* Add “bundle clean” suggestion from CircleCI doc
Cf. https://circleci.com/docs/2.0/caching/#bundler-ruby
* Use workspaces instead of caches for ruby gems
Cache are not guaranteed to be available, while the test jobs *require* their
depencies to run. Workspaces are thus more suitable.
One downside is that the order of workspace layer additions need to be
deterministic, which is why install-ruby{2.3,2.4} now depend on
install-ruby2.5.
* Disable the animated rainbow text when the “Reduce motion” setting is set
* Get rid of the Content Warning rainbows
* Revert to default color for CWs in admin view
Since that colorscheme is apparently broken for some colorblind people.
* Use HTML5's details and summary for statuses with CWs in admin interface
* Allow accessing local private/DM messages by URL
(Provided the user pasting the URL is authorized to see the toot, obviously)
* Fix SearchServiceSpec tests
* Prevent default event handling when clicking on the video position slider
This prevents accidental text selection when clicking on the position slider.
* Fix bug when clicking on video position slider before starting the video
* Slightly more aggressive video preloading
- Preload video metadata if the video is loaded in detailed view, as it is
likely to get played, and metadata is useful for seeking in the video.
- Preload video data if it's fullscreen as it is extremely likely to get
played right after being put in fullscreen (although those are two steps).
- Preload video data if the user has clicked the position slider, as the video
will play as soon as the mouse button is released, and video metadata is
needed to properly seek into the video.
Include a dummy Account class in the migration script containing only the
attributes relevant to the migration in order to not rely as much on the
codebase being in sync with the database schema.
When there is a single detailed status on a public page, scroll to it and
replace the history state to not scroll back on refresh (simulates # anchors).
While this isn't exactly *wrong*, files uploaded with a “.jpe” extension will
keep that extension, which will often cause them to be served with an
incorrect mimetype.
* Distinguish boosts from original statuses in the admin panel (fixes#7449)
* Show the “show more” button in admin view to make CWs clearer (fixes#7451)
* Make content warnings swag
When an ActivityPub Announce is processed and the boosted toot is not known,
fetch it on behalf of one of the booster's followers. This is to allow
fetching self-boosts of previously-unknown private toots.
If fetching on behalf of a user fails, try fetching it anonymously: the
selected follower of a boosting user may be banned by the boosted toot's
author.
* Revert "Do not re-position scroll when loading more (inserting items from below) (#7344)"
This reverts commit 8c601b54cc.
* Revert "Prevent timeline from moving when cursor is hovering over it (fixes#7278) (#7327)"
This reverts commit 58852695c8.
* Also display replies in report modal
* Allow report modal to be up to 80% of viewport height
* Use narrow no-break space where needed in the French translation
* Mark currently selected privacy setting in privacy dropdown
* Prevent Enter keypresses from triggering dropdown display toggle twice
* Give focus to first/selected item of dropdown menus
* Implement keyboard navigation in privacy dropdown
* Implement keyboard navigation in generic dropdown menus
* Revert "Fixes/do not override timestamps (#7331)"
This reverts commit 581a5c9d29.
* Document Snowflake ID corner-case a bit more
Snowflake IDs are used for two purposes: making object identifiers harder to
guess and ensuring they are in chronological order. For this reason, they
are based on the `created_at` attribute of the object.
Unfortunately, inserting items with older snowflakes IDs will break the
assumption of consumers of the paging APIs that new items will always have
a greater identifier than the last seen one.
* Add `override_timestamps` virtual attribute to not correlate snowflake ID with created_at
* Do not override timestamps for incoming toots
* Remove every reference to override_timestamps
Statuses are now created with the announced publishing date
and are only pushed to timelines if that date is at most
6 hours earlier than the time at which it is processed.
* Fix follow/unfollow buttons on public profile
- Present non-logged users with web+mastodon:// URLs for remote accounts
- Present logged-in users with appropriate links (authorize_follows and
remote_unfollows) for remote accounts
* Do not cache rendered cards if user is logged in
* Keep list of blocked domains
Might be overkill, but I'm trying to follow the same logic as for blocked users
* Add basic domain block UI
* Add the domain blocks UI to Getting Started
* Fix undefined URL in `fetchDomainBlocks`
* Update all known users' domain_blocking relationship instead of just one's
Up until now, the order seemed to be in the *opposite* order,
which caused the WebUI to populate mentions in reversed order
when replying to toots local to one's instance.
* Add button to unblock blocked accounts from their profile
* Add “Blocked” badge in place of “Follows you” when the user is blocked
* Add “Muted” badge (below “follows you” badge)
Since 872a0d5bd8, assets URL are absolute and
not relative. Unfortunately, the domain used to build such URLs is the wrong
one: LOCAL_DOMAIN, and not WEB_DOMAIN, where the assets are stored.
Currently, Mastodon will retry delivering toots for a bit over 1 hour.
This is a very short timespan when considering private and direct toots, which
cannot be seen by the recipient at all after the delivery attempts have failed.
Ideally, private and direct toots should have a different number of retries,
but I do not know how to do that.
* Don't normalize URLs in toots
URL normalization is ill-defined and may cause certain links to break.
* Change specs since we are not normalizing user-provided URLs
* Allow HTTP caching of json view of public statuses
HTML views are not cached as they can contain private statuses as well
* Disable session cookies for ActivityPub json rendering of public toots
* Make host_meta/webfinger replies cacheable (fixes#6100)
Drop common code for handling users and sessions as webfinger queries
are very basic, public APIs.
Also explicitly mark results as cacheable with “expires_in”.
* Add “Vary: Accept” header for caching since content-negociation is used
Deleted users are technically suspended, but the code displaying their status
in the admin interface was broken and displayed a javascript object holding
translations of the possible user roles instead.
* Add test for temporary account resolving failures in ProcessMentionsService
* Fix processing of mentions to already-known remote accounts on temporary failures
Thread resolving is one of the few tasks that isn't retried on failure.
One common cause for failure of this task is a well-connected user replying to
a toot from a little-connected user on a small instance: the small instance
will get many requests at once, and will often fail to answer requests within
the 10 seconds timeout used by Mastodon.
This changes makes the ThreadResolveWorker retry a few times, with a
rapidly-increasing time before retries and large random contribution in order
to spread the load over time.
* Work around Twidere and Tootdon bug
Tootdon and Twidere construct @user@domain handles from mentions in toots based
solely on the mention text and account URI's domain without performing any
webfinger call or retrieving account info from the Mastodon server.
As a result, when a remote user has WEB_DOMAIN ≠ LOCAL_DOMAIN, Twidere and
Tootdon will construct the mention as @user@WEB_DOMAIN. Now, this will usually
resolve to the correct account (since the recommended configuration is to have
WEB_DOMAIN perform webfinger redirections to LOCAL_DOMAIN) when processing
mentions, but won't do so when displaying them (as it does not go through the
whole account resolution at that time).
This change rewrites mentions to the resolved account, so that displaying the
mentions will work.
* Use lookbehind instead of non-capturing group in MENTION_RE
Indeed, substitutions with the previous regexp would erroneously eat any
preceding whitespace, which would lead to concatenated mentions in the
previous commit.
Note that users will “lose” up to one character space per mention for their
toots, as that regexp is also used to remove the domain-part of mentioned
users for character counting purposes, and it also erroneously removed the
preceding character if it was a space.
* Resolve remote accounts when mentioned even if they are already known
This commit reduces the risk of not having up-to-date public key or protocol
information for a remote account, which is required to deliver toots
(especially direct messages).
* Do not add mentions in private messages for remote users we cannot deliver to
Mastodon does not deliver private and direct toots to OStatus users, as there
is no guarantee the remote software understands the toot's privacy. However,
users currently do not get any feedback on it (Mastodon won't attempt delivery,
but the toot will be displayed exactly the same way to the user).
This change introduces *some* feedback by not processing mentions that are
not going to be delivered. A long-term solution is still needed to have
delivery receipts or at least some better indication of what is going on, but
at least an user can see *something* is up.
This commit reduces the risk of not having up-to-date public key or protocol
information for a remote account, which is required to deliver toots
(especially direct messages).
Remote ActivityPub users that have never been known as OStatus users
(whether or not they support it) will not have a “remote_url” attribute
set. In case they reside on an instance with WEB_DOMAIN ≠ LOCAL_DOMAIN,
the current check did rely on “remote_url” to verify the user's domain.
The whole point of verified_webfinger? is to check the WebFinger-discoverable
URI maps back to the known author URI. This was not actually verified if the
first Webfinger request was not a redirection.
* Return sensible HTTP status for ActivityPub inbox processing
* Return sensible HTTP status for salmon slap processing
* Return additional information to debug signature verification failures
ThibGandEugen Rochko
