Skip to content
Snippets Groups Projects
  1. Aug 29, 2020
  2. Aug 28, 2020
    • Akihiko Odaki's avatar
      Introduce ApplicationController#cache_collection_paginated_by_id (#14677) · 64ef37b8
      Akihiko Odaki authored
      * Replace incorrect use of distinct with group
      
      Some uses of ActiveRecord::QueryMethods#distinct pass field names but they
      are incorrect for the current version of Rails.
      
      ActiveRecord::QueryMethods#group provides the expected behavior and
      benefits performance. See commit 6da24aad4cafdef8d8a2c92bac2002a5fc2fe9c8.
      
      * Introduce ApplicationController#cache_collection_paginated_by_id
      
      ApplicationController#cache_collection_paginated_by_id fuses
      ApplicationController#cache_collection and Paginable.paginate_by_id.
      
      An advantage of this method is that it prevents from modifying scope which
      Paginable.paginate_by_id may provide.
      ApplicationController#cache_collection always return an array and there
      is no possibility of the scope modification. It is also clear for a
      programmer, considering the implication of "cache".
      
      This method can also emit more efficient queries by using
      Cacheable.cache_ids before calling Paginable.paginate_by_id.
      Unverified
      64ef37b8
    • Akihiko Odaki's avatar
      Eagerly load statuses with the main query in Api::V1::BookmarksController (#14674) · b63ede50
      Akihiko Odaki authored
      This is same with commit 552e886b except
      that it was for Api::V1::FavouritesController while this is for
      Api::V1::BookmarksController.
      Unverified
      b63ede50
    • Akihiko Odaki's avatar
      Replace incorrect use of distinct with group (#14675) · e26e7a1c
      Akihiko Odaki authored
      Some uses of ActiveRecord::QueryMethods#distinct pass field names but they
      are incorrect for the current version of Rails.
      
      ActiveRecord::QueryMethods#group provides the expected behavior and
      benefits performance. See commit 6da24aad4cafdef8d8a2c92bac2002a5fc2fe9c8.
      Unverified
      e26e7a1c
    • Akihiko Odaki's avatar
      Eagerly load statuses with the main query in Api::V1::FavouritesController (#14673) · 552e886b
      Akihiko Odaki authored
      The old implementation had two queries:
      1. The query constructed in Api::V1::FavouritesController#results
      2. The query constructed in #cached_favourites, which is merged with 1.
      
      Both of them are issued againt PostgreSQL. The combination of the two
      queries caused the following problems:
      - The small window between the two queries involves race conditions.
      - Minor performance inefficiency.
      
      Moreover, the construction of query 2, which involves merging with query
      1 has a bug. Query 1 is finalized with paginate_by_id, but paginate_by_id
      returns an array when min_id parameter is specified. The behavior prevents
      from merging the query, and in the real world, ActiveRecord simply ignores
      the merge (!), which results in querying the entire scan of statuses and
      favourites table.
      
      This change fixes these issues by simply letting query 1 get all the works
      done.
      Unverified
      552e886b
  3. Aug 26, 2020
  4. Aug 25, 2020
  5. Aug 24, 2020
    • santiagorodriguez96's avatar
      refactor: add email previews for WebAuthn emails (#14658) · 9cadd40c
      santiagorodriguez96 authored
      This is a leftover for the work done in #14466.
      Unverified
      9cadd40c
    • Daigo 3 Dango's avatar
      Stop installing libssl-dev for build (#14660) · abb14579
      Daigo 3 Dango authored
      libssl-dev is provided with the stack image in build time and
      conflicts in building openssl Gem for webauthn Gem added with #14466.
      Unverified
      abb14579
    • ThibG's avatar
      Add support for latest HTTP Signatures spec draft (#14556) · b241f20b
      ThibG authored
      * Add support for latest HTTP Signatures spec draft
      
      https://www.ietf.org/id/draft-ietf-httpbis-message-signatures-00.html
      
      - add support for the “hs2019” signature algorithm (assumed to be equivalent
        to RSA-SHA256, since we do not have a mechanism to specify the algorithm
        within the key metadata yet)
      - add support for (created) and (expires) pseudo-headers and related
        signature parameters, when using the hs2019 signature algorithm
      - adjust default “headers” parameter while being backwards-compatible with
        previous implementation
      - change the acceptable time window logic from 12 hours surrounding the “date”
        header to accepting signatures created up to 1 hour in the future and
        expiring up to 1 hour in the past (but only allowing expiration dates up to
        12 hours after the creation date)
        This doesn't conform with the current draft, as it doesn't permit accounting
        for clock skew.
        This, however, should be addressed in a next version of the draft:
        https://github.com/httpwg/http-extensions/pull/1235
      
      * Add additional signature requirements
      
      * Rewrite signature params parsing using Parslet
      
      * Make apparent which signature algorithm Mastodon on verification failure
      
      Mastodon uses RSASSA-PKCS1-v1_5, which is not recommended for new applications,
      and new implementers may thus unknowingly use RSASSA-PSS.
      
      * Add workaround for PeerTube's invalid signature header
      
      The previous parser allowed incorrect Signature headers, such as
      those produced by old versions of the `http-signature` node.js package,
      and seemingly used by PeerTube.
      
      This commit adds a workaround for that.
      
      * Fix `signature_key_id` raising an exception
      
      Previously, parsing failures would result in `signature_key_id` being nil,
      but the parser changes made that result in an exception.
      
      This commit changes the `signature_key_id` method to return `nil` in case
      of parsing failures.
      
      * Move extra HTTP signature helper methods to private methods
      
      * Relax (request-target) requirement to (request-target) || digest
      
      This lets requests from Plume work without lowering security significantly.
      Unverified
      b241f20b
    • Takeshi Umeda's avatar
    • ThibG's avatar
      Fix dereferencing remote statuses not using the correct account (#14656) · 92319d73
      ThibG authored
      Follow-up to #14359
      
      In the case of limited toots, the receiver may not be explicitly part of the
      audience. If a specific user's inbox URI was specified, it makes sense to
      dereference the toot from the corresponding user, instead of trying to find
      someone in the explicit audience.
      Unverified
      92319d73
Loading