diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8e579e14899463..e57d5f23b092d8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,37 @@
All notable changes to this project will be documented in this file.
+## [4.2.10] - 2024-07-04
+
+### Security
+
+- Fix incorrect permission checking on multiple API endpoints ([GHSA-58x8-3qxw-6hm7](https://github.com/mastodon/mastodon/security/advisories/GHSA-58x8-3qxw-6hm7))
+- Fix incorrect authorship checking when processing some activities (CVE-2024-37903, [GHSA-xjvf-fm67-4qc3](https://github.com/mastodon/mastodon/security/advisories/GHSA-xjvf-fm67-4qc3))
+- Fix ongoing streaming sessions not being invalidated when application tokens get revoked ([GHSA-vp5r-5pgw-jwqx](https://github.com/mastodon/mastodon/security/advisories/GHSA-vp5r-5pgw-jwqx))
+- Update dependencies
+
+### Added
+
+- Add yarn version specification to avoid confusion with Yarn 3 and Yarn 4
+
+### Changed
+
+- Change preview cards generation to skip unusually long URLs ([oneiros](https://github.com/mastodon/mastodon/pull/30854))
+- Change search modifiers to be case-insensitive ([Gargron](https://github.com/mastodon/mastodon/pull/30865))
+- Change `STATSD_ADDR` handling to emit a warning rather than crashing if the address is unreachable ([timothyjrogers](https://github.com/mastodon/mastodon/pull/30691))
+- Change PWA start URL from `/home` to `/` ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/27377))
+
+### Removed
+
+- Removed dependency on `posix-spawn` ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/18559))
+
+### Fixed
+
+- Fix scheduled statuses scheduled in less than 5 minutes being immediately published ([danielmbrasil](https://github.com/mastodon/mastodon/pull/30584))
+- Fix encoding detection for link cards ([oneiros](https://github.com/mastodon/mastodon/pull/30780))
+- Fix `/admin/accounts/:account_id/statuses/:id` for edited posts with media attachments ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/30819))
+- Fix duplicate `@context` attribute in user archive export ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/30653))
+
## [4.2.9] - 2024-05-30
### Security
diff --git a/Gemfile b/Gemfile
index d8fa119d1da859..2359d1e1527224 100644
--- a/Gemfile
+++ b/Gemfile
@@ -65,7 +65,6 @@ gem 'nsa'
gem 'oj', '~> 3.14'
gem 'ox', '~> 2.14'
gem 'parslet'
-gem 'posix-spawn'
gem 'public_suffix', '~> 5.0'
gem 'pundit', '~> 2.3'
gem 'premailer-rails'
diff --git a/Gemfile.lock b/Gemfile.lock
index 5bc7930efa8235..289a984b8638e5 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -28,47 +28,47 @@ GIT
GEM
remote: https://rubygems.org/
specs:
- actioncable (7.0.8.1)
- actionpack (= 7.0.8.1)
- activesupport (= 7.0.8.1)
+ actioncable (7.0.8.4)
+ actionpack (= 7.0.8.4)
+ activesupport (= 7.0.8.4)
nio4r (~> 2.0)
websocket-driver (>= 0.6.1)
- actionmailbox (7.0.8.1)
- actionpack (= 7.0.8.1)
- activejob (= 7.0.8.1)
- activerecord (= 7.0.8.1)
- activestorage (= 7.0.8.1)
- activesupport (= 7.0.8.1)
+ actionmailbox (7.0.8.4)
+ actionpack (= 7.0.8.4)
+ activejob (= 7.0.8.4)
+ activerecord (= 7.0.8.4)
+ activestorage (= 7.0.8.4)
+ activesupport (= 7.0.8.4)
mail (>= 2.7.1)
net-imap
net-pop
net-smtp
- actionmailer (7.0.8.1)
- actionpack (= 7.0.8.1)
- actionview (= 7.0.8.1)
- activejob (= 7.0.8.1)
- activesupport (= 7.0.8.1)
+ actionmailer (7.0.8.4)
+ actionpack (= 7.0.8.4)
+ actionview (= 7.0.8.4)
+ activejob (= 7.0.8.4)
+ activesupport (= 7.0.8.4)
mail (~> 2.5, >= 2.5.4)
net-imap
net-pop
net-smtp
rails-dom-testing (~> 2.0)
- actionpack (7.0.8.1)
- actionview (= 7.0.8.1)
- activesupport (= 7.0.8.1)
+ actionpack (7.0.8.4)
+ actionview (= 7.0.8.4)
+ activesupport (= 7.0.8.4)
rack (~> 2.0, >= 2.2.4)
rack-test (>= 0.6.3)
rails-dom-testing (~> 2.0)
rails-html-sanitizer (~> 1.0, >= 1.2.0)
- actiontext (7.0.8.1)
- actionpack (= 7.0.8.1)
- activerecord (= 7.0.8.1)
- activestorage (= 7.0.8.1)
- activesupport (= 7.0.8.1)
+ actiontext (7.0.8.4)
+ actionpack (= 7.0.8.4)
+ activerecord (= 7.0.8.4)
+ activestorage (= 7.0.8.4)
+ activesupport (= 7.0.8.4)
globalid (>= 0.6.0)
nokogiri (>= 1.8.5)
- actionview (7.0.8.1)
- activesupport (= 7.0.8.1)
+ actionview (7.0.8.4)
+ activesupport (= 7.0.8.4)
builder (~> 3.1)
erubi (~> 1.4)
rails-dom-testing (~> 2.0)
@@ -78,22 +78,22 @@ GEM
activemodel (>= 4.1, < 7.1)
case_transform (>= 0.2)
jsonapi-renderer (>= 0.1.1.beta1, < 0.3)
- activejob (7.0.8.1)
- activesupport (= 7.0.8.1)
+ activejob (7.0.8.4)
+ activesupport (= 7.0.8.4)
globalid (>= 0.3.6)
- activemodel (7.0.8.1)
- activesupport (= 7.0.8.1)
- activerecord (7.0.8.1)
- activemodel (= 7.0.8.1)
- activesupport (= 7.0.8.1)
- activestorage (7.0.8.1)
- actionpack (= 7.0.8.1)
- activejob (= 7.0.8.1)
- activerecord (= 7.0.8.1)
- activesupport (= 7.0.8.1)
+ activemodel (7.0.8.4)
+ activesupport (= 7.0.8.4)
+ activerecord (7.0.8.4)
+ activemodel (= 7.0.8.4)
+ activesupport (= 7.0.8.4)
+ activestorage (7.0.8.4)
+ actionpack (= 7.0.8.4)
+ activejob (= 7.0.8.4)
+ activerecord (= 7.0.8.4)
+ activesupport (= 7.0.8.4)
marcel (~> 1.0)
mini_mime (>= 1.1.0)
- activesupport (7.0.8.1)
+ activesupport (7.0.8.4)
concurrent-ruby (~> 1.0, >= 1.0.2)
i18n (>= 1.6, < 2)
minitest (>= 5.1)
@@ -191,8 +191,8 @@ GEM
xpath (~> 3.2)
case_transform (0.2)
activesupport
- cbor (0.5.9.6)
- charlock_holmes (0.7.7)
+ cbor (0.5.9.8)
+ charlock_holmes (0.7.8)
chewy (7.3.4)
activesupport (>= 5.2)
elasticsearch (>= 7.12.0, < 7.14.0)
@@ -350,7 +350,7 @@ GEM
httplog (1.6.2)
rack (>= 2.0)
rainbow (>= 2.0.0)
- i18n (1.14.1)
+ i18n (1.14.5)
concurrent-ruby (~> 1.0)
i18n-tasks (1.0.12)
activesupport (>= 4.0.2)
@@ -432,7 +432,7 @@ GEM
net-imap
net-pop
net-smtp
- marcel (1.0.2)
+ marcel (1.0.4)
mario-redis-lock (1.2.1)
redis (>= 3.0.5)
matrix (0.4.2)
@@ -446,7 +446,7 @@ GEM
mime-types-data (~> 3.2015)
mime-types-data (3.2023.0808)
mini_mime (1.1.5)
- mini_portile2 (2.8.5)
+ mini_portile2 (2.8.7)
minitest (5.19.0)
msgpack (1.7.1)
multi_json (1.15.0)
@@ -468,8 +468,8 @@ GEM
net-smtp (0.3.4)
net-protocol
net-ssh (7.1.0)
- nio4r (2.7.0)
- nokogiri (1.16.5)
+ nio4r (2.7.3)
+ nokogiri (1.16.6)
mini_portile2 (~> 2.8.2)
racc (~> 1.4)
nsa (0.3.0)
@@ -517,7 +517,6 @@ GEM
pg (1.5.5)
pghero (3.3.4)
activerecord (>= 6)
- posix-spawn (0.3.15)
premailer (1.21.0)
addressable
css_parser (>= 1.12.0)
@@ -534,7 +533,7 @@ GEM
activesupport (>= 3.0.0)
raabro (1.4.0)
racc (1.7.3)
- rack (2.2.8.1)
+ rack (2.2.9)
rack-attack (6.7.0)
rack (>= 1.0, < 4)
rack-cors (2.0.2)
@@ -551,20 +550,20 @@ GEM
rack
rack-test (2.1.0)
rack (>= 1.3)
- rails (7.0.8.1)
- actioncable (= 7.0.8.1)
- actionmailbox (= 7.0.8.1)
- actionmailer (= 7.0.8.1)
- actionpack (= 7.0.8.1)
- actiontext (= 7.0.8.1)
- actionview (= 7.0.8.1)
- activejob (= 7.0.8.1)
- activemodel (= 7.0.8.1)
- activerecord (= 7.0.8.1)
- activestorage (= 7.0.8.1)
- activesupport (= 7.0.8.1)
+ rails (7.0.8.4)
+ actioncable (= 7.0.8.4)
+ actionmailbox (= 7.0.8.4)
+ actionmailer (= 7.0.8.4)
+ actionpack (= 7.0.8.4)
+ actiontext (= 7.0.8.4)
+ actionview (= 7.0.8.4)
+ activejob (= 7.0.8.4)
+ activemodel (= 7.0.8.4)
+ activerecord (= 7.0.8.4)
+ activestorage (= 7.0.8.4)
+ activesupport (= 7.0.8.4)
bundler (>= 1.15.0)
- railties (= 7.0.8.1)
+ railties (= 7.0.8.4)
rails-controller-testing (1.0.5)
actionpack (>= 5.0.1.rc1)
actionview (>= 5.0.1.rc1)
@@ -579,9 +578,9 @@ GEM
rails-i18n (7.0.7)
i18n (>= 0.7, < 2)
railties (>= 6.0.0, < 8)
- railties (7.0.8.1)
- actionpack (= 7.0.8.1)
- activesupport (= 7.0.8.1)
+ railties (7.0.8.4)
+ actionpack (= 7.0.8.4)
+ activesupport (= 7.0.8.4)
method_source
rake (>= 12.2)
thor (~> 1.0)
@@ -749,7 +748,7 @@ GEM
terrapin (0.6.0)
climate_control (>= 0.0.3, < 1.0)
test-prof (1.2.3)
- thor (1.3.0)
+ thor (1.3.1)
tilt (2.2.0)
timeout (0.4.1)
tpm-key_attestation (0.12.0)
@@ -815,7 +814,7 @@ GEM
xorcist (1.1.3)
xpath (3.2.0)
nokogiri (~> 1.8)
- zeitwerk (2.6.13)
+ zeitwerk (2.6.16)
PLATFORMS
ruby
@@ -897,7 +896,6 @@ DEPENDENCIES
parslet
pg (~> 1.5)
pghero
- posix-spawn
premailer-rails
private_address_check (~> 0.5)
public_suffix (~> 5.0)
diff --git a/app/controllers/api/v1/scheduled_statuses_controller.rb b/app/controllers/api/v1/scheduled_statuses_controller.rb
index 2220b6d22e44d8..b33b534ebb6a57 100644
--- a/app/controllers/api/v1/scheduled_statuses_controller.rb
+++ b/app/controllers/api/v1/scheduled_statuses_controller.rb
@@ -6,6 +6,7 @@ class Api::V1::ScheduledStatusesController < Api::BaseController
before_action -> { doorkeeper_authorize! :read, :'read:statuses' }, except: [:update, :destroy]
before_action -> { doorkeeper_authorize! :write, :'write:statuses' }, only: [:update, :destroy]
+ before_action :require_user!
before_action :set_statuses, only: :index
before_action :set_status, except: :index
diff --git a/app/controllers/api/v1/statuses/translations_controller.rb b/app/controllers/api/v1/statuses/translations_controller.rb
index ec5ea5b85b0d1a..5e5ee7d38e63ff 100644
--- a/app/controllers/api/v1/statuses/translations_controller.rb
+++ b/app/controllers/api/v1/statuses/translations_controller.rb
@@ -4,6 +4,7 @@ class Api::V1::Statuses::TranslationsController < Api::BaseController
include Authorization
before_action -> { doorkeeper_authorize! :read, :'read:statuses' }
+ before_action :require_user!
before_action :set_status
before_action :set_translation
diff --git a/app/controllers/api/v1/timelines/public_controller.rb b/app/controllers/api/v1/timelines/public_controller.rb
index 5bbd92b9eecfb0..0ff2c5aee27124 100644
--- a/app/controllers/api/v1/timelines/public_controller.rb
+++ b/app/controllers/api/v1/timelines/public_controller.rb
@@ -1,6 +1,7 @@
# frozen_string_literal: true
class Api::V1::Timelines::PublicController < Api::BaseController
+ before_action -> { authorize_if_got_token! :read, :'read:statuses' }
before_action :require_user!, only: [:show], if: :require_auth?
after_action :insert_pagination_headers, unless: -> { @statuses.empty? }
diff --git a/app/controllers/api/v1/timelines/tag_controller.rb b/app/controllers/api/v1/timelines/tag_controller.rb
index a79d65c124b73c..ffea89c2580f94 100644
--- a/app/controllers/api/v1/timelines/tag_controller.rb
+++ b/app/controllers/api/v1/timelines/tag_controller.rb
@@ -1,7 +1,8 @@
# frozen_string_literal: true
class Api::V1::Timelines::TagController < Api::BaseController
- before_action -> { doorkeeper_authorize! :read, :'read:statuses' }, only: :show, if: :require_auth?
+ before_action -> { authorize_if_got_token! :read, :'read:statuses' }
+ before_action :require_user!, if: :require_auth?
before_action :load_tag
after_action :insert_pagination_headers, unless: -> { @statuses.empty? }
diff --git a/app/controllers/oauth/authorized_applications_controller.rb b/app/controllers/oauth/authorized_applications_controller.rb
index 350ae2e9062177..17f1be23deeda5 100644
--- a/app/controllers/oauth/authorized_applications_controller.rb
+++ b/app/controllers/oauth/authorized_applications_controller.rb
@@ -17,6 +17,7 @@ class Oauth::AuthorizedApplicationsController < Doorkeeper::AuthorizedApplicatio
def destroy
Web::PushSubscription.unsubscribe_for(params[:id], current_resource_owner)
+ Doorkeeper::Application.find_by(id: params[:id])&.close_streaming_sessions(current_resource_owner)
super
end
diff --git a/app/lib/activitypub/activity/create.rb b/app/lib/activitypub/activity/create.rb
index fedfa39deec9ea..1581555bde8087 100644
--- a/app/lib/activitypub/activity/create.rb
+++ b/app/lib/activitypub/activity/create.rb
@@ -104,7 +104,7 @@ def distribute
def find_existing_status
status = status_from_uri(object_uri)
status ||= Status.find_by(uri: @object['atomUri']) if @object['atomUri'].present?
- status
+ status if status&.account_id == @account.id
end
def process_status_params
diff --git a/app/lib/application_extension.rb b/app/lib/application_extension.rb
index 400c51a023d09b..f226b99cd771d2 100644
--- a/app/lib/application_extension.rb
+++ b/app/lib/application_extension.rb
@@ -16,17 +16,19 @@ module ApplicationExtension
# dependent: delete_all, which means the ActiveRecord callback in
# AccessTokenExtension is not run, so instead we manually announce to
# streaming that these tokens are being deleted.
- before_destroy :push_to_streaming_api, prepend: true
+ before_destroy :close_streaming_sessions, prepend: true
end
def confirmation_redirect_uri
redirect_uri.lines.first.strip
end
- def push_to_streaming_api
+ def close_streaming_sessions(resource_owner = nil)
# TODO: #28793 Combine into a single topic
payload = Oj.dump(event: :kill)
- access_tokens.in_batches do |tokens|
+ scope = access_tokens
+ scope = scope.where(resource_owner_id: resource_owner.id) unless resource_owner.nil?
+ scope.in_batches do |tokens|
redis.pipelined do |pipeline|
tokens.ids.each do |id|
pipeline.publish("timeline:access_token:#{id}", payload)
diff --git a/app/lib/link_details_extractor.rb b/app/lib/link_details_extractor.rb
index bb031986d68186..48a592a404e9fa 100644
--- a/app/lib/link_details_extractor.rb
+++ b/app/lib/link_details_extractor.rb
@@ -265,16 +265,21 @@ def structured_data
end
def document
- @document ||= Nokogiri::HTML(@html, nil, encoding)
+ @document ||= detect_encoding_and_parse_document
end
- def encoding
- @encoding ||= begin
- guess = detector.detect(@html, @html_charset)
- guess&.fetch(:confidence, 0).to_i > 60 ? guess&.fetch(:encoding, nil) : nil
+ def detect_encoding_and_parse_document
+ [detect_encoding, nil, @html_charset, 'UTF-8'].uniq.each do |encoding|
+ document = Nokogiri::HTML(@html, nil, encoding)
+ return document if document.to_s.valid_encoding?
end
end
+ def detect_encoding
+ guess = detector.detect(@html, @html_charset)
+ guess&.fetch(:confidence, 0).to_i > 60 ? guess&.fetch(:encoding, nil) : nil
+ end
+
def detector
@detector ||= CharlockHolmes::EncodingDetector.new.tap do |detector|
detector.strip_tags = true
diff --git a/app/lib/search_query_transformer.rb b/app/lib/search_query_transformer.rb
index a45ae3d09bc1a7..8849acf12c9fd9 100644
--- a/app/lib/search_query_transformer.rb
+++ b/app/lib/search_query_transformer.rb
@@ -223,7 +223,7 @@ def language_code_from_term(term)
end
rule(clause: subtree(:clause)) do
- prefix = clause[:prefix][:term].to_s if clause[:prefix]
+ prefix = clause[:prefix][:term].to_s.downcase if clause[:prefix]
operator = clause[:operator]&.to_s
term = clause[:phrase] ? clause[:phrase].map { |term| term[:term].to_s }.join(' ') : clause[:term].to_s
diff --git a/app/models/status_edit.rb b/app/models/status_edit.rb
index 2b3248bb2cc134..7de509dda172a8 100644
--- a/app/models/status_edit.rb
+++ b/app/models/status_edit.rb
@@ -42,7 +42,7 @@ class PreservedMediaAttachment < ActiveModelSerializers::Model
default_scope { order(id: :asc) }
delegate :local?, :application, :edited?, :edited_at,
- :discarded?, :visibility, to: :status
+ :discarded?, :visibility, :language, to: :status
def emojis
return @emojis if defined?(@emojis)
diff --git a/app/serializers/manifest_serializer.rb b/app/serializers/manifest_serializer.rb
index 48f3aa7a6a3cfb..b6533815a55b69 100644
--- a/app/serializers/manifest_serializer.rb
+++ b/app/serializers/manifest_serializer.rb
@@ -16,11 +16,18 @@ class ManifestSerializer < ActiveModel::Serializer
512
).freeze
- attributes :name, :short_name,
+ attributes :id, :name, :short_name,
:icons, :theme_color, :background_color,
:display, :start_url, :scope,
:share_target, :shortcuts
+ def id
+ # This is set to `/home` because that was the old value of `start_url` and
+ # thus the fallback ID computed by Chrome:
+ # https://developer.chrome.com/blog/pwa-manifest-id/
+ '/home'
+ end
+
def name
object.title
end
@@ -53,7 +60,7 @@ def display
end
def start_url
- '/home'
+ '/'
end
def scope
diff --git a/app/services/backup_service.rb b/app/services/backup_service.rb
index 3ef0366c3c5fc9..b3282c409b41dc 100644
--- a/app/services/backup_service.rb
+++ b/app/services/backup_service.rb
@@ -19,8 +19,8 @@ def call(backup)
def build_outbox_json!(file)
skeleton = serialize(collection_presenter, ActivityPub::CollectionSerializer)
- skeleton[:@context] = full_context
- skeleton[:orderedItems] = ['!PLACEHOLDER!']
+ skeleton['@context'] = full_context
+ skeleton['orderedItems'] = ['!PLACEHOLDER!']
skeleton = Oj.dump(skeleton)
prepend, append = skeleton.split('"!PLACEHOLDER!"')
add_comma = false
diff --git a/app/services/fetch_link_card_service.rb b/app/services/fetch_link_card_service.rb
index 13775e63c19ddd..8302a9ef477fec 100644
--- a/app/services/fetch_link_card_service.rb
+++ b/app/services/fetch_link_card_service.rb
@@ -15,6 +15,9 @@ class FetchLinkCardService < BaseService
)
}iox
+ # URL size limit to safely store in PosgreSQL's unique indexes
+ BYTESIZE_LIMIT = 2692
+
def call(status)
@status = status
@original_url = parse_urls
@@ -85,7 +88,7 @@ def parse_urls
def bad_url?(uri)
# Avoid local instance URLs and invalid URLs
- uri.host.blank? || TagManager.instance.local_url?(uri.to_s) || !%w(http https).include?(uri.scheme)
+ uri.host.blank? || TagManager.instance.local_url?(uri.to_s) || !%w(http https).include?(uri.scheme) || uri.to_s.bytesize > BYTESIZE_LIMIT
end
def mention_link?(anchor)
diff --git a/app/services/post_status_service.rb b/app/services/post_status_service.rb
index e4dd480f104ac2..280666dcf73ea9 100644
--- a/app/services/post_status_service.rb
+++ b/app/services/post_status_service.rb
@@ -171,7 +171,7 @@ def idempotency_duplicate?
end
def scheduled_in_the_past?
- @scheduled_at.present? && @scheduled_at <= Time.now.utc + MIN_SCHEDULE_OFFSET
+ @scheduled_at.present? && @scheduled_at <= Time.now.utc
end
def bump_potential_friendship!
diff --git a/config/initializers/statsd.rb b/config/initializers/statsd.rb
index a655c107165bad..f1628a9d12ca32 100644
--- a/config/initializers/statsd.rb
+++ b/config/initializers/statsd.rb
@@ -3,13 +3,17 @@
if ENV['STATSD_ADDR'].present?
host, port = ENV['STATSD_ADDR'].split(':')
- statsd = Statsd.new(host, port)
- statsd.namespace = ENV.fetch('STATSD_NAMESPACE') { ['Mastodon', Rails.env].join('.') }
+ begin
+ statsd = Statsd.new(host, port)
+ statsd.namespace = ENV.fetch('STATSD_NAMESPACE') { ['Mastodon', Rails.env].join('.') }
- NSA.inform_statsd(statsd) do |informant|
- informant.collect(:action_controller, :web)
- informant.collect(:active_record, :db)
- informant.collect(:active_support_cache, :cache)
- informant.collect(:sidekiq, :sidekiq) if ENV['STATSD_SIDEKIQ'] == 'true'
+ NSA.inform_statsd(statsd) do |informant|
+ informant.collect(:action_controller, :web)
+ informant.collect(:active_record, :db)
+ informant.collect(:active_support_cache, :cache)
+ informant.collect(:sidekiq, :sidekiq) if ENV['STATSD_SIDEKIQ'] == 'true'
+ end
+ rescue
+ Rails.logger.warn("statsd address #{ENV['STATSD_ADDR']} not reachable, proceeding without statsd")
end
end
diff --git a/docker-compose.yml b/docker-compose.yml
index 10a57e31e3e7bd..d61aa05582806c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -56,7 +56,7 @@ services:
web:
build: .
- image: ghcr.io/mastodon/mastodon:v4.2.9
+ image: ghcr.io/mastodon/mastodon:v4.2.10
restart: always
env_file: .env.production
command: bash -c "rm -f /mastodon/tmp/pids/server.pid; bundle exec rails s -p 3000"
@@ -77,7 +77,7 @@ services:
streaming:
build: .
- image: ghcr.io/mastodon/mastodon:v4.2.9
+ image: ghcr.io/mastodon/mastodon:v4.2.10
restart: always
env_file: .env.production
command: node ./streaming
@@ -95,7 +95,7 @@ services:
sidekiq:
build: .
- image: ghcr.io/mastodon/mastodon:v4.2.9
+ image: ghcr.io/mastodon/mastodon:v4.2.10
restart: always
env_file: .env.production
command: bundle exec sidekiq
diff --git a/lib/mastodon/version.rb b/lib/mastodon/version.rb
index f9088382f82f5d..77e85a16528046 100644
--- a/lib/mastodon/version.rb
+++ b/lib/mastodon/version.rb
@@ -13,7 +13,7 @@ def minor
end
def patch
- 9
+ 10
end
def default_prerelease
diff --git a/package.json b/package.json
index 227399e804253a..35a236c8cc57ef 100644
--- a/package.json
+++ b/package.json
@@ -226,5 +226,6 @@
"Capfile|Gemfile|*.{rb,ruby,ru,rake}": "bundle exec rubocop --force-exclusion -a",
"*.{js,jsx,ts,tsx}": "eslint --fix",
"*.{css,scss}": "stylelint --fix"
- }
+ },
+ "packageManager": "yarn@1.22.22"
}
diff --git a/spec/controllers/admin/statuses_controller_spec.rb b/spec/controllers/admin/statuses_controller_spec.rb
index 9befdf978f9822..5c8fc0a6399080 100644
--- a/spec/controllers/admin/statuses_controller_spec.rb
+++ b/spec/controllers/admin/statuses_controller_spec.rb
@@ -43,6 +43,11 @@
describe 'GET #show' do
before do
+ status.media_attachments << Fabricate(:media_attachment, type: :image, account: status.account)
+ status.save!
+ status.snapshot!(at_time: status.created_at, rate_limit: false)
+ status.update!(text: 'Hello, this is an edited post')
+ status.snapshot!(rate_limit: false)
get :show, params: { account_id: account.id, id: status.id }
end
diff --git a/spec/controllers/api/v1/scheduled_statuses_controller_spec.rb b/spec/controllers/api/v1/scheduled_statuses_controller_spec.rb
index 256c4b272aee43..cc3b65f37d5c9d 100644
--- a/spec/controllers/api/v1/scheduled_statuses_controller_spec.rb
+++ b/spec/controllers/api/v1/scheduled_statuses_controller_spec.rb
@@ -13,6 +13,17 @@
allow(controller).to receive(:doorkeeper_token) { token }
end
+ context 'with an application token' do
+ let(:token) { Fabricate(:accessible_access_token, resource_owner_id: nil, scopes: 'read:statuses') }
+
+ it 'returns http unprocessable entity' do
+ get :index
+
+ expect(response)
+ .to have_http_status(422)
+ end
+ end
+
describe 'GET #index' do
it 'returns http success' do
get :index
diff --git a/spec/controllers/api/v1/statuses/translations_controller_spec.rb b/spec/controllers/api/v1/statuses/translations_controller_spec.rb
index 6257494ae18627..da152843b2c74e 100644
--- a/spec/controllers/api/v1/statuses/translations_controller_spec.rb
+++ b/spec/controllers/api/v1/statuses/translations_controller_spec.rb
@@ -9,6 +9,26 @@
let(:app) { Fabricate(:application, name: 'Test app', website: 'http://testapp.com') }
let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read:statuses', application: app) }
+ context 'with an application token' do
+ let(:token) { Fabricate(:accessible_access_token, resource_owner_id: nil, scopes: 'read:statuses', application: app) }
+
+ before do
+ allow(controller).to receive(:doorkeeper_token) { token }
+ end
+
+ describe 'POST /api/v1/statuses/:status_id/translate' do
+ let(:status) { Fabricate(:status, account: user.account, text: 'Hola', language: 'es') }
+
+ before do
+ post :create, params: { status_id: status.id }
+ end
+
+ it 'returns http unprocessable entity' do
+ expect(response).to have_http_status(422)
+ end
+ end
+ end
+
context 'with an oauth token' do
before do
allow(controller).to receive(:doorkeeper_token) { token }
diff --git a/spec/controllers/api/v1/statuses_controller_spec.rb b/spec/controllers/api/v1/statuses_controller_spec.rb
index c2bdba9ace3bf6..591307fe228c5f 100644
--- a/spec/controllers/api/v1/statuses_controller_spec.rb
+++ b/spec/controllers/api/v1/statuses_controller_spec.rb
@@ -182,6 +182,46 @@
expect(response.headers['X-RateLimit-Remaining']).to eq '0'
end
end
+
+ context 'with missing thread' do
+ subject { post :create, params: params }
+
+ let(:params) { { status: 'Hello world', in_reply_to_id: 0 } }
+
+ it 'returns http not found' do
+ subject
+
+ expect(response).to have_http_status(404)
+ end
+ end
+
+ context 'when scheduling a status' do
+ subject { post :create, params: params }
+
+ let(:params) { { status: 'Hello world', scheduled_at: 10.minutes.from_now } }
+ let(:account) { user.account }
+
+ it 'returns HTTP 200' do
+ subject
+
+ expect(response).to have_http_status(200)
+ end
+
+ it 'creates a scheduled status' do
+ expect { subject }.to change { account.scheduled_statuses.count }.from(0).to(1)
+ end
+
+ context 'when the scheduling time is less than 5 minutes' do
+ let(:params) { { status: 'Hello world', scheduled_at: 4.minutes.from_now } }
+
+ it 'does not create a scheduled status', :aggregate_failures do
+ subject
+
+ expect(response).to have_http_status(422)
+ expect(account.scheduled_statuses).to be_empty
+ end
+ end
+ end
end
describe 'DELETE #destroy' do
diff --git a/spec/controllers/api/v1/timelines/tag_controller_spec.rb b/spec/controllers/api/v1/timelines/tag_controller_spec.rb
index 1c60798fcf6fed..89622a41a2325a 100644
--- a/spec/controllers/api/v1/timelines/tag_controller_spec.rb
+++ b/spec/controllers/api/v1/timelines/tag_controller_spec.rb
@@ -6,7 +6,8 @@
render_views
let(:user) { Fabricate(:user) }
- let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read:statuses') }
+ let(:scopes) { 'read:statuses' }
+ let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
before do
allow(controller).to receive(:doorkeeper_token) { token }
@@ -48,13 +49,23 @@
Form::AdminSettings.new(timeline_preview: false).save
end
- context 'when the user is not authenticated' do
+ context 'without an access token' do
let(:token) { nil }
- it 'returns http unauthorized' do
+ it 'returns http unprocessable entity' do
+ subject
+
+ expect(response).to have_http_status(422)
+ end
+ end
+
+ context 'with an application access token, not bound to a user' do
+ let(:token) { Fabricate(:accessible_access_token, resource_owner_id: nil, scopes: scopes) }
+
+ it 'returns http unprocessable entity' do
subject
- expect(response).to have_http_status(401)
+ expect(response).to have_http_status(422)
end
end
diff --git a/spec/controllers/oauth/authorized_applications_controller_spec.rb b/spec/controllers/oauth/authorized_applications_controller_spec.rb
index b54610604c8173..3fd9f9499f4387 100644
--- a/spec/controllers/oauth/authorized_applications_controller_spec.rb
+++ b/spec/controllers/oauth/authorized_applications_controller_spec.rb
@@ -50,9 +50,11 @@
let!(:application) { Fabricate(:application) }
let!(:access_token) { Fabricate(:accessible_access_token, application: application, resource_owner_id: user.id) }
let!(:web_push_subscription) { Fabricate(:web_push_subscription, user: user, access_token: access_token) }
+ let(:redis_pipeline_stub) { instance_double(Redis::Namespace, publish: nil) }
before do
sign_in user, scope: :user
+ allow(redis).to receive(:pipelined).and_yield(redis_pipeline_stub)
post :destroy, params: { id: application.id }
end
@@ -63,5 +65,13 @@
it 'removes subscriptions for the application\'s access tokens' do
expect(Web::PushSubscription.where(user: user).count).to eq 0
end
+
+ it 'removes the web_push_subscription' do
+ expect { web_push_subscription.reload }.to raise_error(ActiveRecord::RecordNotFound)
+ end
+
+ it 'sends a session kill payload to the streaming server' do
+ expect(redis_pipeline_stub).to have_received(:publish).with("timeline:access_token:#{access_token.id}", '{"event":"kill"}')
+ end
end
end
diff --git a/spec/controllers/settings/applications_controller_spec.rb b/spec/controllers/settings/applications_controller_spec.rb
index 169304b3ed4582..88974e551d8e45 100644
--- a/spec/controllers/settings/applications_controller_spec.rb
+++ b/spec/controllers/settings/applications_controller_spec.rb
@@ -166,7 +166,11 @@ def call_update
end
describe 'destroy' do
+ let(:redis_pipeline_stub) { instance_double(Redis::Namespace, publish: nil) }
+ let!(:access_token) { Fabricate(:accessible_access_token, application: app) }
+
before do
+ allow(redis).to receive(:pipelined).and_yield(redis_pipeline_stub)
post :destroy, params: { id: app.id }
end
@@ -177,6 +181,10 @@ def call_update
it 'removes the app' do
expect(Doorkeeper::Application.find_by(id: app.id)).to be_nil
end
+
+ it 'sends a session kill payload to the streaming server' do
+ expect(redis_pipeline_stub).to have_received(:publish).with("timeline:access_token:#{access_token.id}", '{"event":"kill"}')
+ end
end
describe 'regenerate' do
diff --git a/spec/fixtures/requests/low_confidence_latin1.txt b/spec/fixtures/requests/low_confidence_latin1.txt
new file mode 100644
index 00000000000000..39c3e23d649ba8
--- /dev/null
+++ b/spec/fixtures/requests/low_confidence_latin1.txt
@@ -0,0 +1,17 @@
+HTTP/1.1 200 OK
+server: nginx
+date: Thu, 13 Jun 2024 14:33:13 GMT
+content-type: text/html; charset=ISO-8859-1
+content-length: 158
+accept-ranges: bytes
+
+
+
+
+
+ Tofu á l'orange
+
+
+
Tofu á l'orange
+
+
diff --git a/spec/requests/api/v1/timelines/public_spec.rb b/spec/requests/api/v1/timelines/public_spec.rb
index c436262407d04f..03bde3da87f525 100644
--- a/spec/requests/api/v1/timelines/public_spec.rb
+++ b/spec/requests/api/v1/timelines/public_spec.rb
@@ -32,6 +32,8 @@
context 'when the instance allows public preview' do
let(:expected_statuses) { [local_status, remote_status, media_status] }
+ it_behaves_like 'forbidden for wrong scope', 'profile'
+
context 'with an authorized user' do
it_behaves_like 'a successful request to the public timeline'
end
@@ -96,14 +98,20 @@
Form::AdminSettings.new(timeline_preview: false).save
end
- context 'with an authenticated user' do
- let(:expected_statuses) { [local_status, remote_status, media_status] }
+ it_behaves_like 'forbidden for wrong scope', 'profile'
- it_behaves_like 'a successful request to the public timeline'
+ context 'without an authentication token' do
+ let(:headers) { {} }
+
+ it 'returns http unprocessable entity' do
+ subject
+
+ expect(response).to have_http_status(422)
+ end
end
- context 'with an unauthenticated user' do
- let(:headers) { {} }
+ context 'with an application access token, not bound to a user' do
+ let(:token) { Fabricate(:accessible_access_token, resource_owner_id: nil, scopes: scopes) }
it 'returns http unprocessable entity' do
subject
@@ -111,6 +119,12 @@
expect(response).to have_http_status(422)
end
end
+
+ context 'with an authenticated user' do
+ let(:expected_statuses) { [local_status, remote_status, media_status] }
+
+ it_behaves_like 'a successful request to the public timeline'
+ end
end
end
end
diff --git a/spec/services/backup_service_spec.rb b/spec/services/backup_service_spec.rb
index 806ba18323ea56..1eb789d1f5837f 100644
--- a/spec/services/backup_service_spec.rb
+++ b/spec/services/backup_service_spec.rb
@@ -55,9 +55,11 @@ def process_backup
end
def expect_outbox_export
- json = export_json(:outbox)
+ body = export_json_raw(:outbox)
+ json = Oj.load(body)
aggregate_failures do
+ expect(body.scan('@context').count).to eq 1
expect(json['@context']).to_not be_nil
expect(json['type']).to eq 'OrderedCollection'
expect(json['totalItems']).to eq 2
@@ -85,8 +87,12 @@ def expect_bookmarks_export
end
end
+ def export_json_raw(type)
+ read_zip_file(backup, "#{type}.json")
+ end
+
def export_json(type)
- Oj.load(read_zip_file(backup, "#{type}.json"))
+ Oj.load(export_json_raw(type))
end
def include_create_item(status)
diff --git a/spec/services/fetch_link_card_service_spec.rb b/spec/services/fetch_link_card_service_spec.rb
index f44cbb750c7ec0..592dce24d42990 100644
--- a/spec/services/fetch_link_card_service_spec.rb
+++ b/spec/services/fetch_link_card_service_spec.rb
@@ -26,6 +26,7 @@
stub_request(:get, 'http://example.com/sjis_with_wrong_charset').to_return(request_fixture('sjis_with_wrong_charset.txt'))
stub_request(:get, 'http://example.com/koi8-r').to_return(request_fixture('koi8-r.txt'))
stub_request(:get, 'http://example.com/windows-1251').to_return(request_fixture('windows-1251.txt'))
+ stub_request(:get, 'http://example.com/low_confidence_latin1').to_return(request_fixture('low_confidence_latin1.txt'))
Rails.cache.write('oembed_endpoint:example.com', oembed_cache) if oembed_cache
@@ -148,6 +149,14 @@
end
end
+ context 'with a URL of a page in ISO-8859-1 encoding, that charlock_holmes cannot detect' do
+ let(:status) { Fabricate(:status, text: 'Check out http://example.com/low_confidence_latin1') }
+
+ it 'decodes the HTML' do
+ expect(status.preview_card.title).to eq("Tofu á l'orange")
+ end
+ end
+
context 'with a Japanese path URL' do
let(:status) { Fabricate(:status, text: 'テストhttp://example.com/日本語') }
@@ -184,6 +193,19 @@
end
end
+ context 'with an URL too long for PostgreSQL unique indexes' do
+ let(:url) { "http://example.com/#{'a' * 2674}" }
+ let(:status) { Fabricate(:status, text: url) }
+
+ it 'does not fetch the URL' do
+ expect(a_request(:get, url)).to_not have_been_made
+ end
+
+ it 'does not create a preview card' do
+ expect(status.preview_card).to be_nil
+ end
+ end
+
context 'with a URL of a page with oEmbed support' do
let(:html) { 'Hello world' }
let(:status) { Fabricate(:status, text: 'http://example.com/html') }
diff --git a/spec/services/post_status_service_spec.rb b/spec/services/post_status_service_spec.rb
index a74e826261e7f1..826af5479443af 100644
--- a/spec/services/post_status_service_spec.rb
+++ b/spec/services/post_status_service_spec.rb
@@ -61,6 +61,16 @@
status2 = subject.call(account, text: 'test', idempotency: 'meepmeep', scheduled_at: future)
expect(status2.id).to eq status1.id
end
+
+ context 'when scheduled_at is less than min offset' do
+ let(:invalid_scheduled_time) { 4.minutes.from_now }
+
+ it 'raises invalid record error' do
+ expect do
+ subject.call(account, text: 'Hi future!', scheduled_at: invalid_scheduled_time)
+ end.to raise_error(ActiveRecord::RecordInvalid)
+ end
+ end
end
it 'creates response to the original status of boost' do