Commit Graph

851 Commits

Author SHA1 Message Date
Julian Lam
1bd8f9a1fa feat: fine-grained privileges integration for fediverse users and world pseudo-category 2024-02-26 11:39:32 -05:00
Julian Lam
92a8951bca fix: check origin only if object is a string 2024-02-21 14:05:54 -05:00
Julian Lam
a94341f489 feat: security, cross-check key ownership against received actor 2024-02-21 13:43:56 -05:00
Julian Lam
d18e65c473 feat: send proper content-type on AP S2S responses 2024-02-05 14:11:32 -05:00
Julian Lam
47b3ffb9b1 lint: fix eslint errors 2024-01-22 13:51:06 -05:00
Julian Lam
538776f9c7 refactor: move activitypub-related middlewares to their own file 2024-01-18 11:50:14 -05:00
Julian Lam
71e3d26bb4 fix: incorrect logic 2023-12-22 12:58:30 -05:00
Julian Lam
dd480aa4f6 fix: update proceedOnActivityPub middleware to handle how Mastodon doesn't send the 'Accepts' header 2023-12-21 15:49:51 -05:00
Julian Lam
48fd2e6441 Merge remote-tracking branch 'origin/develop' into activitypub 2023-12-13 13:21:32 -05:00
Barış Soner Uşaklı
d13bfacd74 Merge branch 'master' into develop 2023-12-13 13:18:32 -05:00
Barış Soner Uşaklı
2dc1def51f fix: #12227, fix crash in redirect 2023-12-13 13:18:07 -05:00
Julian Lam
99cc60c8d5 fix: add basic sanity-checking to middleware.validateActivity 2023-12-06 13:57:49 -05:00
Julian Lam
e7184eb8cc feat: http signatures support, .sign() and .verify() AP helper methods 2023-12-06 13:38:41 -05:00
Julian Lam
ab3ff320b5 refactor: acp tpl + config option
- Updated ACP template to match new format
- changed global switch to `activitypubEnabled` (lowercase p)
2023-12-06 13:38:18 -05:00
Julian Lam
0cbbce8c16 chore: update AP helpers export, 404 logic reversal, no slugify in userslug in mock profile from remote instance 2023-12-06 13:38:18 -05:00
Julian Lam
a05b674e27 feat: ability to view federated profiles via url manipulation 2023-12-06 13:38:18 -05:00
Julian Lam
099124c49e feat: global switch for disabling federation, + test 2023-12-06 13:38:18 -05:00
Julian Lam
2dec357aee feat: activitypub actor endpoint for user accounts 2023-12-06 13:38:18 -05:00
Julian Lam
d7c6b3d60e refactor(socket.io): deprecate categories.setWatchState in favour of api.categories.setWatchState 2023-10-31 11:32:07 -04:00
Barış Soner Uşaklı
b1ff93f85c refactor: get rid of util.promisify on async function 2023-10-22 16:15:28 -04:00
Barış Soner Uşaklı
b398321a5e Chat with privileged (#12092)
* Update headers.js

Fixes X-Upstream-Hostname header for os hostnames with invalid characters

* Added missing period in allowed hostname chars

Allowed hostname chars should include A-Za-z0-9-. based on https://man7.org/linux/man-pages/man7/hostname.7.html

* feat: add chat:privileged global privilege

to only allow chatting with privileged users

* test: fix priv test

* test: one more fix

---------

Co-authored-by: chadjw <chad.warner@gmail.com>
2023-10-17 13:19:25 -04:00
Julian Lam
d7e9f32412 test: additional tests for #12034 2023-09-26 14:54:13 -04:00
Julian Lam
74902e4a7b fix: #11808, reduce zeal of middleware.registrationComplete
Now will judiciously check whether the target category or topic is restricted to verified users before redirecting unverified users to the email confirmation interstitial
2023-09-26 14:54:13 -04:00
Barış Soner Uşaklı
9e829b983d 308 /uid/<uid> to /user/<slug> 2023-08-16 20:28:34 -04:00
Julian Lam
bcc4b82cc6 feat: middleware.handleMultipart, applies on API routes — invokes multipart middleware based on content-type header 2023-08-03 12:16:03 -04:00
Barış Soner Uşaklı
a5cc5372cb Merge branch 'master' into develop 2023-07-15 20:05:27 -04:00
Barış Soner Uşaklı
a4dba8d3fa fix: #11804, fix direction of dropdown on rtl 2023-07-15 18:54:50 -04:00
Barış Soner Uşaklı
539a4d437c Merge branch 'master' into develop 2023-07-15 15:52:49 -04:00
Barış Soner Uşaklı
a0478c7049 fix: #11803, fix rtl in acp 2023-07-15 15:06:12 -04:00
Barış Soner Uşaklı
bc8dbc2084 add roomId class to body 2023-07-13 20:01:39 -04:00
Barış Soner Uşaklı
9b901783fa Chat refactor (#11779)
* first part of chat refactor

remove per user chat zsets & store all mids in chat:room:<roomId>:mids
reverse uids in getUidsInRoom

* feat: create room button

public groups wip

* feat: public rooms

create chats:room zset
chat room deletion

* join socket.io room

* get rid of some calls that load all users in room

* dont load all users when loadRoom is called

* mange room users infinitescroll

dont load all members in api call

* IS for user list

ability to change groups field for public rooms
update groups field if group is renamed

* test: test fixes

* wip

* keep 150 messages

* fix extra awaits

fix dupe code in chat toggleReadState

* unread state for public rooms

* feat: faster push unread

* test: spec

* change base to harmony

* test: lint fixes

* fix language of chat with message

* add 2 methods for perf

messaging.getTeasers and getUsers(roomIds)
instead of loading one by one

* refactor: cleaner conditional

* test fix upgrade script fix

save timestamp of room creation in room object

* set progress.total

* don't check for guests/spiders

* public room unread fix

* add public unread counts

* mark read on send

* ignore instead of throwing

* doggy.gif

* fix: restore delete

* prevent entering chat rooms with

meta.enter

* fix self message causing mark unread

* ability to sort public rooms

* dont init sortable on mobile

* move chat-loaded class to core

* test: fix spec

* add missing keys

* use ajaxify

* refactor: store some refs

* fix: when user is deleted remove from public rooms as well

* feat: change how unread count is calculated

* get rid of cleaned content

get rid of mid

* add help text

* test: fix tests, add back mid

to prevent breaking change

* ability to search members of chat rooms

* remove

* derp

* perf: switch with  partial data

fix tests

* more fixes

if user leaves a group leave public rooms is he is no longer part of any of the groups that have access

fix the cache key used to get all public room ids

dont allow joining chat socket.io room if user is no longer part of group

* fix: lint

* fix: js error when trying to delete room after switching

* add isRoomPublic
2023-07-12 13:03:54 -04:00
Barış Soner Uşaklı
e8b40b5884 fix persona defaults
fix missing theme:id
2023-07-12 10:20:20 -04:00
Barış Soner Uşaklı
0183e5f8d2 fix: #11775, trim -rtl from targetSkin 2023-07-03 18:50:09 -04:00
Barış Soner Uşaklı
ad1da0218a Merge branch 'master' into develop 2023-06-20 18:52:36 -04:00
Barış Soner Uşaklı
090a792168 fix: #11729, only check registered users
ignore guests(uid 0) & spiders(uid -1)
2023-06-18 18:42:49 -04:00
Barış Soner Uşaklı
556fd65d51 feat: custom skins panel in acp 2023-06-16 18:04:22 -04:00
Barış Soner Uşaklı
3080eb7e01 feat: #11714, add registrationQueue flag 2023-06-15 09:13:04 -04:00
Barış Soner Uşaklı
2edfe0ef3e feat: bring back noskin option
if forum sets a default skin there was no way for the user to go back to the no skin version
2023-06-10 11:55:59 -04:00
Barış Soner Uşaklı
e89cfd447e feat: closes #11671, allow custom classes on body
res.render('myplugin', { bodyClasses: ['myplugin', 'special']});
2023-06-02 17:30:11 -04:00
Barış Soner Uşaklı
11cd32722e Merge branch 'master' into develop 2023-05-28 18:13:50 -04:00
Barış Soner Uşaklı
67f44a3212 feat: add back support for req.body._csrf
used in login.tpl etc for noscript login
2023-05-27 16:46:04 -04:00
Barış Soner Uşaklı
adf14ea57c fix: browser title if options.title is undefined 2023-05-16 13:05:03 -04:00
Barış Soner Uşaklı
51096ad234 poc: use csrf_token in ws handshake (#11573) 2023-05-15 11:15:53 -04:00
Barış Soner Uşaklı
63b859f053 poc: use csrf_token in ws handshake (#11573) 2023-05-15 11:12:46 -04:00
Barış Soner Uşaklı
bd80d36e0d Merge branch 'master' into develop 2023-05-12 09:48:25 -04:00
Julian Lam
7b8bffd763 feat: internal utility functions for token management (creation, deletion, etc)
Including tests
2023-05-11 15:22:50 -04:00
Julian Lam
686ecea123 fix: #11589, regression where a user could not confirm their email if requireEmailAddress was enabled 2023-05-11 11:34:24 -04:00
Barış Soner Uşaklı
e1473bcc2d fix: strip html tags from browser title 2023-05-07 19:00:21 -04:00
Julian Lam
84313712a2 fix: add an additional check on page load to enforce requireEmailAddress setting
The old behaviour would require that an email be entered, but did not block access to the forum (nor did it ensure that the email was verified).

The new behaviour (if the setting is enabled) will ensure that only those users with a confirmed email can continue through.

The only exceptions are super admins (so they don't get locked out).
2023-05-05 14:38:01 -04:00
Julian Lam
d814e281a0 feat: write API shorthand to query post routes by their topic index (requires tid in either query string or request body)
middleware.checkRequired is also updated to check for matches in req.query as well.
2023-05-01 12:02:34 -04:00