df5c2456a2
Merge tag 'v4.2.28'
2025-12-09 00:33:50 +08:00
Claire
3c443b007f
Merge commit from fork
2025-12-08 15:44:08 +01:00
e0fefefc26
Merge tag 'v4.2.21'
2025-05-07 11:09:29 +08:00
Claire
d5a905f1c8
Fix incorrect redirect in response to unauthenticated API requests in limited federation mode ( #34549 )
2025-05-05 18:48:34 +02:00
2fbf224392
Merge tag 'v4.2.20'
2025-04-12 22:35:59 +08:00
Claire
91ef24d0e3
Add delay to profile updates to debounce them ( #34137 )
2025-03-31 15:38:11 +02:00
Claire
ec2b17860b
Change user archive signed URL TTL from 10 seconds to 1 hour ( #34254 )
2025-03-31 15:38:11 +02:00
Claire
bea340816d
Merge commit from fork
...
* Fix domain blocks/rationales being visible to unapproved/unconfirmed users
* Fix domain blocks/rationales being visible to suspended users
Co-authored-by: Claire <claire.github-309c@sitedethib.com>
* Allow moved users to view domain blocks
* Add authorization specs for `/api/v1/instance/domain_blocks` spec
* Fix tests
* Fix incorrect test setup
---------
Co-authored-by: Jeremy Kescher <jeremy@kescher.at>
2025-02-27 15:49:57 +01:00
Claire
5a44db38ac
Fix incorrect signature after HTTP redirect ( #33757 )
2025-02-25 17:11:17 +01:00
15cab6832d
Merge tag 'v4.2.13'
2024-10-15 20:15:43 +08:00
Claire
346c37df80
Fix replies collection being cached improperly
2024-09-30 13:28:03 +02:00
0caab94100
Merge tag 'v4.2.10'
2024-07-04 23:06:49 +08:00
Claire
4fb4721072
Merge pull request from GHSA-58x8-3qxw-6hm7
...
* Fix insufficient permission checking for public timeline endpoints
Note that this changes unauthenticated access failure code from 401 to 422
* Add more tests for public timelines
* Require user token in `/api/v1/statuses/:id/translate` and `/api/v1/scheduled_statuses`
2024-07-04 16:26:49 +02:00
Claire
df974a912b
Merge pull request from GHSA-vp5r-5pgw-jwqx
...
* Fix streaming sessions not being closed when revoking access to an app
* Add tests for GHSA-7w3c-p9j8-mq3x
2024-07-04 16:11:28 +02:00
70e34976ec
Merge tag 'v4.2.9'
2024-05-30 22:36:04 +08:00
Emelia Smith
67b2e62331
Fix missing destory audit logs for Domain Allows ( #30125 )
2024-05-17 12:30:00 +02:00
Claire
56b7d1a7b6
Fix not being able to block a subdomain of an already-blocked domain through the API ( #30119 )
2024-05-17 12:30:00 +02:00
Claire
c3be5a3d2e
Remove caching in cache_collection ( #29862 )
2024-05-17 12:30:00 +02:00
Matt Jankowski
0143c9d3e1
Fix results/query in api/v1/featured_tags/suggestions ( #29597 )
2024-05-17 12:30:00 +02:00
Claire
6536d96d1b
Add fallback redirection when getting a webfinger query WEB_DOMAIN@WEB_DOMAIN ( #28592 )
2024-05-17 12:30:00 +02:00
4c465ab0cf
Merge tag 'v4.2.7'
2024-02-16 19:32:23 +08:00
Claire
870ee80fd3
Fix user creation failure handling in OAuth paths ( #29207 )
2024-02-14 22:55:31 +01:00
251eace9e8
Merge tag 'v4.2.6'
2024-02-15 00:11:02 +08:00
Claire
f1700523f1
Merge pull request from GHSA-vm39-j3vx-pch3
...
* Prevent different identities from a same SSO provider from accessing a same account
* Lock auth provider changes behind `ALLOW_UNSAFE_AUTH_PROVIDER_REATTACH=true`
* Rename methods to avoid confusion between OAuth and OmniAuth
2024-02-14 15:16:07 +01:00
4ae66bb821
Merge tag 'v4.2.5'
2024-02-02 07:22:30 +08:00
Claire
a6641f828b
Merge pull request from GHSA-3fjr-858r-92rw
...
* Fix insufficient origin validation
* Bump version to v4.2.5
2024-02-01 15:56:46 +01:00
cc078387ce
Merge tag 'v4.2.4'
2024-01-24 23:37:05 +08:00
Claire
6fe2a47357
Add rate-limit of TOTP authentication attempts at controller level ( #28801 )
2024-01-24 15:31:13 +01:00
Claire
3837ec2227
Fix Mastodon not correctly processing HTTP Signatures with query strings ( #28476 )
2024-01-24 15:31:13 +01:00
Claire
c0a9db3611
Fix potential redirection loop of streaming endpoint ( #28665 )
2024-01-24 15:31:13 +01:00
Claire
01caa18e5b
Fix streaming API redirection ignoring the port of streaming_api_base_url ( #28558 )
2024-01-24 15:31:13 +01:00
Claire
d7875adad2
Fix call to inefficient delete_matched cache method in domain blocks ( #28367 )
2023-12-19 11:27:37 +01:00
caf015faca
Merge tag 'v4.2.3'
2023-12-17 14:03:01 +08:00
Claire
700ae1f918
Fix report processing notice not mentioning the report number when performing a custom action ( #27442 )
2023-12-04 15:28:15 +01:00
4b6be591e3
Merge tag 'v4.2.1'
2023-10-11 18:56:08 +08:00
Claire
ffcf2c691e
Fix Vary headers not being set on some redirects ( #27272 )
2023-10-10 13:52:41 +02:00
f64f787fc2
Merge tag 'v4.2.0-rc1'
2023-09-15 02:23:32 +08:00
Robert R George
20666482ef
Added admin api for managing tags ( #26872 )
2023-09-13 11:22:53 +02:00
CSDUMMI
9a70cac9de
Fix #26849 by adding the domain of the current SSO provider to the form-action CSP ( #26857 )
2023-09-12 13:04:51 +02:00
Claire
33c8708a1a
Change GET /api/v1/directory to use database replica rather than primary ( #26856 )
2023-09-08 17:01:02 +02:00
Claire
09ec9c6aa5
Downgrade signature verification debug logging from warn to debug ( #26812 )
2023-09-06 12:17:22 +02:00
Claire
548c032dbb
Improve interaction modal error handling ( #26795 )
2023-09-05 23:49:48 +02:00
5464814968
Merge tag 'v4.2.0-beta3'
2023-09-05 07:31:32 +08:00
Claire
16681e0f20
Add admin notifications for new Mastodon versions ( #26582 )
2023-09-01 17:47:07 +02:00
Claire
9e26cd5503
Add authorized_fetch server setting in addition to env var ( #25798 )
2023-09-01 15:41:10 +02:00
Daniel M Brasil
ccca542db1
Fix /api/v1/timelines/tag/:hashtag allowing for unauthenticated access when public preview is disabled ( #26237 )
2023-08-31 13:53:24 +02:00
Claire
25bf640629
Add debug logging on signature verification failure ( #26637 )
2023-08-29 10:29:07 +02:00
Lukas Martini
a7d96e6aff
Improve error messages when DeepL quota is exceeded ( #26704 )
2023-08-29 09:14:44 +02:00
jsgoldstein
30c191aaa0
Add new public status index ( #26344 )
...
Co-authored-by: Eugen Rochko <eugen@zeonfederated.com>
Co-authored-by: Claire <claire.github-309c@sitedethib.com>
2023-08-24 16:40:04 +02:00
9e38d55101
Merge tag 'v4.2.0-beta2'
2023-08-22 03:51:20 +08:00
