Browse Source
It's already running on our instance (queer.group) and working fine. Manually reviewed the changes, hadn't found anything that could break hometown-specific code. And to update our instance, I also just followed the [steps on the release](https://github.com/mastodon/mastodon/releases/tag/v4.0.5) aka `bundle install && yarn install` followed by a restart of all processes. --------- Co-authored-by: Claire <claire.github-309c@sitedethib.com> Co-authored-by: Daniel M Brasil <danielmbrasil@protonmail.com> Co-authored-by: Emelia Smith <ThisIsMissEm@users.noreply.github.com> Co-authored-by: Vyr Cossont <VyrCossont@users.noreply.github.com> Co-authored-by: Renaud Chaput <renchap@gmail.com>hometown-4.0.4 v4.0.4+hometown-1.1.1-patch
Jasmin
3 years ago
committed by
GitHub
52 changed files with 599 additions and 170 deletions
@ -0,0 +1,27 @@
|
||||
<policymap> |
||||
<!-- Set some basic system resource limits --> |
||||
<policy domain="resource" name="time" value="60" /> |
||||
|
||||
<policy domain="module" rights="none" pattern="URL" /> |
||||
|
||||
<policy domain="filter" rights="none" pattern="*" /> |
||||
|
||||
<!-- |
||||
Ideally, we would restrict ImageMagick to only accessing its own |
||||
disk-backed pixel cache as well as Mastodon-created Tempfiles. |
||||
|
||||
However, those paths depend on the operating system and environment |
||||
variables, so they can only be known at runtime. |
||||
|
||||
Furthermore, those paths are not necessarily shared across Mastodon |
||||
processes, so even creating a policy.xml at runtime is impractical. |
||||
|
||||
For the time being, only disable indirect reads. |
||||
--> |
||||
<policy domain="path" rights="none" pattern="@*" /> |
||||
|
||||
<!-- Disallow any coder by default, and only enable ones required by Mastodon --> |
||||
<policy domain="coder" rights="none" pattern="*" /> |
||||
<policy domain="coder" rights="read | write" pattern="{PNG,JPEG,GIF,HEIC,WEBP}" /> |
||||
<policy domain="coder" rights="write" pattern="{HISTOGRAM,RGB,INFO}" /> |
||||
</policymap> |
||||
@ -0,0 +1,22 @@
|
||||
# frozen_string_literal: true |
||||
|
||||
module Paperclip |
||||
module MediaTypeSpoofDetectorExtensions |
||||
def calculated_content_type |
||||
return @calculated_content_type if defined?(@calculated_content_type) |
||||
|
||||
@calculated_content_type = type_from_file_command.chomp |
||||
|
||||
# The `file` command fails to recognize some MP3 files as such |
||||
@calculated_content_type = type_from_marcel if @calculated_content_type == 'application/octet-stream' && type_from_marcel == 'audio/mpeg' |
||||
@calculated_content_type |
||||
end |
||||
|
||||
def type_from_marcel |
||||
@type_from_marcel ||= Marcel::MimeType.for Pathname.new(@file.path), |
||||
name: @file.path |
||||
end |
||||
end |
||||
end |
||||
|
||||
Paperclip::MediaTypeSpoofDetector.prepend(Paperclip::MediaTypeSpoofDetectorExtensions) |
||||
Binary file not shown.
@ -0,0 +1,53 @@
|
||||
# frozen_string_literal: true |
||||
|
||||
require 'rails_helper' |
||||
|
||||
RSpec.describe AccountReachFinder do |
||||
let(:account) { Fabricate(:account) } |
||||
|
||||
let(:follower1) { Fabricate(:account, protocol: :activitypub, inbox_url: 'https://example.com/inbox-1') } |
||||
let(:follower2) { Fabricate(:account, protocol: :activitypub, inbox_url: 'https://example.com/inbox-2') } |
||||
let(:follower3) { Fabricate(:account, protocol: :activitypub, inbox_url: 'https://foo.bar/users/a/inbox', shared_inbox_url: 'https://foo.bar/inbox') } |
||||
|
||||
let(:mentioned1) { Fabricate(:account, protocol: :activitypub, inbox_url: 'https://foo.bar/users/b/inbox', shared_inbox_url: 'https://foo.bar/inbox') } |
||||
let(:mentioned2) { Fabricate(:account, protocol: :activitypub, inbox_url: 'https://example.com/inbox-3') } |
||||
let(:mentioned3) { Fabricate(:account, protocol: :activitypub, inbox_url: 'https://example.com/inbox-4') } |
||||
|
||||
let(:unrelated_account) { Fabricate(:account, protocol: :activitypub, inbox_url: 'https://example.com/unrelated-inbox') } |
||||
|
||||
before do |
||||
follower1.follow!(account) |
||||
follower2.follow!(account) |
||||
follower3.follow!(account) |
||||
|
||||
Fabricate(:status, account: account).tap do |status| |
||||
status.mentions << Mention.new(account: follower1) |
||||
status.mentions << Mention.new(account: mentioned1) |
||||
end |
||||
|
||||
Fabricate(:status, account: account) |
||||
|
||||
Fabricate(:status, account: account).tap do |status| |
||||
status.mentions << Mention.new(account: mentioned2) |
||||
status.mentions << Mention.new(account: mentioned3) |
||||
end |
||||
|
||||
Fabricate(:status).tap do |status| |
||||
status.mentions << Mention.new(account: unrelated_account) |
||||
end |
||||
end |
||||
|
||||
describe '#inboxes' do |
||||
it 'includes the preferred inbox URL of followers' do |
||||
expect(described_class.new(account).inboxes).to include(*[follower1, follower2, follower3].map(&:preferred_inbox_url)) |
||||
end |
||||
|
||||
it 'includes the preferred inbox URL of recently-mentioned accounts' do |
||||
expect(described_class.new(account).inboxes).to include(*[mentioned1, mentioned2, mentioned3].map(&:preferred_inbox_url)) |
||||
end |
||||
|
||||
it 'does not include the inbox of unrelated users' do |
||||
expect(described_class.new(account).inboxes).to_not include(unrelated_account.preferred_inbox_url) |
||||
end |
||||
end |
||||
end |
||||
Loading…
Reference in new issue