Commit graph

6188 commits

Author SHA1 Message Date
Claire 02a87431cf
Fix error when suspending user with an already-existing canonical email block (#17036)
* Fix error when suspending user with an already-existing canonical email block

Fixes #17033

While attempting to create a `CanonicalEmailBlock` with an existing hash would
raise an `ActiveRecord::RecordNotUnique` error, this being done within a
transaction would cancel the whole transaction. For this reason, checking for
uniqueness in Rails would query the database within the transaction and avoid
invalidating the whole transaction for this reason.

A race condition is still possible, where multiple accounts sharing a canonical
email would be blocked in concurrent transactions, in which only one would
succeed, but that is way less likely to happen that the current issue, and can
always be retried after the first failure, unlike the current situation.

* Add tests
2021-11-24 17:41:03 +01:00
Claire db32835338
Fix overflow of long profile fields in admin view (#17010) 2021-11-19 18:22:49 +01:00
Claire 6159020617
Fix background-color of emoji-mart selector (#17011)
Reverts part of #16907 to fix hardcoded color
2021-11-19 18:21:37 +01:00
Takeshi Umeda 3419d3ec84
Bump chewy from 5.2.0 to 7.2.3 (supports Elasticsearch 7.x) (#16915)
* Bump chewy from 5.2.0 to 7.2.2

* fix style (codeclimate)

* fix style

* fix style

* Bump chewy from 7.2.2 to 7.2.3
2021-11-18 22:02:08 +01:00
Mashiro 2b6a25c609
Add lazy load to emoji-mart (#16907)
* perf: lazyload emoji-mart!

* Bump lazyload
2021-11-18 22:01:31 +01:00
Claire 3517867b76
Fix confusing error when webfinger request returns empty document (#16986)
For some reason, some misconfigured servers return an empty document when
queried over webfinger. Since an empty document does not lead to a parse
error, the error is not caught properly and triggers uncaught exceptions
later on.

This PR fixes that by immediately erroring out with `Webfinger::Error` on
getting an empty response.
2021-11-14 21:55:40 +01:00
Eugen Rochko 5d7c852283
Fix no link previews being generated for pages with invalid structured data (#16979)
Fix #16955
2021-11-13 23:07:13 +01:00
Claire ef8deb0878
Fix OpenGraph/LinkedData embeds having incorrectly-generated iframes (#16978) 2021-11-13 03:30:27 +01:00
Claire 6da135a493
Fix reviving revoked sessions and invalidating login (#16943)
Up until now, we have used Devise's Rememberable mechanism to re-log users
after the end of their browser sessions. This mechanism relies on a signed
cookie containing a token. That token was stored on the user's record,
meaning it was shared across all logged in browsers, meaning truly revoking
a browser's ability to auto-log-in involves revoking the token itself, and
revoking access from *all* logged-in browsers.

We had a session mechanism that dynamically checks whether a user's session
has been disabled, and would log out the user if so. However, this would only
clear a session being actively used, and a new one could be respawned with
the `remember_user_token` cookie.

In practice, this caused two issues:
- sessions could be revived after being closed from /auth/edit (security issue)
- auto-log-in would be disabled for *all* browsers after logging out from one
  of them

This PR removes the `remember_token` mechanism and treats the `_session_id`
cookie/token as a browser-specific `remember_token`, fixing both issues.
2021-11-06 00:13:58 +01:00
Claire 87085a5152
Fix AccountNote not having a maximum length (#16942) 2021-11-06 00:12:25 +01:00
Eugen Rochko 39cdf61ab7
Add support for structured data and more OpenGraph tags to link cards (#16938)
Save preview cards under their canonical URL

Increase max redirects to follow from 2 to 3
2021-11-05 23:23:05 +01:00
Claire 989c67d29d
Fix handling announcements with links (#16941)
Broken since #15827
2021-11-05 21:14:35 +01:00
Jeong Arm 458830ee7c
Fix statuses order in account's statuses admin page (#16937) 2021-11-04 15:49:35 +01:00
mayaeh 7ccbfb55dd
ran yarn manage:translations en (#16912) 2021-10-28 05:29:49 +02:00
Sasha Sorokin 11d4f9eefc
Split context for filter bar and unread markers (#16865)
On notifications page, in settings, "Show" for quick filter bar and
unread notifications markers use the same string, while being placed in
the separate contexts - under different settings categories.

This commit splits the contexts, creating new strings:

- "Show filter bar" in place of "Show" for filter bar;

- "Highlight unread notifications" in place of "Show" for unread
  notification markers, which are now simply called "Highlighting";

- There's also "Unread notifications" in place of "Unread notification
  markers" string to accompany the changes to "Show" string under that
  category.

All new strings have new IDs, which will cause previous strings to
invalidate on the next translation update and new strings to be created.
This will help Mastodon translators to know that there are changes and
improve translation in accordance to the source string update.
2021-10-25 16:32:28 +02:00
Claire ec059317fa
Fix some link previews being incorrectly generated from other prior links (#16885)
* Add tests

* Fix some link previews being incorrectly generated from different prior links

PR #12403 added a cache to avoid redundant queries when the OEmbed endpoint can
be guessed from the URL. This caching mechanism is not perfectly correct as
there is no guarantee that all pages from a given domain share the same
OEmbed provider endpoint.

This PR prevents the FetchOEmbedService from caching OEmbed endpoint that
cannot be generalized by replacing a fully-qualified URL from the endpoint's
parameters, greatly reducing the number of incorrect cached generalizations.
2021-10-21 20:39:35 +02:00
Mashiro b58d32cfe2
Enhance dashboard styles (#16884)
* Display sparkline graph on Chrome

* Heatmap auto overflow

* Change grid columns number on small screen

* Please codeclimate bot

* Remove graph height
2021-10-21 06:24:34 +02:00
Claire 3f9b28ce26
Add support for fetching Create and Announce activities by URI (#16383)
* Add support for fetching Create and Announce activities by URI

This should improve compatibility with ZAP and offer a way to fetch boosts,
which is currently not possible.

* Add tests
2021-10-21 01:14:04 +02:00
Takeshi Umeda 17f4e457b3
Add remove from followers api (#16864)
* Add followed_by? to account_interactions

* Add RemoveFromFollowersService

* Fix AccountBatch to use RemoveFromFollowersService

* Add remove from followers API
2021-10-18 12:02:35 +02:00
Eugen Rochko f00043dc4b
New Crowdin updates (#16354)
* New translations en.json (Latvian)
[ci skip]

* New translations en.json (Hebrew)
[ci skip]

* New translations en.json (Hebrew)
[ci skip]

* New translations simple_form.en.yml (Breton)
[ci skip]

* New translations simple_form.en.yml (Breton)
[ci skip]

* New translations simple_form.en.yml (Breton)
[ci skip]

* New translations simple_form.en.yml (Breton)
[ci skip]

* New translations en.json (Icelandic)
[ci skip]

* New translations en.json (Icelandic)
[ci skip]

* New translations en.json (Chinese Simplified)
[ci skip]

* New translations en.yml (Chinese Simplified)
[ci skip]

* New translations en.yml (Chinese Simplified)
[ci skip]

* New translations simple_form.en.yml (Chinese Simplified)
[ci skip]

* New translations devise.en.yml (Chinese Simplified)
[ci skip]

* New translations en.yml (Chinese Simplified)
[ci skip]

* New translations devise.en.yml (Chinese Simplified)
[ci skip]

* New translations en.json (Persian)
[ci skip]

* New translations en.json (Finnish)
[ci skip]

* New translations doorkeeper.en.yml (Finnish)
[ci skip]

* New translations doorkeeper.en.yml (Finnish)
[ci skip]

* New translations doorkeeper.en.yml (Finnish)
[ci skip]

* New translations doorkeeper.en.yml (Finnish)
[ci skip]

* New translations doorkeeper.en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (French)
[ci skip]

* New translations en.yml (French)
[ci skip]

* New translations en.json (Russian)
[ci skip]

* New translations en.json (Russian)
[ci skip]

* New translations en.json (Russian)
[ci skip]

* New translations activerecord.en.yml (Latvian)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations doorkeeper.en.yml (Latvian)
[ci skip]

* New translations en.yml (Slovak)
[ci skip]

* New translations doorkeeper.en.yml (Latvian)
[ci skip]

* New translations en.yml (Slovak)
[ci skip]

* New translations doorkeeper.en.yml (Latvian)
[ci skip]

* New translations doorkeeper.en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Esperanto)
[ci skip]

* New translations en.yml (Esperanto)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations doorkeeper.en.yml (Latvian)
[ci skip]

* New translations doorkeeper.en.yml (Latvian)
[ci skip]

* New translations doorkeeper.en.yml (Latvian)
[ci skip]

* New translations doorkeeper.en.yml (Latvian)
[ci skip]

* New translations devise.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations en.yml (Slovak)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Slovak)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations simple_form.en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Armenian)
[ci skip]

* New translations en.json (Danish)
[ci skip]

* New translations en.yml (Arabic)
[ci skip]

* New translations en.yml (Catalan)
[ci skip]

* New translations en.yml (Czech)
[ci skip]

* New translations en.yml (Danish)
[ci skip]

* New translations en.yml (Spanish)
[ci skip]

* New translations en.yml (German)
[ci skip]

* New translations en.yml (Greek)
[ci skip]

* New translations en.yml (Basque)
[ci skip]

* New translations en.yml (Hungarian)
[ci skip]

* New translations en.yml (Slovak)
[ci skip]

* New translations en.yml (Persian)
[ci skip]

* New translations en.yml (Swedish)
[ci skip]

* New translations en.yml (French)
[ci skip]

* New translations en.yml (Chinese Simplified)
[ci skip]

* New translations en.yml (Finnish)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Italian)
[ci skip]

* New translations en.yml (Sinhala)
[ci skip]

* New translations en.yml (Sardinian)
[ci skip]

* New translations en.yml (Esperanto)
[ci skip]

* New translations en.yml (Vietnamese)
[ci skip]

* New translations en.yml (Turkish)
[ci skip]

* New translations en.yml (Ukrainian)
[ci skip]

* New translations en.yml (Chinese Traditional)
[ci skip]

* New translations en.yml (Galician)
[ci skip]

* New translations en.yml (Icelandic)
[ci skip]

* New translations en.yml (Portuguese, Brazilian)
[ci skip]

* New translations en.yml (Indonesian)
[ci skip]

* New translations en.yml (Tamil)
[ci skip]

* New translations en.yml (Spanish, Argentina)
[ci skip]

* New translations en.yml (Serbian (Cyrillic))
[ci skip]

* New translations en.yml (Albanian)
[ci skip]

* New translations en.yml (Japanese)
[ci skip]

* New translations en.yml (Georgian)
[ci skip]

* New translations en.yml (Korean)
[ci skip]

* New translations en.yml (Lithuanian)
[ci skip]

* New translations en.yml (Dutch)
[ci skip]

* New translations en.yml (Norwegian)
[ci skip]

* New translations en.yml (Polish)
[ci skip]

* New translations en.yml (Portuguese)
[ci skip]

* New translations en.yml (Russian)
[ci skip]

* New translations en.yml (Slovenian)
[ci skip]

* New translations en.yml (Spanish, Mexico)
[ci skip]

* New translations en.yml (Norwegian Nynorsk)
[ci skip]

* New translations en.yml (Estonian)
[ci skip]

* New translations en.yml (Kazakh)
[ci skip]

* New translations en.json (Norwegian Nynorsk)
[ci skip]

* New translations en.yml (Thai)
[ci skip]

* New translations en.yml (Bengali)
[ci skip]

* New translations en.yml (Asturian)
[ci skip]

* New translations en.yml (Scottish Gaelic)
[ci skip]

* New translations en.yml (Occitan)
[ci skip]

* New translations en.json (Kurmanji (Kurdish))
[ci skip]

* New translations en.yml (Kurmanji (Kurdish))
[ci skip]

* New translations en.json (Sorani (Kurdish))
[ci skip]

* New translations en.yml (Breton)
[ci skip]

* New translations en.yml (Malay)
[ci skip]

* New translations en.yml (Welsh)
[ci skip]

* New translations en.yml (Chinese Traditional, Hong Kong)
[ci skip]

* New translations en.yml (Tatar)
[ci skip]

* New translations en.yml (Malayalam)
[ci skip]

* New translations en.yml (Sorani (Kurdish))
[ci skip]

* New translations en.yml (Corsican)
[ci skip]

* New translations en.yml (Kabyle)
[ci skip]

* New translations en.yml (Catalan)
[ci skip]

* New translations en.yml (Polish)
[ci skip]

* New translations en.yml (Russian)
[ci skip]

* New translations en.yml (Russian)
[ci skip]

* New translations en.yml (Catalan)
[ci skip]

* New translations en.yml (Kurmanji (Kurdish))
[ci skip]

* New translations en.json (Russian)
[ci skip]

* New translations en.yml (Czech)
[ci skip]

* New translations en.json (Russian)
[ci skip]

* New translations en.yml (Czech)
[ci skip]

* New translations en.yml (Czech)
[ci skip]

* New translations en.yml (Turkish)
[ci skip]

* New translations en.yml (Occitan)
[ci skip]

* New translations en.yml (Czech)
[ci skip]

* New translations en.yml (Kurmanji (Kurdish))
[ci skip]

* New translations en.yml (Czech)
[ci skip]

* New translations en.yml (Danish)
[ci skip]

* New translations en.yml (Danish)
[ci skip]

* New translations en.yml (Kurmanji (Kurdish))
[ci skip]

* New translations en.yml (Norwegian)
[ci skip]

* New translations en.yml (Kurmanji (Kurdish))
[ci skip]

* New translations en.yml (Chinese Traditional)
[ci skip]

* New translations en.yml (Galician)
[ci skip]

* New translations en.yml (Galician)
[ci skip]

* New translations en.yml (French)
[ci skip]

* New translations en.yml (French)
[ci skip]

* New translations en.yml (Chinese Traditional)
[ci skip]

* New translations en.yml (Hungarian)
[ci skip]

* New translations en.yml (Albanian)
[ci skip]

* New translations en.yml (Albanian)
[ci skip]

* New translations en.yml (Ukrainian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Portuguese)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.json (Portuguese)
[ci skip]

* New translations en.yml (Portuguese)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Latvian)
[ci skip]

* New translations en.yml (Spanish)
[ci skip]

* New translations en.yml (Hungarian)
[ci skip]

* New translations en.yml (Italian)
[ci skip]

* New translations en.yml (Indonesian)
[ci skip]

* New translations en.yml (Indonesian)
[ci skip]

* New translations devise.en.yml (French)
[ci skip]

* Run `i18n-tasks normalize`

* Run `yarn manage:translations`

* Trim unnecessary line breaks

Co-authored-by: Yamagishi Kazutoshi <ykzts@desire.sh>
2021-10-17 10:28:51 +09:00
Claire a184c860ca
Fix retention rate computation (#16854) 2021-10-14 22:20:37 +02:00
Jeong Arm f4081d1564
Allow keeping only 1 boosts/favs on auto deleting posts (#16653)
* Allow keeping 1 boosts/favs on auto deleting posts

* Fix tests
2021-10-14 21:11:14 +02:00
Claire b21f3aa21d
Minor memory optimizations (#16507)
Reduce constant memory usage by ~100kB and further reduce boot-up memory
allocations and temporary memory use by a further ~200kB.
2021-10-14 21:04:57 +02:00
Jeong Arm 3ec8e04b3b
Add font-display to display text before loading (#16330) 2021-10-14 21:04:26 +02:00
gunchleoc 8ce42640e5
Add Northern Kurdish locale as requested by translator. It already has a project started on Crowdin. (#16548) 2021-10-14 21:02:54 +02:00
Claire 9b978872cc
Fix 404 error when filtering admin action logs by non-existent target account (#16643)
Currently, there is no way for an admin to delete an account record. However,
should that happen in the future, or should an admin mistype an account id,
`/admin/action_logs?target_account_id=<non-existent-account-id>` currently
returns a 404 instead of an empty list.

With this commit, the aforementioned page returns a correct list instead
(potentially non-empty if the account has been manually deleted)
2021-10-14 20:53:11 +02:00
Eugen Rochko 07341e7aa6
Add graphs and retention metrics to admin dashboard (#16829) 2021-10-14 20:44:59 +02:00
Claire 216570ad98
Fix scheduled statuses decreasing statuses counts (#16791)
* Add tests

* Fix scheduled statuses decreasing statuses counts

Fixes #16774
2021-10-14 19:59:21 +02:00
Claire 5159ba26e4
Fix error when rendering public pages with media attachments (#16763)
* Add tests

* Fix error when rendering public pages with media attachments

* Add tests

* Fix tests

* Please CodeClimate
2021-10-13 15:27:19 +02:00
Sasha Sorokin 89b5071fde
Add single option votes tooltip in polls (#16849)
Adds a tooltip when hovering over the percentages in a poll showing how
many votes were cast for that option.

Also removes descriptions from messages here since they are not picked
up by Crowdin anyway and might be confusing to other developers :)

Fixes #16820
2021-10-13 04:59:31 +02:00
Claire 84ceebe1c4
Fix media attachment size validation not correctly accounting for file type (#16819)
* Fix media attachment size validation not correctly accounting for file type

Fixes a regression introduced in #16724 caused by the fact that kt-paperclip
now correctly runs validations before processing, meaning that file size
verification could not rely on our before_post_processing hook.

Moved the `before_post_processing` hooks to `before_validate` to make sure
the media attachment type is set correctly before the file gets validated.

* Add tests
2021-10-06 14:49:32 +01:00
Mélanie Chauvel 900481b7fa
Improve hover and focus style in columns settings (#16222)
* Make focus visible on switches and text buttons in columns settings

* Make hover/focus visible on left/right arrows in columns settings

Use same style as for station action bar (reply/boost/fav/etc.)

* Tab first to “Pin/Unpin” before left/right arrows in columns settings
2021-10-01 00:55:51 +02:00
Claire 24f9ea7818
Fix webauthn secure key authentication (#16792)
* Add tests

* Fix webauthn secure key authentication

Fixes #16769
2021-09-30 05:26:29 +02:00
Mashiro 2e549fa2d5
Fix drawer tab menu routes in advanced web ui (#16793) 2021-09-30 05:19:08 +02:00
Claire fc3ae1343d
Switch from unmaintained paperclip to kt-paperclip (#16724)
* Switch from unmaintained paperclip to kt-paperclip

* Drop some compatibility monkey-patches not required by kt-paperclip

* Drop media spoof check monkey-patching

It's broken with kt-paperclip and hopefully it won't be needed anymore

* Fix regression introduced by paperclip 6.1.0

* Do not rely on pathname to call FastImage

* Add test for ogg vorbis file with cover art

* Add audio/vorbis to the accepted content-types

This seems erroneous as this would be the content-type for a vorbis stream
without an ogg container, but that's what the `marcel` gem outputs, so…

* Restore missing for_as_default method

* Refactor Attachmentable concern and delay Paperclip's content-type spoof check

Check for content-type spoofing *after* setting the extension ourselves, this
fixes a regression with kt-paperclip's validations being more strict than
paperclip 6.0.0 and rejecting some Pleroma uploads because of unknown
extensions.

* Please CodeClimate

* Add audio/vorbis to the unreliable set

It doesn't correspond to a file format and thus has no extension associated.
2021-09-29 23:52:36 +02:00
Claire 6b19e1e632
Fix incorrect use of old WebUI paths (#16773)
* Fix incorrect use of old WebUI paths

PR #16171 renamed some routes but missed some occurrences.
Without #16772, this leads to unreachable routes in those cases.

* Fix floating action button being displayed on statuses and compose screen
2021-09-27 07:24:04 +02:00
Claire 11502ae46e
Add aliases for WebUI routes that were renamed in #16171 (#16772)
* Add aliases for some WebUI routes that were renamed in #16171

Accounts and statuses routes need more work as they use different parameters.

* Add aliases for /statuses/* routes

* Add aliases for /accounts/* WebUI routes

Does not correctly set the “active” state on the navigation tabs but this is
a minor issue.

* Fix some routes

* Fix /accounts/:id/{media,followers,following} not loading on legacy routes
2021-09-27 07:23:48 +02:00
Eugen Rochko a0d4129893
Refactor notifications to go through a separate stream in streaming API (#16765)
Eliminate need to have custom notifications filtering logic in the
streaming API code by publishing notifications into a separate stream
and then simply using the multi-stream capability to subscribe to that
stream when necessary
2021-09-26 13:23:28 +02:00
Eugen Rochko 52e5c07948
Change routing paths to use usernames in web UI (#16171) 2021-09-26 05:46:13 +02:00
Claire e0af97164a
Fix followers synchronization mechanism not working when URI has empty path (#16744)
Follow-up to #16510, forgot the controller exposing the actual followers…
2021-09-15 18:51:16 +02:00
Claire db57bff11d
Stop setting a shortcode to newly-created media attachments (#16730)
* Stop setting a shortcode to newly-created media attachments

The WebUI has stopped using the “short media URL” in ages. This isn't used
anywhere except for mail notifications.

Deprecating it would allow us to eventually get rid of at least a database
column and corruption-prone index, as well as a controller.

* Fix tests
2021-09-13 18:59:37 +02:00
Holger 209f8f3a60
use relative path for scope (#16714)
Use relative path for `scope` in web manifest to allow users use PWA correctly via alternate domains.
2021-09-08 23:33:36 +02:00
Claire 12cd097e7c
Fix addressing of remote groups' followers (#16700)
Fixes #16699
2021-09-08 23:33:23 +02:00
Claire 2b18f7a943
Fix processing mentions to domains with non-ascii TLDs (#16689)
Fixes #16602
2021-09-01 22:06:40 +02:00
Truong Nguyen 7283a5d3b9
Explicitly set userVerification to discoraged (#16545) 2021-08-26 09:51:22 -05:00
Claire 94bcf45321
Fix authentication failures after going halfway through a sign-in attempt (#16607)
* Add tests

* Add security-related tests

My first (unpublished) attempt at fixing the issues introduced (extremely
hard-to-exploit) security vulnerabilities, addressing them in a test.

* Fix authentication failures after going halfway through a sign-in attempt

* Refactor `authenticate_with_sign_in_token` and `authenticate_with_two_factor` to make the two authentication steps more obvious
2021-08-25 22:52:41 +02:00
matildepark 79341d0f5f
Fix follow request count to dynamically update (#16652) 2021-08-25 17:46:29 +02:00
Daniel 5c21021176
Fix undefined variable for Auth::OmniauthCallbacksController (#16654)
The addition of authentication history broke the omniauth login with
the following error:

  method=GET path=/auth/auth/cas/callback format=html
  controller=Auth::OmniauthCallbacksController action=cas status=500
  error='NameError: undefined local variable or method `user' for
  #<Auth::OmniauthCallbacksController:0x00000000036290>
  Did you mean?  @user' duration=435.93 view=0.00 db=36.19

* app/controllers/auth/omniauth_callbacks_controller.rb: fix variable
  name to `@user`
2021-08-25 17:40:56 +02:00
Claire 3c45dfa0fe
Fix “discoverable” account setting being tied to profile directory (#16637) 2021-08-20 16:11:58 +02:00
Claire 9ac7e6fef7
Fix remotely-suspended accounts' toots being merged back into timelines (#16628)
* Fix remotely-suspended accounts' toots being merged back into timelines

* Mark remotely-deleted accounts as remotely suspended
2021-08-20 07:40:33 +01:00