
2023-07-06 13:45:40 +02:00
99c2bbbec9
Change profile updates to be sent to recently-mentioned servers ( #24852 )
2023-07-06 13:45:40 +02:00
7e58779300
Fix reports not being closed when performing batch suspensions ( #24988 )
2023-07-06 13:45:40 +02:00
4c6c790f80
Fix /api/v1/conversations sometimes returning empty accounts ( #25499 )
2023-07-06 13:45:40 +02:00
036ac5b5c9
Fix ArgumentError when loading newer Private Mentions ( #25399 )
2023-07-06 13:45:40 +02:00
8c4ea7d715
Fix misleading error code when receiving invalid WebAuthn credentials ( #23568 )
2023-03-16 11:45:53 +01:00
68af19c328
Change auto-deletion throttling constants to better scale with server size ( #23320 )
2023-03-13 18:49:01 +01:00
3f2e31800e
Unescape HTML entities ( #24019 )
2023-03-13 18:45:42 +01:00
0dc342df81
Fix “Remove all followers from the selected domains” being more destructive than it claims ( #23805 )
2023-03-13 18:36:15 +01:00
0c9eac80d8
Fix unbounded recursion in post discovery ( #23506 )
...
* Add a limit to how many posts can get fetched as a result of a single request
* Add tests
* Always pass `request_id` when processing `Announce` activities
---------
Co-authored-by: nametoolong <nametoolong@users.noreply.github.com>
2023-02-10 22:16:37 +01:00
0592937264
Apply Rubocop Rails/WhereNot ( #23448 )
...
* Apply Rubocop Rails/WhereNot
* Update spec for where.not
2023-02-08 10:39:57 +01:00
1487fcde93
Apply Rubocop Style/ExpandPathArguments ( #23450 )
2023-02-08 07:06:20 +01:00
ed570050c6
Autofix Rails/EagerEvaluationLogMessage ( #23429 )
...
* Autofix Rails/EagerEvaluationLogMessage
* Update spec for debug block syntax
2023-02-07 03:44:36 +01:00
9edefc779f
Fix `UserCleanupScheduler` crash when an unconfirmed account has a moderation note ( #23318 )
...
* Fix `UserCleanupScheduler` crash when an unconfirmed account has a moderation note
* Add tests
2023-02-07 01:14:44 +01:00
Claire
Emelia Smith
MitarashiDango
Matt Jankowski
Daniel M Brasil
Renaud Chaput
Christian Schmidt
Nick Schonning