5a44db38ac
Fix incorrect signature after HTTP redirect ( #33757 )
1 year ago
81cd489208
Fix Content-Security-Policy when using sso-redirect ( #32241 )
2 years ago
3dc4ddc663
Fix search params being dropped when redirected to non-deck path ( #31984 )
2 years ago
a496aeabcb
Change form-action Content-Security-Policy directive to be more restrictive ( #26897 )
2 years ago
7efe0bde9d
Add `have_http_link_header` matcher and set header values as strings ( #31010 )
2 years ago
2ec1181ee5
Fix contrast between background and form elements on some pages ( #31266 )
2 years ago
85d9053b36
Move `pagination_params` into `API::BaseController` ( #28845 )
2 years ago
c3be5a3d2e
Remove caching in `cache_collection` ( #29862 )
2 years ago
65e82211cd
Rename `cache_*` methods to `preload_*` in controller concern ( #30209 )
2 years ago
1d3ecd3fba
Add `API::Pagination` concern ( #28826 )
2 years ago
babbf6017d
Remove caching in `cache_collection` ( #29862 )
2 years ago
edde54e991
Update stoplight to version 4.1.0 ( #28366 )
2 years ago
f9100743ec
Add `Api::ErrorHandling` concern for api/base controller ( #29574 )
2 years ago
7efc33b909
Move HTTP Signature parsing code to its own class ( #28932 )
2 years ago
13fa4f70cc
Merge security fixes of mastodon v4.0.13 ( #1340 )
...
There were some smaller merge conflicts (e.g. in `lib/version.rb`), but
all of them were of smaller nature. Due to the fact that other v4.0.*
versions are also included, it's a bit bigger than the other PR for 3.5.
I won't repeat the changelog here, the upgrade is the usual *git pull
and restart all mastodon processes*.
---------
Co-authored-by: Michael Stanclift <mx@vmstan.com>
Co-authored-by: Claire <claire.github-309c@sitedethib.com>
Co-authored-by: Eugen Rochko <eugen@zeonfederated.com>
Co-authored-by: Emelia Smith <ThisIsMissEm@users.noreply.github.com>
Co-authored-by: Renaud Chaput <renchap@gmail.com>
Co-authored-by: Daniel M Brasil <danielmbrasil@protonmail.com>
Co-authored-by: yufushiro <62991447+yufushiro@users.noreply.github.com>
Co-authored-by: Nicolai Søborg <NicolaiSoeborg@users.noreply.github.com>
Co-authored-by: Essem <smswessem@gmail.com>
Co-authored-by: Jakob Gillich <jakob@gillich.me>
Co-authored-by: David Aaron <1858430+suddjian@users.noreply.github.com>
Co-authored-by: Matt Jankowski <matt@jankowski.online>
2 years ago
a6641f828b
Merge pull request from GHSA-3fjr-858r-92rw
...
* Fix insufficient origin validation
* Bump version to v4.2.5
2 years ago
1726085db5
Merge pull request from GHSA-3fjr-858r-92rw
...
* Fix insufficient origin validation
* Bump version to 4.3.0-alpha.1
2 years ago
6fe2a47357
Add rate-limit of TOTP authentication attempts at controller level ( #28801 )
2 years ago
3837ec2227
Fix Mastodon not correctly processing HTTP Signatures with query strings ( #28476 )
2 years ago
b19ae521b7
Add confirmation when redirecting logged-out requests to permalink ( #27792 )
...
Co-authored-by: Claire <claire.github-309c@sitedethib.com>
2 years ago
3593ee2e36
Add rate-limit of TOTP authentication attempts at controller level ( #28801 )
2 years ago
5a6d533c53
Enable Rails 7.1 Marshalling format ( #28609 )
2 years ago
092bb8a27a
Fix Mastodon not correctly processing HTTP Signatures with query strings ( #28476 )
2 years ago
963354978a
Add `Account#unavailable?` and `Account#permanently_unavailable?` aliases ( #28053 )
2 years ago
1f1c75bba5
File cleanup/organization in `controllers/concerns` ( #27846 )
2 years ago
291dc04e67
Remove un-needed `action` and `template` options to `render` in controllers ( #28022 )
2 years ago
d562fb8459
Specs for minimal CSP policy in `Api::` controllers ( #27845 )
2 years ago
33f8c1c5eb
Remove version check from update cache_concern.rb ( #27592 )
3 years ago
379115e601
Add SELF_DESTRUCT env variable to process self-destructions in the background ( #26439 )
3 years ago
d4c2dca874
Fix haml-lint `InstanceVariables` rule for auth/sessions/two_factor/o… ( #27372 )
3 years ago
ffcf2c691e
Fix Vary headers not being set on some redirects ( #27272 )
3 years ago
40ba6e119b
Fix Vary headers not being set on some redirects ( #27272 )
3 years ago
340f1a68be
Simplify instance presenter view access ( #26046 )
3 years ago
9a70cac9de
Fix #26849 by adding the domain of the current SSO provider to the form-action CSP ( #26857 )
3 years ago
09ec9c6aa5
Downgrade signature verification debug logging from `warn` to `debug` ( #26812 )
3 years ago
25bf640629
Add debug logging on signature verification failure ( #26637 )
3 years ago
8b37dd2c86
Fix Content Security Policy sometimes unnecessarily allowing hCaptcha scripts ( #26388 )
3 years ago
120f5802c0
Add direct link to the Single-Sign On provider if there is only one sign up method available ( #26083 )
3 years ago
e258b4cb64
Refactor: replace whitelist_mode mentions with limited_federation_mode ( #26252 )
3 years ago
2e1391fdd2
Fix `Naming/MemoizedInstanceVariableName` cop ( #25928 )
3 years ago
5134fc65e2
Fix `Naming/AccessorMethodName` cop ( #25924 )
3 years ago
39110d1d0a
Fix CAPTCHA page not following design pattern of sign-up flow ( #25395 )
3 years ago
bec6a1cad4
Add hCaptcha support ( #25019 )
3 years ago
d5a185d721
Autofix Rubocop Style/CaseLikeIf ( #23756 )
3 years ago
668a19a2f3
Fix Performance/DeletePrefix cop ( #24796 )
3 years ago
b0bf6216e6
Fix /api/v1/instance/domain_blocks being unconditionally cached ( #24662 )
3 years ago
276c39361b
Fix anonymous visitors getting a session cookie on first visit ( #24584 )
3 years ago
6084461cd0
Change unauthenticated responses to be cached in REST API ( #24348 )
3 years ago
58a1b2e330
Fix caching logic with regards to Accept-Language, Cookie, and Signature ( #24604 )
3 years ago
e98c86050a
Refactor `Cache-Control` and `Vary` definitions ( #24347 )
3 years ago
Claire
Renaud Chaput
Matt Jankowski
Jasmin
Eugen Rochko
Jean Boussier
Ricardo Trindade
CSDUMMI
Emelia Smith
Nick Schonning