This repository has been archived on 2024-07-22. You can view files and clone it, but cannot push or open issues or pull requests.

Claire 6da135a493 Fix reviving revoked sessions and invalidating login (#16943) ... Up until now, we have used Devise's Rememberable mechanism to re-log users after the end of their browser sessions. This mechanism relies on a signed cookie containing a token. That token was stored on the user's record, meaning it was shared across all logged in browsers, meaning truly revoking a browser's ability to auto-log-in involves revoking the token itself, and revoking access from *all* logged-in browsers. We had a session mechanism that dynamically checks whether a user's session has been disabled, and would log out the user if so. However, this would only clear a session being actively used, and a new one could be respawned with the `remember_user_token` cookie. In practice, this caused two issues: - sessions could be revived after being closed from /auth/edit (security issue) - auto-log-in would be disabled for *all* browsers after logging out from one of them This PR removes the `remember_token` mechanism and treats the `_session_id` cookie/token as a browser-specific `remember_token`, fixing both issues.		2021-11-06 00:13:58 +01:00
..
account_suggestions	Change auto-following admin-selected accounts, show in recommendations (#16078)	2021-04-24 17:01:43 +02:00
admin	Fix 404 error when filtering admin action logs by non-existent target account (#16643)	2021-10-14 20:53:11 +02:00
concerns	Add remove from followers api (#16864)	2021-10-18 12:02:35 +02:00
form	Add remove from followers api (#16864)	2021-10-18 12:02:35 +02:00
web	Add `policy` param to `POST /api/v1/push/subscriptions` (#16040)	2021-04-15 05:00:25 +02:00
account.rb	Switch from unmaintained paperclip to kt-paperclip (#16724)	2021-09-29 23:52:36 +02:00
account_alias.rb	…
account_conversation.rb	…
account_deletion_request.rb	…
account_domain_block.rb	…
account_filter.rb	Fix admins being able to suspend their instance actor (#14567)	2020-12-15 17:23:58 +01:00
account_identity_proof.rb	…
account_migration.rb	Fix race conditions on account migration creation (#15597)	2021-02-02 14:49:57 +01:00
account_moderation_note.rb	…
account_note.rb	Fix AccountNote not having a maximum length (#16942)	2021-11-06 00:12:25 +01:00
account_pin.rb	…
account_stat.rb	Fix upgrade path from 3.4.0 (#16465)	2021-07-07 21:13:30 +02:00
account_statuses_cleanup_policy.rb	Allow keeping only 1 boosts/favs on auto deleting posts (#16653)	2021-10-14 21:11:14 +02:00
account_suggestions.rb	Change auto-following admin-selected accounts, show in recommendations (#16078)	2021-04-24 17:01:43 +02:00
account_summary.rb	Fix FollowRecommendationsScheduler failing because of unpopulated views (#16189)	2021-05-09 10:39:29 +02:00
account_warning.rb	…
account_warning_preset.rb	…
admin.rb	…
announcement.rb	…
announcement_filter.rb	…
announcement_mute.rb	…
announcement_reaction.rb	…
application_record.rb	…
backup.rb	…
block.rb	…
bookmark.rb	Add feature to automatically delete old toots (#16529)	2021-08-09 23:11:50 +02:00
canonical_email_block.rb	Add canonical e-mail blocks for suspended accounts (#16049)	2021-04-17 03:14:25 +02:00
context.rb	…
conversation.rb	…
conversation_mute.rb	…
custom_emoji.rb	Switch from unmaintained paperclip to kt-paperclip (#16724)	2021-09-29 23:52:36 +02:00
custom_emoji_category.rb	…
custom_emoji_filter.rb	…
custom_filter.rb	Optimize map { ... }.compact calls (#15513)	2021-01-10 00:32:01 +01:00
device.rb	…
domain_allow.rb	Fix performance on instances list in admin UI (#15282)	2020-12-14 09:06:34 +01:00
domain_block.rb	Add option to obfuscate domain name in public list of domain blocks (#15355)	2020-12-18 08:30:41 +01:00
email_domain_block.rb	…
encrypted_message.rb	…
export.rb	…
favourite.rb	Add feature to automatically delete old toots (#16529)	2021-08-09 23:11:50 +02:00
featured_tag.rb	…
feed.rb	…
follow.rb	Fix being able to import more than allowed number of follows (#15384)	2020-12-26 23:52:46 +01:00
follow_recommendation.rb	Fix FollowRecommendationsScheduler failing because of unpopulated views (#16189)	2021-05-09 10:39:29 +02:00
follow_recommendation_filter.rb	Add cold-start follow recommendations (#15945)	2021-04-12 12:37:14 +02:00
follow_recommendation_suppression.rb	Add cold-start follow recommendations (#15945)	2021-04-12 12:37:14 +02:00
follow_request.rb	Fix edge case where accepted follow cannot be processed because of follow limit (#16098)	2021-04-23 22:51:21 +02:00
home_feed.rb	Fix rubocop config and warnings (#15503)	2021-01-07 09:40:55 +01:00
identity.rb	…
import.rb	Fix follow limit preventing re-following of a moved account (#14207)	2020-12-18 09:18:31 +01:00
instance.rb	Add management of delivery availability in Federation settings (#15771)	2021-05-05 23:39:02 +02:00
instance_filter.rb	Add management of delivery availability in Federation settings (#15771)	2021-05-05 23:39:02 +02:00
invite.rb	…
invite_filter.rb	…
ip_block.rb	…
list.rb	Improve account deletion performances further (#15407)	2020-12-22 23:57:46 +01:00
list_account.rb	…
list_feed.rb	Fix rubocop config and warnings (#15503)	2021-01-07 09:40:55 +01:00
login_activity.rb	Add authentication history (#16408)	2021-06-21 17:07:30 +02:00
marker.rb	…
media_attachment.rb	Fix error when rendering public pages with media attachments (#16763)	2021-10-13 15:27:19 +02:00
mention.rb	…
message_franking.rb	…
mute.rb	…
notification.rb	Prepare Mastodon for Rails 6 (#15911)	2021-03-17 10:09:55 +01:00
one_time_key.rb	…
poll.rb	Fix rubocop config and warnings (#15503)	2021-01-07 09:40:55 +01:00
poll_vote.rb	…
preview_card.rb	Switch from unmaintained paperclip to kt-paperclip (#16724)	2021-09-29 23:52:36 +02:00
public_feed.rb	Fix rubocop config and warnings (#15503)	2021-01-07 09:40:55 +01:00
relationship_filter.rb	…
relay.rb	…
remote_follow.rb	…
report.rb	Update Mastodon to Rails 6.1 (#15910)	2021-03-24 10:44:31 +01:00
report_filter.rb	Add ability to filter reports by origin of target account (#16487)	2021-07-11 11:01:38 +02:00
report_note.rb	…
rule.rb	Add server rules (#15769)	2021-02-21 19:50:12 +01:00
scheduled_status.rb	…
search.rb	…
session_activation.rb	Add Ruby 3.0 support (#16046)	2021-05-06 14:22:54 +02:00
setting.rb	Use Rails' index_by where it makes sense (#15542)	2021-01-12 09:27:38 +01:00
site_upload.rb	…
status.rb	Fix handling announcements with links (#16941)	2021-11-05 21:14:35 +01:00
status_pin.rb	Add feature to automatically delete old toots (#16529)	2021-08-09 23:11:50 +02:00
status_stat.rb	…
system_key.rb	…
tag.rb	Change trending hashtags to be affected be reblogs (#16164)	2021-05-07 14:33:43 +02:00
tag_feed.rb	Fix rubocop config and warnings (#15503)	2021-01-07 09:40:55 +01:00
tag_filter.rb	Change trending hashtags to be affected be reblogs (#16164)	2021-05-07 14:33:43 +02:00
tombstone.rb	…
trending_tags.rb	Change trending hashtags to be affected be reblogs (#16164)	2021-05-07 14:33:43 +02:00
unavailable_domain.rb	Fix performance on instances list in admin UI (#15282)	2020-12-14 09:06:34 +01:00
user.rb	Fix reviving revoked sessions and invalidating login (#16943)	2021-11-06 00:13:58 +01:00
user_invite_request.rb	…
web.rb	…
webauthn_credential.rb	…