[IMPORTANT] Squash commits before 2020.11.09 #253
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
While OAuth tokens were immediately revoked, accessing the home controller immediately generated new OAuth tokens and "revived" the session due to a combination of using remember_me tokens and overwriting the `authenticate_user!` method
- Rate limit login attempts by target account - Rate limit password resets and e-mail re-confirmations by target account - Rate limit sign-up/login attempts, password resets, and e-mail re-confirmations by IP like before
Signed-off-by: Eugen Rochko <[email protected]>
Merge upstream v3.1.5
This reverts commit ad4b4f7.
This reverts commit 6670b03.
This reverts commit 0463d24.
This reverts commit de17572.
This reverts commit 22dceec.
twitter & like count
* enhance transparent theme & hashtag & cw button * fix bug handling code block in htmlParser
* enhance transparent theme & hashtag & cw button * fix bug handling code block in htmlParser * fix style * fix style
* enhance transparent theme & hashtag & cw button * fix bug handling code block in htmlParser * fix style * fix style * add hashtag markup * add hashtag markup
* Add support for Gemini urls (mastodon#15013) This PR updates the `valid_url` regex and sanitizer allowlist to provide support for Gemini urls. Closes mastodon#14991 * Removed disabling comments for Style/MethodMissingSuper (mastodon#15014) * Removed disabling comments for Style/MethodMissingSuper * Update rubocop for codeclimate * Add follower synchronization mechanism (mastodon#14510) * Add support for followers synchronization on the receiving end Check the `collectionSynchronization` attribute on `Create` and `Announce` activities and synchronize followers from provided collection if possible. * Add tests for followers synchronization on the receiving end * Add support for follower synchronization on the sender's end * Add tests for the sending end * Switch from AS attributes to HTTP header Replace the custom `collectionSynchronization` ActivityStreams attribute by an HTTP header (`X-AS-Collection-Synchronization`) with the same syntax as the `Signature` header and the following fields: - `collectionId` to specify which collection to synchronize - `digest` for the SHA256 hex-digest of the list of followers known on the receiving instance (where “receiving instance” is determined by accounts sharing the same host name for their ActivityPub actor `id`) - `url` of a collection that should be fetched by the instance actor Internally, move away from the webfinger-based `domain` attribute and use account `uri` prefix to group accounts. * Add environment variable to disable followers synchronization Since the whole mechanism relies on some new preconditions that, in some extremely rare cases, might not be met, add an environment variable (DISABLE_FOLLOWERS_SYNCHRONIZATION) to disable the mechanism altogether and avoid followers being incorrectly removed. The current conditions are: 1. all managed accounts' actor `id` and inbox URL have the same URI scheme and netloc. 2. all accounts whose actor `id` or inbox URL share the same URI scheme and netloc as a managed account must be managed by the same Mastodon instance as well. As far as Mastodon is concerned, breaking those preconditions require extensive configuration changes in the reverse proxy and might also cause other issues. Therefore, this environment variable provides a way out for people with highly unusual configurations, and can be safely ignored for the overwhelming majority of Mastodon administrators. * Only set follower synchronization header on non-public statuses This is to avoid unnecessary computations and allow Follow-related activities to be handled by the usual codepath instead of going through the synchronization mechanism (otherwise, any Follow/Undo/Accept activity would trigger the synchronization mechanism even if processing the activity itself would be enough to re-introduce synchronization) * Change how ActivityPub::SynchronizeFollowersService handles follow requests If the remote lists a local follower which we only know has sent a follow request, consider the follow request as accepted instead of sending an Undo. * Integrate review feeback - rename X-AS-Collection-Synchronization to Collection-Synchronization - various minor refactoring and code style changes * Only select required fields when computing followers_hash * Use actor URI rather than webfinger domain in synchronization endpoint * Change hash computation to be a XOR of individual hashes Makes it much easier to be memory-efficient, and avoid sorting discrepancy issues. * Marginally improve followers_hash computation speed * Further improve hash computation performances by using pluck_each * helm: bump version to 3.2.1 (mastodon#15019) * Bump @testing-library/react from 11.0.4 to 11.1.0 (mastodon#14992) Bumps [@testing-library/react](https://github.com/testing-library/react-testing-library) from 11.0.4 to 11.1.0. - [Release notes](https://github.com/testing-library/react-testing-library/releases) - [Changelog](https://github.com/testing-library/react-testing-library/blob/master/CHANGELOG.md) - [Commits](testing-library/react-testing-library@v11.0.4...v11.1.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump @babel/core from 7.11.6 to 7.12.3 (mastodon#14993) Bumps [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) from 7.11.6 to 7.12.3. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.12.3/packages/babel-core) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump @babel/runtime from 7.11.2 to 7.12.1 (mastodon#14994) Bumps [@babel/runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime) from 7.11.2 to 7.12.1. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.12.1/packages/babel-runtime) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump webmock from 3.9.1 to 3.9.3 (mastodon#14996) Bumps [webmock](https://github.com/bblimke/webmock) from 3.9.1 to 3.9.3. - [Release notes](https://github.com/bblimke/webmock/releases) - [Changelog](https://github.com/bblimke/webmock/blob/master/CHANGELOG.md) - [Commits](bblimke/webmock@v3.9.1...v3.9.3) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump @babel/plugin-transform-react-inline-elements from 7.10.4 to 7.12.1 (mastodon#14998) Bumps [@babel/plugin-transform-react-inline-elements](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-react-inline-elements) from 7.10.4 to 7.12.1. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.12.1/packages/babel-plugin-transform-react-inline-elements) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump active_record_query_trace from 1.7 to 1.8 (mastodon#14999) Bumps [active_record_query_trace](https://github.com/brunofacca/active-record-query-trace) from 1.7 to 1.8. - [Release notes](https://github.com/brunofacca/active-record-query-trace/releases) - [Changelog](https://github.com/brunofacca/active-record-query-trace/blob/master/HISTORY.md) - [Commits](brunofacca/active-record-query-trace@v1.7...v1.8) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump yargs from 16.0.3 to 16.1.0 (mastodon#15010) Bumps [yargs](https://github.com/yargs/yargs) from 16.0.3 to 16.1.0. - [Release notes](https://github.com/yargs/yargs/releases) - [Changelog](https://github.com/yargs/yargs/blob/master/CHANGELOG.md) - [Commits](yargs/yargs@v16.0.3...v16.1.0) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump oj from 3.10.14 to 3.10.15 (mastodon#15009) Bumps [oj](https://github.com/ohler55/oj) from 3.10.14 to 3.10.15. - [Release notes](https://github.com/ohler55/oj/releases) - [Changelog](https://github.com/ohler55/oj/blob/develop/CHANGELOG.md) - [Commits](ohler55/oj@v3.10.14...v3.10.15) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump tzinfo-data from 1.2020.2 to 1.2020.3 (mastodon#15002) Bumps [tzinfo-data](https://github.com/tzinfo/tzinfo-data) from 1.2020.2 to 1.2020.3. - [Release notes](https://github.com/tzinfo/tzinfo-data/releases) - [Commits](tzinfo/tzinfo-data@v1.2020.2...v1.2020.3) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump rubocop from 0.93.0 to 0.93.1 (mastodon#15004) Bumps [rubocop](https://github.com/rubocop-hq/rubocop) from 0.93.0 to 0.93.1. - [Release notes](https://github.com/rubocop-hq/rubocop/releases) - [Changelog](https://github.com/rubocop-hq/rubocop/blob/master/CHANGELOG.md) - [Commits](rubocop/rubocop@v0.93.0...v0.93.1) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump omniauth-saml from 1.10.2 to 1.10.3 (mastodon#15007) Bumps [omniauth-saml](https://github.com/omniauth/omniauth-saml) from 1.10.2 to 1.10.3. - [Release notes](https://github.com/omniauth/omniauth-saml/releases) - [Changelog](https://github.com/omniauth/omniauth-saml/blob/master/CHANGELOG.md) - [Commits](omniauth/omniauth-saml@v1.10.2...v1.10.3) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump @github/webauthn-json from 0.5.6 to 0.5.7 (mastodon#14997) Bumps [@github/webauthn-json](https://github.com/github/webauthn-json) from 0.5.6 to 0.5.7. - [Release notes](https://github.com/github/webauthn-json/releases) - [Commits](github/webauthn-json@v0.5.6...v0.5.7) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump @babel/plugin-proposal-decorators from 7.10.5 to 7.12.1 (mastodon#15008) Bumps [@babel/plugin-proposal-decorators](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-proposal-decorators) from 7.10.5 to 7.12.1. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.12.1/packages/babel-plugin-proposal-decorators) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump @babel/preset-react from 7.10.4 to 7.12.1 (mastodon#15006) Bumps [@babel/preset-react](https://github.com/babel/babel/tree/HEAD/packages/babel-preset-react) from 7.10.4 to 7.12.1. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.12.1/packages/babel-preset-react) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump react from 16.13.1 to 16.14.0 (mastodon#15005) Bumps [react](https://github.com/facebook/react/tree/HEAD/packages/react) from 16.13.1 to 16.14.0. - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/master/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v16.14.0/packages/react) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump @babel/preset-env from 7.11.5 to 7.12.1 (mastodon#15001) Bumps [@babel/preset-env](https://github.com/babel/babel/tree/HEAD/packages/babel-preset-env) from 7.11.5 to 7.12.1. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.12.1/packages/babel-preset-env) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump @babel/plugin-transform-runtime from 7.11.5 to 7.12.1 (mastodon#14995) Bumps [@babel/plugin-transform-runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-runtime) from 7.11.5 to 7.12.1. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.12.1/packages/babel-plugin-transform-runtime) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Fix account processing failing because of large collections (mastodon#15027) Fixes mastodon#15025 * Fix followers synchronization mechanism not being triggered on mentions (mastodon#15026) e.g. if someone on an instance that previously had followers gets mentioned in a private toot, before this PR, they would not receive a Collection-Synchronization header and may show the toot to the former followers in addition to the mentioned person. Co-authored-by: Josh Leeb-du Toit <[email protected]> Co-authored-by: abcang <[email protected]> Co-authored-by: ThibG <[email protected]> Co-authored-by: Alex Dunn <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
merge upstream (bump version to 3.2.1)
* Add quote feature * Compatible with Misskey quote * Apply quote by parsing post body * Add index to statuses quote_id * Add confirmation of overwriting of input content when quoting * quote: fix reblog availability check * update CSS for quote status * Modify quote related CSS (#9) * Add feature_quote to instance API * Fix boost target to be quoted if boosted * Fix quote nesting at once, add quote_id * quote: fix git HEAD mistak * support rich content type in quote statues Co-authored-by: Genbu Hase <[email protected]> Co-authored-by: noellabo <[email protected]> Co-authored-by: Allen Zhong <[email protected]> Co-authored-by: 常盤 みどり <[email protected]>
* [New] Implement a feature of quote * remake quote feature * Fix quote nesting at once, add quote_id * Fix boost target to be quoted if boosted * Add feature_quote to instance API * Add confirmation of overwriting of input content when quoting * Fix to reject status quotations other than public and unlisted * Add index to statuses quote_id * Change not to delete the element specified in invisible * Compatible with Misskey quote * Apply quote by parsing post body * Fix null poll * Fix an avatar icon size of the status quoted on the public page * Fix tooltip 'cannot be quoted' * Fix quoted audio * Fix PictureInPicture to work in quotes * Add a quote URL to the search target string * rich content quote support [with TODO] * Add quote availability check for local only * rm unused "expires_at" Co-authored-by: Genbu Hase <[email protected]> Co-authored-by: wakin <[email protected]> Co-authored-by: noellabo <[email protected]>
mashirozx
changed the title
mashirozx
changed the title
mashirozx
changed the title
Repository owner
locked as off-topic and limited conversation to collaborators
Nov 9, 2020
mashirozx
changed the title
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
squash modifications before commit cfbf26f (mashirozx/master)
the last commit tree on upstream/master:
https://github.com/mashirozx/mastodon/tree/2b63c62c57b431074c7b91e195cabf94a0db7a10
the last commit tree on mashirozx/master:
https://github.com/mashirozx/mastodon/tree/cfbf26fc87bd7ff7c1f59287e0d2e0ba709b23b9
for further revert, try to revert on the last commit tree and merge to master.
I've kept the last commit as branch: https://github.com/mashirozx/mastodon/tree/the-last-commit-tree-before-rebase
maybe one day I'll rebase or recommit these changes.