Commit Graph

791 Commits

Author SHA1 Message Date
Jasmin 3fd984f95c
Merge security fixes of v3.5.17 (#1341)
_todo_

---------

Co-authored-by: Claire <claire.github-309c@sitedethib.com>
Co-authored-by: Essem <smswessem@gmail.com>
Co-authored-by: Jakob Gillich <jakob@gillich.me>
Co-authored-by: David Aaron <1858430+suddjian@users.noreply.github.com>
Co-authored-by: Matt Jankowski <matt@jankowski.online>
Co-authored-by: Jonathan de Jong <jonathandejong02@gmail.com>
2024-02-01 10:37:20 -05:00
Darius Kazemi 1eaaff303c Merge tag 'v3.5.14' into hometown-3.5.14-merge 2023-09-19 19:30:03 -07:00
Claire 49af3e26dc Fix moderator rights inconsistencies (#26729) 2023-09-19 17:01:17 +02:00
Claire 412c3e13ec Fix crash when encountering invalid URL (#26814) 2023-09-19 17:01:17 +02:00
Nicolai Søborg e8eeb746ac Fix `frame_rate` for videos where `ffprobe` reports 0/0 (#26500) 2023-09-19 17:01:17 +02:00
Claire 9deb178126
Merge pull request from GHSA-v3xf-c9qf-j667 2023-09-19 16:53:58 +02:00
Emelia Smith dcffd6b3d7 Allow reports with long comments from remote instances, but truncate (#25028) 2023-09-05 17:22:43 +02:00
Claire 2e0eab9d18 Change text extraction in `PlainTextFormatter` to be faster (#26727) 2023-09-05 17:22:43 +02:00
Claire e655b35d7e Fix incorrect connect timeout in outgoing requests (#26116) 2023-07-31 14:33:27 +02:00
Claire ced65ffbb4 Change request timeout handling to use a longer deadline (#26055) 2023-07-21 16:07:24 +02:00
Darius Kazemi 6599159d48 Merge tag 'v3.5.10' into hometown-3.5.10-merge 2023-07-09 15:02:39 -07:00
Claire dca0d8427e Fix crash in admin interface when viewing a remote user with verified links (#25796) 2023-07-07 19:35:24 +02:00
Claire ca4b23bf0d
Merge pull request from GHSA-55j9-c3mp-6fcq 2023-07-06 15:06:49 +02:00
Claire 32e5a9f053
Merge pull request from GHSA-9pxv-6qvf-pjwc
* Fix timeout handling of outbound HTTP requests

* Use CLOCK_MONOTONIC instead of Time.now
2023-07-06 15:06:24 +02:00
Claire feac95333f Change profile updates to be sent to recently-mentioned servers (#24852) 2023-07-06 13:46:21 +02:00
Claire 3faebae2d1 Change OpenGraph-based embeds to allow fullscreen (#25058) 2023-07-06 13:46:21 +02:00
Claire 95f59da157 Fix “Authorized applications” inefficiently and incorrectly getting last use date (#25060) 2023-07-06 13:46:21 +02:00
Claire f90daf58db Add warning for object storage misconfiguration (#24137) 2023-03-16 22:50:15 +01:00
Claire cb622b23b1 Fix dashboard crash on ElasticSearch server error (#23751) 2023-03-16 12:31:20 +01:00
Claire a8a3e86216
Fix unbounded recursion in post discovery (#23507)
* Add a limit to how many posts can get fetched as a result of a single request

* Add tests

* Always pass `request_id` when processing `Announce` activities

---------

Co-authored-by: nametoolong <nametoolong@users.noreply.github.com>
2023-02-10 22:16:47 +01:00
Claire 533bf92d21
Don't delivery a reply to domains which are blocked by author (#22117) (#23490)
Co-authored-by: Jeong Arm <kjwonmail@gmail.com>
2023-02-09 21:01:53 +01:00
Claire 1f0be21317
Fix some performance issues with /admin/instances (#21907) (#23483)
/admin/instances?availability=failing remains wholly unefficient
2023-02-09 20:57:14 +01:00
Claire ee66f5790f
Fix unbounded recursion in account discovery (v3.5 backport) (#22026)
* Fix trying to fetch posts from other users when fetching featured posts

* Rate-limit discovery of new subdomains

* Put a limit on recursively discovering new accounts
2022-12-15 19:21:17 +01:00
Darius Kazemi 427596ab01 Adding a `norss` user preference
There is now a `norss` user preference for a user to opt out of having an RSS feed of their public posts. This operates on the exact same logic as the existing `noindex` for the search engine opt-out: the admin can check a box in Site Settings for a default setting for users. If a user has never touched their RSS opt-out setting then it is equal to whatever the default is. But individual users can override the default in their Preferences -> Other menu.

So a privacy-minded server admin could opt everyone out by default, but the overall default behavior is to have RSS feeds of public posts for everyone, which is the default Mastodon behavior anyway.

The `norss`, like `noindex`, is just a key on a pre-existing `settings` object that is a key-value store, so there doesn't even need to be a database migration for this!

Fixes #1232
2022-12-03 22:04:55 -08:00
Darius Kazemi 9c4df21753 Fix ActivityPub Article rendering bugs
* re-add the `article-type` class to article content in feed
 * fix margin on `article-type`
 * handle images where `src` is formatted like `/foo/bar.png` by inferring the protocol and domain (and port and password if applicable) from `url` in the AP object received -- without this we can't make a reasonable inference of origin since the domain for the content might be different from the domain of the activitypub server itself
2022-12-02 17:13:06 -08:00
Darius Kazemi f5ffda7cf3 Merge tag 'v3.5.4' into hometown-dev 2022-11-14 11:47:27 -08:00
Claire 2dd8f977e8 Fix emoji substitution not applying only to text nodes in backend code
Signed-off-by: Claire <claire.github-309c@sitedethib.com>
2022-11-14 11:20:41 +01:00
Darius Kazemi 66e6c0108a
Merge pull request #1186 from therabidbanana/dh-fix-article-format
Updates the article formatter to strip unsafe HTML
2022-11-11 16:05:18 -08:00
Darius Kazemi e311837121 Merge tag 'v3.5.3' into hometown-3.5.3-merge 2022-11-11 14:50:45 -08:00
David d8f85dfcb6 Also download file 2022-10-30 22:47:10 +00:00
David 2f970e8bb7 Updates the formatter to be smarter 2022-10-30 22:13:45 +00:00
Eugen Rochko 0a1992430d
Fix errors when rendering RSS feeds (#18531) 2022-05-26 23:02:42 +02:00
Eugen Rochko 96129c2f10
Fix confirmation redirect to app without `Location` header (#18523) 2022-05-26 22:03:54 +02:00
Eugen Rochko a9b64b24d6
Change algorithm of `tootctl search deploy` to improve performance (#18463) 2022-05-22 22:16:43 +02:00
Yamagishi Kazutoshi c3fac61f56
Fix `Mastodon::RaceConditionError` that occurs when external status is reblogged (#18424)
* Fix `Mastodon::RaceConditionError` that occurs when external status is reblogged

* Replace to `@object`
2022-05-16 01:00:09 +02:00
Eugen Rochko 6cf57c6765
Refactor how Redis locks are created (#18400)
* Refactor how Redis locks are created

* Fix autorelease duration on account deletion lock
2022-05-13 00:02:35 +02:00
Eugen Rochko 2b8dc58b7f
Change RSS feeds (#18356)
* Change RSS feeds

- Use date and time for titles instead of ellipsized text
- Use full content in body, even when there is a content warning
- Use media extensions

* Change feed icons and add width and height attributes to custom emojis

* Fix custom emoji animate on hover breaking

* Fix tests
2022-05-09 07:43:08 +02:00
Darius Kazemi 43d693cace Merge branch 'hometown-dev-3.5.2' into hometown-dev 2022-05-05 21:34:15 -07:00
Darius Kazemi 2c5862ede0 Merge tag 'v3.5.2' into hometown-dev-3.5.2 2022-05-05 21:08:15 -07:00
Darius Kazemi ac01eee575 Merge tag 'v3.5.1' into hometown-dev-3.5.1 2022-05-05 20:41:34 -07:00
Eugen Rochko 6da648227e
Fix error caused by missing subject in Webfinger response (#18204) 2022-05-01 00:37:46 +02:00
Eugen Rochko 7b0fe4aef9
Fix opening and closing Redis connections instead of using a pool (#18171)
* Fix opening and closing Redis connections instead of using a pool

* Fix Redis connections not being returned to the pool in CLI commands
2022-04-29 22:43:07 +02:00
Eugen Rochko 3917353645
Fix single Redis connection being used across all threads (#18135)
* Fix single Redis connection being used across all Sidekiq threads

* Fix tests
2022-04-28 17:47:34 +02:00
Eugen Rochko b93e2ae0a4
Fix n+1 query on feed merge and populate operations (#18111) 2022-04-26 22:06:31 +02:00
Claire b9197486e5
Fix UnmergeWorker being exceptionally slow in some conditions (#18110) 2022-04-26 21:48:36 +02:00
Claire 0360135d4d
Fix PeerTube videos appearing with an erroneous “Edited at” marker (#18100)
* Fix PeerTube videos appearing with an erroneous “Edited at” marker

PeerTube videos have an `updated` field equal to `published`.
When processing an incoming activity that has the same value for `updated` and
`published`, assume this doesn't represent an actual edit.

* Please CodeClimate
2022-04-26 21:25:26 +02:00
dogelover911 4c9949560d
FeedManager: skip account when target_account's last status is too old (#18009)
Co-authored-by: dogelover911 <dogelover911@localhost>
2022-04-11 21:17:03 +02:00
0x2019 012537452a
Fix error resposes for `from` search prefix (#17963)
* Fix error responses in `from` search prefix (addresses mastodon/mastodon#17941)

Using unsupported prefixes now reports a 422; searching for posts from an
account the instance is not aware of reports a 404. TODO: The UI for this
on the front end is abysmal.

Searching `from:username@domain` now succeeds when `domain` is the local
domain; searching `from:@username(@domain)?` now works as expected.

* Remove unused methods on new Error classes as they are not being used

Currently when `raise`d there are error messages being supplied, but
this is not actually being used. The associated `raise`s have been
edited accordingly.

* Remove needless comments

* Satisfy rubocop

* Try fixing tests being unable to find AccountFindingConcern methods

* Satisfy rubocop

* Simplify `from` prefix logic

This incorporates @ClearlyClaire's suggestion (see
https://github.com/mastodon/mastodon/pull/17963#pullrequestreview-933986737).

Accepctable account strings in `from:` clauses are more lenient than
before this commit; for example, `from:@user@example.org@asnteo +cat`
will not error, and return posts by @user@example.org containing the
word "cat". This is more consistent with how Mastodon matches mentions
in statuses. In addition, `from` clauses will not be checked for
syntatically invalid usernames or domain names, simply 404ing when
`Account.find_remote!` raises ActiveRecord::NotFound.

New code for this PR that is no longer used has been removed.
2022-04-08 21:21:49 +02:00
Eugen Rochko 8e20e16cf0
Change e-mail notifications to only be sent when recipient is offline (#17984)
* Change e-mail notifications to only be sent when recipient is offline

Change the default for follow and mention notifications back on

* Add preference to always send e-mail notifications

* Change wording
2022-04-08 18:03:31 +02:00
Eugen Rochko 6221b36b27
Remove sign-in token authentication, instead send e-mail about new sign-in (#17970) 2022-04-06 20:58:12 +02:00