Skip to content
Snippets Groups Projects
  1. Nov 13, 2021
  2. Nov 12, 2021
  3. Nov 11, 2021
  4. Nov 06, 2021
  5. Nov 05, 2021
    • Claire's avatar
      Fix reviving revoked sessions and invalidating login (#16943) · 6da135a4
      Claire authored
      Up until now, we have used Devise's Rememberable mechanism to re-log users
      after the end of their browser sessions. This mechanism relies on a signed
      cookie containing a token. That token was stored on the user's record,
      meaning it was shared across all logged in browsers, meaning truly revoking
      a browser's ability to auto-log-in involves revoking the token itself, and
      revoking access from *all* logged-in browsers.
      
      We had a session mechanism that dynamically checks whether a user's session
      has been disabled, and would log out the user if so. However, this would only
      clear a session being actively used, and a new one could be respawned with
      the `remember_user_token` cookie.
      
      In practice, this caused two issues:
      - sessions could be revived after being closed from /auth/edit (security issue)
      - auto-log-in would be disabled for *all* browsers after logging out from one
        of them
      
      This PR removes the `remember_token` mechanism and treats the `_session_id`
      cookie/token as a browser-specific `remember_token`, fixing both issues.
      6da135a4
    • Claire's avatar
      87085a51
    • Eugen Rochko's avatar
      Add support for structured data and more OpenGraph tags to link cards (#16938) · 39cdf61a
      Eugen Rochko authored
      Save preview cards under their canonical URL
      
      Increase max redirects to follow from 2 to 3
      39cdf61a
    • Claire's avatar
      Fix handling announcements with links (#16941) · 989c67d2
      Claire authored
      Broken since #15827
      989c67d2
  6. Nov 04, 2021
  7. Nov 02, 2021
  8. Oct 28, 2021
  9. Oct 25, 2021
    • Claire's avatar
      Fix mastodon:setup to take dotenv/docker-compose differences into account (#16896) · 5ba46952
      Claire authored
      In order to work around https://github.com/mastodon/mastodon/issues/16895,
      add a warning to .env.production.sample, and change the mastodon:setup rake
      task to:
      - output a warning if a variable will be interpreted differently by dotenv
        and docker-compose
      - ensure the printed config is compatible with docker-compose
      5ba46952
    • Sasha Sorokin's avatar
      Split context for filter bar and unread markers (#16865) · 11d4f9ee
      Sasha Sorokin authored
      On notifications page, in settings, "Show" for quick filter bar and
      unread notifications markers use the same string, while being placed in
      the separate contexts - under different settings categories.
      
      This commit splits the contexts, creating new strings:
      
      - "Show filter bar" in place of "Show" for filter bar;
      
      - "Highlight unread notifications" in place of "Show" for unread
        notification markers, which are now simply called "Highlighting";
      
      - There's also "Unread notifications" in place of "Unread notification
        markers" string to accompany the changes to "Show" string under that
        category.
      
      All new strings have new IDs, which will cause previous strings to
      invalidate on the next translation update and new strings to be created.
      This will help Mastodon translators to know that there are changes and
      improve translation in accordance to the source string update.
      11d4f9ee
    • Yurii Izorkin's avatar
      templates/systemd/mastodon: update sandbox mode (#16235) · a9ff5c83
      Yurii Izorkin authored
      * templates/systemd/mastodon: add new sandboxing options
      
      * templates/systemd/mastodon: add '@privileged' and remove duplicates SystemCallFilters
      
      * templates/systemd/mastodon: add '@ipc' SystemCallFilter
      
      * templates/systemd/mastodon: add '@memlock' SystemCallFilter
      
      * templates/systemd/mastodon: allow '@resources' filter to mastodon-web service
      a9ff5c83
  10. Oct 24, 2021
  11. Oct 21, 2021
    • Claire's avatar
      Fix some link previews being incorrectly generated from other prior links (#16885) · ec059317
      Claire authored
      * Add tests
      
      * Fix some link previews being incorrectly generated from different prior links
      
      PR #12403 added a cache to avoid redundant queries when the OEmbed endpoint can
      be guessed from the URL. This caching mechanism is not perfectly correct as
      there is no guarantee that all pages from a given domain share the same
      OEmbed provider endpoint.
      
      This PR prevents the FetchOEmbedService from caching OEmbed endpoint that
      cannot be generalized by replacing a fully-qualified URL from the endpoint's
      parameters, greatly reducing the number of incorrect cached generalizations.
      ec059317
Loading