- docker
before_script:
+ - echo $MIX_ENV
- rm -rf _build/*/lib/pleroma
- apt-get update && apt-get install -y cmake
- mix local.hex --force
script:
- mix credo --strict --only=warnings,todo,fixme,consistency,readability
+cycles:
+ stage: test
+ image: elixir:1.11
+ only:
+ changes:
+ - "**/*.ex"
+ - "**/*.exs"
+ - "mix.lock"
+ cache: {}
+ script:
+ - mix deps.get
+ - mix compile
+ - mix xref graph --format cycles --label compile | awk '{print $0} END{exit ($0 != "No cycles found")}'
+
docs-deploy:
stage: deploy
cache: *testing_cache_policy
### Changed
- **Breaking:** Configuration: `:chat, enabled` moved to `:shout, enabled` and `:instance, chat_limit` moved to `:shout, limit`
+- Support for Erlang/OTP 24
- The `application` metadata returned with statuses is no longer hardcoded. Apps that want to display these details will now have valid data for new posts after this change.
- HTTPSecurityPlug now sends a response header to opt out of Google's FLoC (Federated Learning of Cohorts) targeted advertising.
- Email address is now returned if requesting user is the owner of the user account so it can be exposed in client and FE user settings UIs.
+- Improved Twittercard and OpenGraph meta tag generation including thumbnails and image dimension metadata when available.
+- ActivityPub Client-to-Server(C2S): Limitation on the type of Activity/Object are lifted as they are now passed through ObjectValidators
### Added
- MRF (`FollowBotPolicy`): New MRF Policy which makes a designated local Bot account attempt to follow all users in public Notes received by your instance. Users who require approving follower requests or have #nobot in their profile are excluded.
- Return OAuth token `id` (primary key) in POST `/oauth/token`.
-- `AnalyzeMetadata` upload filter for extracting attachment dimensions and generating blurhashes.
+- `AnalyzeMetadata` upload filter for extracting image/video attachment dimensions and generating blurhashes for images. Blurhashes for videos are not generated at this time.
- Attachment dimensions and blurhashes are federated when available.
- Pinned posts federation
### Fixed
- Don't crash so hard when email settings are invalid.
- Checking activated Upload Filters for required commands.
+- Remote users can no longer reappear after being deleted.
+- Deactivated users may now be deleted.
+- Mix task `pleroma.database prune_objects`
+- Linkify: Parsing crash with URLs ending in unbalanced closed paren, no path separator, and no query parameters
+
+### Removed
+- **Breaking**: Remove deprecated `/api/qvitter/statuses/notifications/read` (replaced by `/api/v1/pleroma/notifications/read`)
## Unreleased (Patch)
### Docker
While we don’t provide docker files, other people have written very good ones. Take a look at <https://github.com/angristan/docker-pleroma> or <https://glitch.sh/sn0w/pleroma-docker>.
+### Raspberry Pi
+Community maintained Raspberry Pi image that you can flash and run Pleroma on your Raspberry Pi. Available here <https://github.com/guysoft/PleromaPi>.
+
### Compilation Troubleshooting
If you ever encounter compilation issues during the updating of Pleroma, you can try these commands and see if they fix things:
```elixir
defmodule Pleroma.Web.ActivityPub.MRF.RewritePolicy do
@moduledoc "MRF policy which rewrites all Notes to have 'new message content'."
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
# Catch messages which contain Note objects with actual data to filter.
# Capture the object as `object`, the message content as `content` and the
* Note: Behaves exactly the same as `POST /api/v1/upload`.
Can only accept images - any attempt to upload non-image files will be met with `HTTP 415 Unsupported Media Type`.
-## `/api/v1/pleroma/notification_settings`
+## `/api/pleroma/notification_settings`
### Updates user notification settings
* Method `PUT`
* Authentication: required
It assumes that you have administrative rights, either as root or a user with [sudo permissions](https://www.linode.com/docs/tools-reference/custom-kernels-distros/install-alpine-linux-on-your-linode/#configuration). If you want to run this guide with root, ignore the `sudo` at the beginning of the lines, unless it calls a user like `sudo -Hu pleroma`; in this case, use `su -l <username> -s $SHELL -c 'command'` instead.
-### Required packages
-
-* `postgresql`
-* `elixir`
-* `erlang`
-* `erlang-parsetools`
-* `erlang-xmerl`
-* `git`
-* `file-dev`
-* Development Tools
-* `cmake`
-
-#### Optional packages used in this guide
-
-* `nginx` (preferred, example configs for other reverse proxies can be found in the repo)
-* `certbot` (or any other ACME client for Let’s Encrypt certificates)
-* `ImageMagick`
-* `ffmpeg`
-* `exiftool`
+{! backend/installation/generic_dependencies.include !}
### Prepare the system
# Installing on Debian Based Distributions
## Installation
-This guide will assume you are on Debian Stretch. This guide should also work with Ubuntu 16.04 and 18.04. It also assumes that you have administrative rights, either as root or a user with [sudo permissions](https://www.digitalocean.com/community/tutorials/how-to-add-delete-and-grant-sudo-privileges-to-users-on-a-debian-vps). If you want to run this guide with root, ignore the `sudo` at the beginning of the lines, unless it calls a user like `sudo -Hu pleroma`; in this case, use `su <username> -s $SHELL -c 'command'` instead.
+This guide will assume you are on Debian 11 (“bullseye”) or later. This guide should also work with Ubuntu 18.04 (“Bionic Beaver”) and later. It also assumes that you have administrative rights, either as root or a user with [sudo permissions](https://www.digitalocean.com/community/tutorials/how-to-add-delete-and-grant-sudo-privileges-to-users-on-a-debian-vps). If you want to run this guide with root, ignore the `sudo` at the beginning of the lines, unless it calls a user like `sudo -Hu pleroma`; in this case, use `su <username> -s $SHELL -c 'command'` instead.
-### Required packages
-
-* `postgresql` (9.6+, Ubuntu 16.04 comes with 9.5, you can get a newer version from [here](https://www.postgresql.org/download/linux/ubuntu/))
-* `postgresql-contrib` (9.6+, same situtation as above)
-* `elixir` (1.8+, Follow the guide to install from the Erlang Solutions repo or use [asdf](https://github.com/asdf-vm/asdf) as the pleroma user)
-* `erlang-dev`
-* `erlang-nox`
-* `libmagic-dev`
-* `git`
-* `build-essential`
-* `cmake`
-
-#### Optional packages used in this guide
-
-* `nginx` (preferred, example configs for other reverse proxies can be found in the repo)
-* `certbot` (or any other ACME client for Let’s Encrypt certificates)
-* `ImageMagick`
-* `ffmpeg`
-* `exiftool`
+{! backend/installation/generic_dependencies.include !}
### Prepare the system
### Install Elixir and Erlang
-* Download and add the Erlang repository:
-
-```shell
-wget -P /tmp/ https://packages.erlang-solutions.com/erlang-solutions_2.0_all.deb
-sudo dpkg -i /tmp/erlang-solutions_2.0_all.deb
-```
-
-* Install Elixir and Erlang:
+* Install Elixir and Erlang (you might need to use backports or [asdf](https://github.com/asdf-vm/asdf) on old systems):
```shell
sudo apt update
sudo apt install elixir erlang-dev erlang-nox
```
+
### Optional packages: [`docs/installation/optional/media_graphics_packages.md`](../installation/optional/media_graphics_packages.md)
```shell
This document was written for FreeBSD 12.1, but should be work on future releases.
-## Required software
+{! backend/installation/generic_dependencies.include !}
+
+## Installing software used in this guide
This assumes the target system has `pkg(8)`.
--- /dev/null
+## Required dependencies
+
+* PostgreSQL 9.6+
+* Elixir 1.9+
+* Erlang OTP 22.2+
+* git
+* file / libmagic
+* gcc (clang might also work)
+* GNU make
+* CMake
+
+## Optionnal dependencies
+
+* ImageMagick
+* FFmpeg
+* exiftool
This guide will assume that you have administrative rights, either as root or a user with [sudo permissions](https://wiki.gentoo.org/wiki/Sudo). Lines that begin with `#` indicate that they should be run as the superuser. Lines using `$` should be run as the indicated user, e.g. `pleroma$` should be run as the `pleroma` user.
-### Configuring your hostname (optional)
-
-If you would like your prompt to permanently include your host/domain, change `/etc/conf.d/hostname` to your hostname. You can reboot or use the `hostname` command to make immediate changes.
+{! backend/installation/generic_dependencies.include !}
### Your make.conf, package.use, and USE flags
# Installing on NetBSD
-## Required software
+{! backend/installation/generic_dependencies.include !}
+
+## Installing software used in this guide
pkgin should have been installed by the NetBSD installer if you selected
the right options. If it isn't installed, install it using pkg_add.
For any additional information regarding commands and configuration files mentioned here, check the man pages [online](https://man.openbsd.org/) or directly on your server with the man command.
-#### Required software
-
-The following packages need to be installed:
+{! backend/installation/generic_dependencies.include !}
- * elixir
- * gmake
- * git
- * postgresql-server
- * postgresql-contrib
- * cmake
- * ffmpeg
- * ImageMagick
+### Preparing the system
+#### Required software
To install them, run the following command (with doas or as root):
=== "Alpine"
```
- echo "http://nl.alpinelinux.org/alpine/latest-stable/community" >> /etc/apk/repositories
+ awk 'NR==2' /etc/apk/repositories | sed 's/main/community/' | tee -a /etc/apk/repositories
apk update
apk add curl unzip ncurses postgresql postgresql-contrib nginx certbot file-dev
```
=== "Alpine"
```
- echo "http://nl.alpinelinux.org/alpine/latest-stable/community" >> /etc/apk/repositories
apk update
apk add imagemagick ffmpeg exiftool
```
)
|> Repo.delete_all(timeout: :infinity)
+ prune_hashtags_query = """
+ DELETE FROM hashtags AS ht
+ WHERE NOT EXISTS (
+ SELECT 1 FROM hashtags_objects hto
+ WHERE ht.id = hto.hashtag_id)
+ """
+
+ Repo.query(prune_hashtags_query)
+
if Keyword.get(options, :vacuum) do
Maintenance.vacuum("full")
end
get_in_reply_to_activity_from_object(Object.normalize(activity, fetch: false))
end
- def normalize(obj) when is_map(obj), do: get_by_ap_id_with_object(obj["id"])
+ def normalize(%Activity{data: %{"id" => ap_id}}), do: get_by_ap_id_with_object(ap_id)
+ def normalize(%{"id" => ap_id}), do: get_by_ap_id_with_object(ap_id)
def normalize(ap_id) when is_binary(ap_id), do: get_by_ap_id_with_object(ap_id)
def normalize(_), do: nil
def delete_all_by_object_ap_id(_), do: nil
- defp purge_web_resp_cache(%Activity{} = activity) do
- %{path: path} = URI.parse(activity.data["id"])
- @cachex.del(:web_resp_cache, path)
+ defp purge_web_resp_cache(%Activity{data: %{"id" => id}} = activity) when is_binary(id) do
+ with %{path: path} <- URI.parse(id) do
+ @cachex.del(:web_resp_cache, path)
+ end
+
activity
end
- defp purge_web_resp_cache(nil), do: nil
+ defp purge_web_resp_cache(activity), do: activity
def follow_accepted?(
%Activity{data: %{"type" => "Follow", "object" => followed_ap_id}} = activity
check_filter(Pleroma.Upload.Filter.Mogrify, "mogrify"),
check_filter(Pleroma.Upload.Filter.Mogrifun, "mogrify"),
check_filter(Pleroma.Upload.Filter.AnalyzeMetadata, "mogrify"),
- check_filter(Pleroma.Upload.Filter.AnalyzeMetadata, "convert")
+ check_filter(Pleroma.Upload.Filter.AnalyzeMetadata, "convert"),
+ check_filter(Pleroma.Upload.Filter.AnalyzeMetadata, "ffprobe")
]
preview_proxy_commands_status =
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Pleroma.Config.Loader do
- defp reject_keys,
- do: [
- Pleroma.Repo,
- Pleroma.Web.Endpoint,
- :env,
- :configurable_from_database,
- :database,
- :swarm
- ]
-
- defp reject_groups,
- do: [
- :postgrex,
- :tesla
- ]
+ # These modules are only being used as keys here (for equality check),
+ # so it's okay to use `Module.concat/1` to have the compiler ignore them.
+ @reject_keys [
+ Module.concat(["Pleroma.Repo"]),
+ Module.concat(["Pleroma.Web.Endpoint"]),
+ :env,
+ :configurable_from_database,
+ :database,
+ :swarm
+ ]
+
+ @reject_groups [
+ :postgrex,
+ :tesla
+ ]
if Code.ensure_loaded?(Config.Reader) do
@reader Config.Reader
@spec filter_group(atom(), keyword()) :: keyword()
def filter_group(group, configs) do
Enum.reject(configs[group], fn {key, _v} ->
- key in reject_keys() or group in reject_groups() or
+ key in @reject_keys or group in @reject_groups or
(group == :phoenix and key == :serve_endpoints)
end)
end
defmodule Pleroma.Instances do
@moduledoc "Instances context."
- @adapter Pleroma.Instances.Instance
+ alias Pleroma.Instances.Instance
- defdelegate filter_reachable(urls_or_hosts), to: @adapter
- defdelegate reachable?(url_or_host), to: @adapter
- defdelegate set_reachable(url_or_host), to: @adapter
- defdelegate set_unreachable(url_or_host, unreachable_since \\ nil), to: @adapter
- defdelegate get_consistently_unreachable(), to: @adapter
+ def filter_reachable(urls_or_hosts), do: Instance.filter_reachable(urls_or_hosts)
+
+ def reachable?(url_or_host), do: Instance.reachable?(url_or_host)
+
+ def set_reachable(url_or_host), do: Instance.set_reachable(url_or_host)
+
+ def set_unreachable(url_or_host, unreachable_since \\ nil),
+ do: Instance.set_unreachable(url_or_host, unreachable_since)
+
+ def get_consistently_unreachable, do: Instance.get_consistently_unreachable()
def set_consistently_unreachable(url_or_host),
do: set_unreachable(url_or_host, reachability_datetime_threshold())
adapter: Ecto.Adapters.Postgres,
migration_timestamps: [type: :naive_datetime_usec]
- use Ecto.Explain
-
import Ecto.Query
require Logger
{:ok, :no_duration_limit, :no_duration_limit}
end
- defp client, do: Pleroma.ReverseProxy.Client
+ defp client, do: Pleroma.ReverseProxy.Client.Wrapper
defp track_failed_url(url, error, opts) do
ttl =
@callback stream_body(map()) :: {:ok, binary(), map()} | :done | {:error, atom() | String.t()}
@callback close(reference() | pid() | map()) :: :ok
-
- def request(method, url, headers, body \\ "", opts \\ []) do
- client().request(method, url, headers, body, opts)
- end
-
- def stream_body(ref), do: client().stream_body(ref)
-
- def close(ref), do: client().close(ref)
-
- defp client do
- :tesla
- |> Application.get_env(:adapter)
- |> client()
- end
-
- defp client(Tesla.Adapter.Hackney), do: Pleroma.ReverseProxy.Client.Hackney
- defp client(Tesla.Adapter.Gun), do: Pleroma.ReverseProxy.Client.Tesla
- defp client(_), do: Pleroma.Config.get!(Pleroma.ReverseProxy.Client)
end
--- /dev/null
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.ReverseProxy.Client.Wrapper do
+ @moduledoc "Meta-client that calls the appropriate client from the config."
+ @behaviour Pleroma.ReverseProxy.Client
+
+ @impl true
+ def request(method, url, headers, body \\ "", opts \\ []) do
+ client().request(method, url, headers, body, opts)
+ end
+
+ @impl true
+ def stream_body(ref), do: client().stream_body(ref)
+
+ @impl true
+ def close(ref), do: client().close(ref)
+
+ defp client do
+ :tesla
+ |> Application.get_env(:adapter)
+ |> client()
+ end
+
+ defp client(Tesla.Adapter.Hackney), do: Pleroma.ReverseProxy.Client.Hackney
+ defp client(Tesla.Adapter.Gun), do: Pleroma.ReverseProxy.Client.Tesla
+ defp client(_), do: Pleroma.Config.get!(Pleroma.ReverseProxy.Client)
+end
use Pleroma.Web, :controller
alias Pleroma.User
- alias Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug
alias Pleroma.Web.Plugs.OAuthScopesPlug
# Serves only with proper OAuth token (:api and :authenticated_api)
# Via :authenticated_api, serves if token is present and has requested scopes
#
# Suggested use: as :fallback_oauth_check but open with nil :user for :api on private instances
- plug(
- :skip_plug,
- EnsurePublicOrAuthenticatedPlug when action == :fallback_oauth_skip_publicity_check
- )
+ plug(:skip_public_check when action == :fallback_oauth_skip_publicity_check)
plug(
OAuthScopesPlug,
# Via :authenticated_api, serves if :user is set (regardless of token presence and its scopes)
#
# Suggested use: making an :api endpoint always accessible (e.g. email confirmation endpoint)
- plug(
- :skip_plug,
- [OAuthScopesPlug, EnsurePublicOrAuthenticatedPlug]
- when action == :skip_oauth_skip_publicity_check
- )
+ plug(:skip_auth when action == :skip_oauth_skip_publicity_check)
# Via :authenticated_api, always fails with 403 (endpoint is insecure)
# Via :api, drops :user if present and serves if public (private instance rejects on no user)
require Logger
- @callback filter(Pleroma.Upload.t()) ::
+ @callback filter(upload :: struct()) ::
{:ok, :filtered}
| {:ok, :noop}
- | {:ok, :filtered, Pleroma.Upload.t()}
+ | {:ok, :filtered, upload :: struct()}
| {:error, any()}
- @spec filter([module()], Pleroma.Upload.t()) :: {:ok, Pleroma.Upload.t()} | {:error, any()}
+ @spec filter([module()], upload :: struct()) :: {:ok, upload :: struct()} | {:error, any()}
def filter([], upload) do
{:ok, upload}
end
end
+ def filter(%Pleroma.Upload{tempfile: file, content_type: "video" <> _} = upload) do
+ try do
+ result = media_dimensions(file)
+
+ upload =
+ upload
+ |> Map.put(:width, result.width)
+ |> Map.put(:height, result.height)
+
+ {:ok, :filtered, upload}
+ rescue
+ e in ErlangError ->
+ Logger.warn("#{__MODULE__}: #{inspect(e)}")
+ {:ok, :noop}
+ end
+ end
+
def filter(_), do: {:ok, :noop}
defp get_blurhash(file) do
_ -> nil
end
end
+
+ defp media_dimensions(file) do
+ with executable when is_binary(executable) <- System.find_executable("ffprobe"),
+ args = [
+ "-v",
+ "error",
+ "-show_entries",
+ "stream=width,height",
+ "-of",
+ "csv=p=0:s=x",
+ file
+ ],
+ {result, 0} <- System.cmd(executable, args),
+ [width, height] <-
+ String.split(String.trim(result), "x") |> Enum.map(&String.to_integer(&1)) do
+ %{width: width, height: height}
+ else
+ nil -> {:error, {:ffprobe, :command_not_found}}
+ {:error, _} = error -> error
+ end
+ end
end
email: nil,
name: nil,
password_hash: nil,
- keys: nil,
- public_key: nil,
avatar: %{},
tags: [],
last_refreshed_at: nil,
follower_count: 0,
following_count: 0,
is_locked: false,
- is_confirmed: true,
password_reset_pending: false,
- is_approved: true,
registration_reason: nil,
confirmation_token: nil,
domain_blocks: [],
raw_fields: [],
is_discoverable: false,
also_known_as: []
+ # id: preserved
+ # ap_id: preserved
+ # nickname: preserved
})
end
+ # Purge doesn't delete the user from the database.
+ # It just nulls all its fields and deactivates it.
+ # See `User.purge_user_changeset/1` above.
+ defp purge(%User{} = user) do
+ user
+ |> purge_user_changeset()
+ |> update_and_set_cache()
+ end
+
def delete(users) when is_list(users) do
for user <- users, do: delete(user)
end
def delete(%User{} = user) do
+ # Purge the user immediately
+ purge(user)
BackgroundWorker.enqueue("delete_user", %{"user_id" => user.id})
end
- defp delete_and_invalidate_cache(%User{} = user) do
+ # *Actually* delete the user from the DB
+ defp delete_from_db(%User{} = user) do
invalidate_cache(user)
Repo.delete(user)
end
- defp delete_or_deactivate(%User{local: false} = user), do: delete_and_invalidate_cache(user)
+ # If the user never finalized their account, it's safe to delete them.
+ defp maybe_delete_from_db(%User{local: true, is_confirmed: false} = user),
+ do: delete_from_db(user)
- defp delete_or_deactivate(%User{local: true} = user) do
- status = account_status(user)
-
- case status do
- :confirmation_pending ->
- delete_and_invalidate_cache(user)
+ defp maybe_delete_from_db(%User{local: true, is_approved: false} = user),
+ do: delete_from_db(user)
- :approval_pending ->
- delete_and_invalidate_cache(user)
-
- _ ->
- user
- |> purge_user_changeset()
- |> update_and_set_cache()
- end
- end
+ defp maybe_delete_from_db(user), do: {:ok, user}
def perform(:force_password_reset, user), do: force_password_reset(user)
@spec perform(atom(), User.t()) :: {:ok, User.t()}
def perform(:delete, %User{} = user) do
+ # Purge the user again, in case perform/2 is called directly
+ purge(user)
+
# Remove all relationships
user
|> get_followers()
delete_user_activities(user)
delete_notifications_from_user_activities(user)
-
delete_outgoing_pending_follow_requests(user)
- delete_or_deactivate(user)
+ maybe_delete_from_db(user)
end
def perform(:set_activation_async, user, status), do: set_activation(user, status)
- e.g. Pleroma.User.Query.build(%{ap_id: ["http://ap_id1", "http://ap_id2"]})
"""
import Ecto.Query
- import Pleroma.Web.AdminAPI.Search, only: [not_empty_string: 1]
+ import Pleroma.Web.Utils.Guards, only: [not_empty_string: 1]
alias Pleroma.FollowingRelationship
alias Pleroma.User
)
end
+ defp skip_auth(conn, _) do
+ skip_plug(conn, [OAuthScopesPlug, EnsurePublicOrAuthenticatedPlug])
+ end
+
+ defp skip_public_check(conn, _) do
+ skip_plug(conn, EnsurePublicOrAuthenticatedPlug)
+ end
+
# Executed just before actual controller action, invokes before-action hooks (callbacks)
defp action(conn, params) do
with %{halted: false} = conn <-
{recipients, to, cc}
end
- defp check_actor_is_active(nil), do: true
+ defp check_actor_can_insert(%{"type" => "Delete"}), do: true
+ defp check_actor_can_insert(%{"type" => "Undo"}), do: true
- defp check_actor_is_active(actor) when is_binary(actor) do
+ defp check_actor_can_insert(%{"actor" => actor}) when is_binary(actor) do
case User.get_cached_by_ap_id(actor) do
%User{is_active: true} -> true
_ -> false
end
end
+ defp check_actor_can_insert(_), do: true
+
defp check_remote_limit(%{"object" => %{"content" => content}}) when not is_nil(content) do
limit = Config.get([:instance, :remote_limit])
String.length(content) <= limit
def insert(map, local \\ true, fake \\ false, bypass_actor_check \\ false) when is_map(map) do
with nil <- Activity.normalize(map),
map <- lazy_put_activity_defaults(map, fake),
- {_, true} <- {:actor_check, bypass_actor_check || check_actor_is_active(map["actor"])},
+ {_, true} <- {:actor_check, bypass_actor_check || check_actor_can_insert(map)},
{_, true} <- {:remote_limit_pass, check_remote_limit(map)},
{:ok, map} <- MRF.filter(map),
{recipients, _, _} = get_recipients(map),
alias Pleroma.Object.Fetcher
alias Pleroma.User
alias Pleroma.Web.ActivityPub.ActivityPub
- alias Pleroma.Web.ActivityPub.Builder
alias Pleroma.Web.ActivityPub.InternalFetchActor
alias Pleroma.Web.ActivityPub.ObjectView
alias Pleroma.Web.ActivityPub.Pipeline
|> json(err)
end
- defp handle_user_activity(
- %User{} = user,
- %{"type" => "Create", "object" => %{"type" => "Note"} = object} = params
- ) do
- content = if is_binary(object["content"]), do: object["content"], else: ""
- name = if is_binary(object["name"]), do: object["name"], else: ""
- summary = if is_binary(object["summary"]), do: object["summary"], else: ""
- length = String.length(content <> name <> summary)
+ defp fix_user_message(%User{ap_id: actor}, %{"type" => "Create", "object" => object} = activity)
+ when is_map(object) do
+ length =
+ [object["content"], object["summary"], object["name"]]
+ |> Enum.filter(&is_binary(&1))
+ |> Enum.join("")
+ |> String.length()
- if length > Pleroma.Config.get([:instance, :limit]) do
- {:error, dgettext("errors", "Note is over the character limit")}
- else
+ limit = Pleroma.Config.get([:instance, :limit])
+
+ if length < limit do
object =
object
- |> Map.merge(Map.take(params, ["to", "cc"]))
- |> Map.put("attributedTo", user.ap_id)
- |> Transmogrifier.fix_object()
-
- ActivityPub.create(%{
- to: params["to"],
- actor: user,
- context: object["context"],
- object: object,
- additional: Map.take(params, ["cc"])
- })
- end
- end
+ |> Transmogrifier.strip_internal_fields()
+ |> Map.put("attributedTo", actor)
+ |> Map.put("actor", actor)
+ |> Map.put("id", Utils.generate_object_id())
- defp handle_user_activity(%User{} = user, %{"type" => "Delete"} = params) do
- with %Object{} = object <- Object.normalize(params["object"], fetch: false),
- true <- user.is_moderator || user.ap_id == object.data["actor"],
- {:ok, delete_data, _} <- Builder.delete(user, object.data["id"]),
- {:ok, delete, _} <- Pipeline.common_pipeline(delete_data, local: true) do
- {:ok, delete}
+ {:ok, Map.put(activity, "object", object)}
else
- _ -> {:error, dgettext("errors", "Can't delete object")}
+ {:error,
+ dgettext(
+ "errors",
+ "Character limit (%{limit} characters) exceeded, contains %{length} characters",
+ limit: limit,
+ length: length
+ )}
end
end
- defp handle_user_activity(%User{} = user, %{"type" => "Like"} = params) do
- with %Object{} = object <- Object.normalize(params["object"], fetch: false),
- {_, {:ok, like_object, meta}} <- {:build_object, Builder.like(user, object)},
- {_, {:ok, %Activity{} = activity, _meta}} <-
- {:common_pipeline,
- Pipeline.common_pipeline(like_object, Keyword.put(meta, :local, true))} do
+ defp fix_user_message(
+ %User{ap_id: actor} = user,
+ %{"type" => "Delete", "object" => object} = activity
+ ) do
+ with {_, %Object{data: object_data}} <- {:normalize, Object.normalize(object, fetch: false)},
+ {_, true} <- {:permission, user.is_moderator || actor == object_data["actor"]} do
{:ok, activity}
else
- _ -> {:error, dgettext("errors", "Can't like object")}
+ {:normalize, _} ->
+ {:error, "No such object found"}
+
+ {:permission, _} ->
+ {:forbidden, "You can't delete this object"}
end
end
- defp handle_user_activity(_, _) do
- {:error, dgettext("errors", "Unhandled activity type")}
+ defp fix_user_message(%User{}, activity) do
+ {:ok, activity}
end
def update_outbox(
- %{assigns: %{user: %User{nickname: nickname} = user}} = conn,
+ %{assigns: %{user: %User{nickname: nickname, ap_id: actor} = user}} = conn,
%{"nickname" => nickname} = params
) do
- actor = user.ap_id
-
params =
params
- |> Map.drop(["id"])
+ |> Map.drop(["nickname"])
+ |> Map.put("id", Utils.generate_activity_id())
|> Map.put("actor", actor)
- |> Transmogrifier.fix_addressing()
- with {:ok, %Activity{} = activity} <- handle_user_activity(user, params) do
+ with {:ok, params} <- fix_user_message(user, params),
+ {:ok, activity, _} <- Pipeline.common_pipeline(params, local: true),
+ %Activity{data: activity_data} <- Activity.normalize(activity) do
conn
|> put_status(:created)
- |> put_resp_header("location", activity.data["id"])
- |> json(activity.data)
+ |> put_resp_header("location", activity_data["id"])
+ |> json(activity_data)
else
+ {:forbidden, message} ->
+ conn
+ |> put_status(:forbidden)
+ |> json(message)
+
{:error, message} ->
conn
|> put_status(:bad_request)
|> json(message)
+
+ e ->
+ Logger.warn(fn -> "AP C2S: #{inspect(e)}" end)
+
+ conn
+ |> put_status(:bad_request)
+ |> json("Bad Request")
end
end
@required_description_keys [:key, :related_policy]
- @callback filter(Map.t()) :: {:ok | :reject, Map.t()}
- @callback describe() :: {:ok | :error, Map.t()}
- @callback config_description() :: %{
- optional(:children) => [map()],
- key: atom(),
- related_policy: String.t(),
- label: String.t(),
- description: String.t()
- }
- @optional_callbacks config_description: 0
-
def filter(policies, %{} = message) do
policies
|> Enum.reduce({:ok, message}, fn
def describe, do: get_policies() |> describe()
def config_descriptions do
- Pleroma.Web.ActivityPub.MRF
+ Pleroma.Web.ActivityPub.MRF.Policy
|> Pleroma.Docs.Generator.list_behaviour_implementations()
|> config_descriptions()
end
defmodule Pleroma.Web.ActivityPub.MRF.ActivityExpirationPolicy do
@moduledoc "Adds expiration to all local Create activities"
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
@impl true
def filter(activity) do
@moduledoc "Prevent followbots from following with a bit of heuristic"
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
# XXX: this should become User.normalize_by_ap_id() or similar, really.
defp normalize_by_ap_id(%{"id" => id}), do: User.get_cached_by_ap_id(id)
defmodule Pleroma.Web.ActivityPub.MRF.AntiLinkSpamPolicy do
alias Pleroma.User
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
require Logger
defmodule Pleroma.Web.ActivityPub.MRF.DropPolicy do
require Logger
@moduledoc "Drop and log everything received"
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
@impl true
def filter(object) do
alias Pleroma.Object
@moduledoc "Ensure a re: is prepended on replies to a post with a Subject"
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
@reply_prefix Regex.compile!("^re:[[:space:]]*", [:caseless])
defmodule Pleroma.Web.ActivityPub.MRF.FollowBotPolicy do
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
alias Pleroma.Config
alias Pleroma.User
alias Pleroma.Web.CommonAPI
defmodule Pleroma.Web.ActivityPub.MRF.ForceBotUnlistedPolicy do
alias Pleroma.User
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
@moduledoc "Remove bot posts from federated timeline"
require Pleroma.Constants
Note: This MRF Policy is always enabled, if you want to disable it you have to set empty lists.
"""
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
defp check_reject(message, hashtags) do
if Enum.any?(Config.get([:mrf_hashtag, :reject]), fn match -> match in hashtags end) do
@moduledoc "Block messages with too much mentions (configurable)"
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
defp delist_message(message, threshold) when threshold > 0 do
follower_collection = User.get_cached_by_ap_id(message["actor"]).follower_address
@moduledoc "Reject or Word-Replace messages with a keyword or regex"
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
defp string_matches?(string, _) when not is_binary(string) do
false
end
defmodule Pleroma.Web.ActivityPub.MRF.MediaProxyWarmingPolicy do
@moduledoc "Preloads any attachments in the MediaProxy cache by prefetching them"
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
alias Pleroma.HTTP
alias Pleroma.Web.MediaProxy
defmodule Pleroma.Web.ActivityPub.MRF.MentionPolicy do
@moduledoc "Block messages which mention a user"
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
@impl true
def filter(%{"type" => "Create"} = message) do
defmodule Pleroma.Web.ActivityPub.MRF.NoEmptyPolicy do
@moduledoc "Filter local activities which have no content"
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
alias Pleroma.Web.Endpoint
defmodule Pleroma.Web.ActivityPub.MRF.NoOpPolicy do
@moduledoc "Does nothing (lets the messages go through unmodified)"
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
@impl true
def filter(object) do
defmodule Pleroma.Web.ActivityPub.MRF.NoPlaceholderTextPolicy do
@moduledoc "Ensure no content placeholder is present (such as the dot from mastodon)"
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
@impl true
def filter(
@moduledoc "Scrub configured hypertext markup"
alias Pleroma.HTML
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
@impl true
def filter(%{"type" => "Create", "object" => child_object} = object) do
require Pleroma.Constants
@moduledoc "Filter activities depending on their age"
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
defp check_date(%{"object" => %{"published" => published}} = message) do
with %DateTime{} = now <- DateTime.utc_now(),
--- /dev/null
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ActivityPub.MRF.Policy do
+ @callback filter(Map.t()) :: {:ok | :reject, Map.t()}
+ @callback describe() :: {:ok | :error, Map.t()}
+ @callback config_description() :: %{
+ optional(:children) => [map()],
+ key: atom(),
+ related_policy: String.t(),
+ label: String.t(),
+ description: String.t()
+ }
+ @optional_callbacks config_description: 0
+end
alias Pleroma.Config
alias Pleroma.User
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
require Pleroma.Constants
defmodule Pleroma.Web.ActivityPub.MRF.SimplePolicy do
@moduledoc "Filter activities depending on their origin instance"
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
alias Pleroma.Config
alias Pleroma.FollowingRelationship
alias Pleroma.Config
@moduledoc "Detect new emojis by their shortcode and steals them"
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
defp accept_host?(host), do: host in Config.get([:mrf_steal_emoji, :hosts], [])
require Logger
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
defp lookup_subchain(actor) do
with matches <- Config.get([:mrf_subchain, :match_actor]),
defmodule Pleroma.Web.ActivityPub.MRF.TagPolicy do
alias Pleroma.User
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
@moduledoc """
Apply policies based on user tags
alias Pleroma.Config
@moduledoc "Accept-list of users from specified instances"
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
defp filter_by_list(object, []), do: {:ok, object}
defmodule Pleroma.Web.ActivityPub.MRF.VocabularyPolicy do
@moduledoc "Filter messages which belong to certain activity vocabularies"
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
@impl true
def filter(%{"type" => "Undo", "object" => child_message} = message) do
end
end
+ def validate(o, m), do: {:error, {:validator_not_set, {o, m}}}
+
def cast_and_apply(%{"type" => "ChatMessage"} = object) do
ChatMessageValidator.cast_and_apply(object)
end
alias Pleroma.EctoType.ActivityPub.ObjectValidators
alias Pleroma.Object
alias Pleroma.User
+ alias Pleroma.Web.ActivityPub.ObjectValidators.CommonFixes
alias Pleroma.Web.ActivityPub.Utils
alias Pleroma.Web.ActivityPub.Visibility
field(:type, :string)
field(:object, ObjectValidators.ObjectID)
field(:actor, ObjectValidators.ObjectID)
- field(:context, :string, autogenerate: {Utils, :generate_context_id, []})
+ field(:context, :string)
field(:to, ObjectValidators.Recipients, default: [])
field(:cc, ObjectValidators.Recipients, default: [])
field(:published, ObjectValidators.DateTime)
end
def cast_data(data) do
+ data =
+ data
+ |> fix()
+
%__MODULE__{}
|> changeset(data)
end
def changeset(struct, data) do
struct
|> cast(data, __schema__(:fields))
- |> fix_after_cast()
end
- def fix_after_cast(cng) do
- cng
+ defp fix(data) do
+ data =
+ data
+ |> CommonFixes.fix_actor()
+ |> CommonFixes.fix_activity_addressing()
+
+ with %Object{} = object <- Object.normalize(data["object"]) do
+ data
+ |> CommonFixes.fix_activity_context(object)
+ |> CommonFixes.fix_object_action_recipients(object)
+ else
+ _ -> data
+ end
end
defp validate_data(data_cng) do
|> validate_announcable()
end
- def validate_announcable(cng) do
+ defp validate_announcable(cng) do
with actor when is_binary(actor) <- get_field(cng, :actor),
object when is_binary(object) <- get_field(cng, :object),
%User{} = actor <- User.get_cached_by_ap_id(actor),
end
end
- def validate_existing_announce(cng) do
+ defp validate_existing_announce(cng) do
actor = get_field(cng, :actor)
object = get_field(cng, :object)
defmodule Pleroma.Web.ActivityPub.ObjectValidators.CommonFixes do
alias Pleroma.EctoType.ActivityPub.ObjectValidators
+ alias Pleroma.Object
alias Pleroma.Object.Containment
alias Pleroma.User
alias Pleroma.Web.ActivityPub.Transmogrifier
|> Transmogrifier.fix_implicit_addressing(follower_collection)
end
- def fix_activity_addressing(activity, _meta) do
+ def fix_activity_addressing(activity) do
%User{follower_address: follower_collection} = User.get_cached_by_ap_id(activity["actor"])
activity
|> Map.put("actor", actor)
|> Map.put("attributedTo", actor)
end
+
+ def fix_activity_context(data, %Object{data: %{"context" => object_context}}) do
+ data
+ |> Map.put("context", object_context)
+ end
+
+ def fix_object_action_recipients(%{"actor" => actor} = data, %Object{data: %{"actor" => actor}}) do
+ to = ((data["to"] || []) -- [actor]) |> Enum.uniq()
+
+ Map.put(data, "to", to)
+ end
+
+ def fix_object_action_recipients(data, %Object{data: %{"actor" => actor}}) do
+ to = ((data["to"] || []) ++ [actor]) |> Enum.uniq()
+
+ Map.put(data, "to", to)
+ end
end
alias Pleroma.Activity
alias Pleroma.EctoType.ActivityPub.ObjectValidators
+ alias Pleroma.User
import Ecto.Changeset
import Pleroma.Web.ActivityPub.ObjectValidators.CommonValidations
cng
|> validate_required([:id, :type, :actor, :to, :cc, :object])
|> validate_inclusion(:type, ["Delete"])
- |> validate_actor_presence()
+ |> validate_delete_actor(:actor)
|> validate_modification_rights()
|> validate_object_or_user_presence(allowed_types: @deletable_types)
|> add_deleted_activity_id()
|> cast_data
|> validate_data
end
+
+ defp validate_delete_actor(cng, field_name) do
+ validate_change(cng, field_name, fn field_name, actor ->
+ case User.get_cached_by_ap_id(actor) do
+ %User{} -> []
+ _ -> [{field_name, "can't find user"}]
+ end
+ end)
+ end
end
alias Pleroma.EctoType.ActivityPub.ObjectValidators
alias Pleroma.Object
+ alias Pleroma.Web.ActivityPub.ObjectValidators.CommonFixes
import Ecto.Changeset
import Pleroma.Web.ActivityPub.ObjectValidators.CommonValidations
end
def cast_data(data) do
+ data =
+ data
+ |> fix()
+
%__MODULE__{}
|> changeset(data)
end
def changeset(struct, data) do
struct
|> cast(data, __schema__(:fields))
- |> fix_after_cast()
- end
-
- def fix_after_cast(cng) do
- cng
- |> fix_context()
end
- def fix_context(cng) do
- object = get_field(cng, :object)
+ defp fix(data) do
+ data =
+ data
+ |> CommonFixes.fix_actor()
+ |> CommonFixes.fix_activity_addressing()
- with nil <- get_field(cng, :context),
- %Object{data: %{"context" => context}} <- Object.get_cached_by_ap_id(object) do
- cng
- |> put_change(:context, context)
+ with %Object{} = object <- Object.normalize(data["object"]) do
+ data
+ |> CommonFixes.fix_activity_context(object)
+ |> CommonFixes.fix_object_action_recipients(object)
else
- _ ->
- cng
+ _ -> data
end
end
- def validate_emoji(cng) do
+ defp validate_emoji(cng) do
content = get_field(cng, :content)
if Pleroma.Emoji.is_unicode_emoji?(content) do
alias Pleroma.EctoType.ActivityPub.ObjectValidators
alias Pleroma.Object
+ alias Pleroma.Web.ActivityPub.ObjectValidators.CommonFixes
alias Pleroma.Web.ActivityPub.Utils
import Ecto.Changeset
end
def cast_data(data) do
+ data =
+ data
+ |> fix()
+
%__MODULE__{}
|> changeset(data)
end
def changeset(struct, data) do
struct
|> cast(data, __schema__(:fields))
- |> fix_after_cast()
- end
-
- def fix_after_cast(cng) do
- cng
- |> fix_recipients()
- |> fix_context()
- end
-
- def fix_context(cng) do
- object = get_field(cng, :object)
-
- with nil <- get_field(cng, :context),
- %Object{data: %{"context" => context}} <- Object.get_cached_by_ap_id(object) do
- cng
- |> put_change(:context, context)
- else
- _ ->
- cng
- end
end
- def fix_recipients(cng) do
- to = get_field(cng, :to)
- cc = get_field(cng, :cc)
- object = get_field(cng, :object)
+ defp fix(data) do
+ data =
+ data
+ |> CommonFixes.fix_actor()
+ |> CommonFixes.fix_activity_addressing()
- with {[], []} <- {to, cc},
- %Object{data: %{"actor" => actor}} <- Object.get_cached_by_ap_id(object),
- {:ok, actor} <- ObjectValidators.ObjectID.cast(actor) do
- cng
- |> put_change(:to, [actor])
+ with %Object{} = object <- Object.normalize(data["object"]) do
+ data
+ |> CommonFixes.fix_activity_context(object)
+ |> CommonFixes.fix_object_action_recipients(object)
else
- _ ->
- cng
+ _ -> data
end
end
|> validate_existing_like()
end
- def validate_existing_like(%{changes: %{actor: actor, object: object}} = cng) do
+ defp validate_existing_like(%{changes: %{actor: actor, object: object}} = cng) do
if Utils.get_existing_like(actor, %{data: %{"id" => object}}) do
cng
|> add_error(:actor, "already liked this object")
end
end
- def validate_existing_like(cng), do: cng
+ defp validate_existing_like(cng), do: cng
end
alias Pleroma.Activity
alias Pleroma.EctoType.ActivityPub.ObjectValidators
+ alias Pleroma.User
import Ecto.Changeset
import Pleroma.Web.ActivityPub.ObjectValidators.CommonValidations
data_cng
|> validate_inclusion(:type, ["Undo"])
|> validate_required([:id, :type, :object, :actor, :to, :cc])
- |> validate_actor_presence()
+ |> validate_undo_actor(:actor)
|> validate_object_presence()
|> validate_undo_rights()
end
_ -> cng
end
end
+
+ defp validate_undo_actor(cng, field_name) do
+ validate_change(cng, field_name, fn field_name, actor ->
+ case User.get_cached_by_ap_id(actor) do
+ %User{} -> []
+ _ -> [{field_name, "can't find user"}]
+ end
+ end)
+ end
end
require Logger
@cachex Pleroma.Config.get([:cachex, :provider], Cachex)
- @ap_streamer Pleroma.Config.get([:side_effects, :ap_streamer], ActivityPub)
@logger Pleroma.Config.get([:side_effects, :logger], Logger)
@behaviour Pleroma.Web.ActivityPub.SideEffects.Handling
+ defp ap_streamer, do: Pleroma.Config.get([:side_effects, :ap_streamer], ActivityPub)
+
@impl true
def handle(object, meta \\ [])
MessageReference.delete_for_object(deleted_object)
- @ap_streamer.stream_out(object)
- @ap_streamer.stream_out_participations(deleted_object, user)
+ ap_streamer().stream_out(object)
+ ap_streamer().stream_out_participations(deleted_object, user)
:ok
else
{:actor, _} ->
when action in [:follow, :unfollow]
)
- plug(:put_view, Pleroma.Web.AdminAPI.AccountView)
-
action_fallback(AdminAPI.FallbackController)
defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.Admin.UserOperation
@page_size 50
- defmacro not_empty_string(string) do
- quote do
- is_binary(unquote(string)) and unquote(string) != ""
- end
- end
-
@spec user(map()) :: {:ok, [User.t()], pos_integer()}
def user(params \\ %{}) do
query =
--- /dev/null
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.AdminAPI.UserView do
+ use Pleroma.Web, :view
+ alias Pleroma.Web.AdminAPI
+
+ def render(view, opts), do: AdminAPI.AccountView.render(view, opts)
+end
requestBody: Helpers.request_body("Parameters", create_request()),
responses: %{
200 => Operation.response("Media", "application/json", Attachment),
+ 400 => Operation.response("Media", "application/json", ApiError),
401 => Operation.response("Media", "application/json", ApiError),
422 => Operation.response("Media", "application/json", ApiError)
}
responses: %{
200 => Operation.response("Media", "application/json", Attachment),
401 => Operation.response("Media", "application/json", ApiError),
+ 403 => Operation.response("Media", "application/json", ApiError),
422 => Operation.response("Media", "application/json", ApiError)
}
}
requestBody: Helpers.request_body("Parameters", create_request()),
responses: %{
202 => Operation.response("Media", "application/json", Attachment),
+ 400 => Operation.response("Media", "application/json", ApiError),
422 => Operation.response("Media", "application/json", ApiError),
500 => Operation.response("Media", "application/json", ApiError)
}
],
operationId: "TimelineController.hashtag",
responses: %{
- 200 => Operation.response("Array of Status", "application/json", array_of_statuses())
+ 200 => Operation.response("Array of Status", "application/json", array_of_statuses()),
+ 401 => Operation.response("Error", "application/json", ApiError)
}
}
end
--- /dev/null
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ApiSpec.TwitterUtilOperation do
+ alias OpenApiSpex.Operation
+ alias OpenApiSpex.Schema
+ alias Pleroma.Web.ApiSpec.Schemas.ApiError
+ alias Pleroma.Web.ApiSpec.Schemas.BooleanLike
+
+ def open_api_operation(action) do
+ operation = String.to_existing_atom("#{action}_operation")
+ apply(__MODULE__, operation, [])
+ end
+
+ def emoji_operation do
+ %Operation{
+ tags: ["Emojis"],
+ summary: "List all custom emojis",
+ operationId: "UtilController.emoji",
+ parameters: [],
+ responses: %{
+ 200 =>
+ Operation.response("List", "application/json", %Schema{
+ type: :object,
+ additionalProperties: %Schema{
+ type: :object,
+ properties: %{
+ image_url: %Schema{type: :string},
+ tags: %Schema{type: :array, items: %Schema{type: :string}}
+ }
+ },
+ example: %{
+ "firefox" => %{
+ "image_url" => "/emoji/firefox.png",
+ "tag" => ["Fun"]
+ }
+ }
+ })
+ }
+ }
+ end
+
+ def frontend_configurations_operation do
+ %Operation{
+ tags: ["Configuration"],
+ summary: "Dump frontend configurations",
+ operationId: "UtilController.frontend_configurations",
+ parameters: [],
+ responses: %{
+ 200 =>
+ Operation.response("List", "application/json", %Schema{
+ type: :object,
+ additionalProperties: %Schema{type: :object}
+ })
+ }
+ }
+ end
+
+ def change_password_operation do
+ %Operation{
+ tags: ["Account credentials"],
+ summary: "Change account password",
+ security: [%{"oAuth" => ["write:accounts"]}],
+ operationId: "UtilController.change_password",
+ parameters: [
+ Operation.parameter(:password, :query, :string, "Current password", required: true),
+ Operation.parameter(:new_password, :query, :string, "New password", required: true),
+ Operation.parameter(
+ :new_password_confirmation,
+ :query,
+ :string,
+ "New password, confirmation",
+ required: true
+ )
+ ],
+ responses: %{
+ 200 =>
+ Operation.response("Success", "application/json", %Schema{
+ type: :object,
+ properties: %{status: %Schema{type: :string, example: "success"}}
+ }),
+ 400 => Operation.response("Error", "application/json", ApiError),
+ 403 => Operation.response("Error", "application/json", ApiError)
+ }
+ }
+ end
+
+ def change_email_operation do
+ %Operation{
+ tags: ["Account credentials"],
+ summary: "Change account email",
+ security: [%{"oAuth" => ["write:accounts"]}],
+ operationId: "UtilController.change_email",
+ parameters: [
+ Operation.parameter(:password, :query, :string, "Current password", required: true),
+ Operation.parameter(:email, :query, :string, "New email", required: true)
+ ],
+ requestBody: nil,
+ responses: %{
+ 200 =>
+ Operation.response("Success", "application/json", %Schema{
+ type: :object,
+ properties: %{status: %Schema{type: :string, example: "success"}}
+ }),
+ 400 => Operation.response("Error", "application/json", ApiError),
+ 403 => Operation.response("Error", "application/json", ApiError)
+ }
+ }
+ end
+
+ def update_notificaton_settings_operation do
+ %Operation{
+ tags: ["Accounts"],
+ summary: "Update Notification Settings",
+ security: [%{"oAuth" => ["write:accounts"]}],
+ operationId: "UtilController.update_notificaton_settings",
+ parameters: [
+ Operation.parameter(
+ :block_from_strangers,
+ :query,
+ BooleanLike,
+ "blocks notifications from accounts you do not follow"
+ ),
+ Operation.parameter(
+ :hide_notification_contents,
+ :query,
+ BooleanLike,
+ "removes the contents of a message from the push notification"
+ )
+ ],
+ requestBody: nil,
+ responses: %{
+ 200 =>
+ Operation.response("Success", "application/json", %Schema{
+ type: :object,
+ properties: %{status: %Schema{type: :string, example: "success"}}
+ }),
+ 400 => Operation.response("Error", "application/json", ApiError)
+ }
+ }
+ end
+
+ def disable_account_operation do
+ %Operation{
+ tags: ["Account credentials"],
+ summary: "Disable Account",
+ security: [%{"oAuth" => ["write:accounts"]}],
+ operationId: "UtilController.disable_account",
+ parameters: [
+ Operation.parameter(:password, :query, :string, "Password")
+ ],
+ responses: %{
+ 200 =>
+ Operation.response("Success", "application/json", %Schema{
+ type: :object,
+ properties: %{status: %Schema{type: :string, example: "success"}}
+ }),
+ 403 => Operation.response("Error", "application/json", ApiError)
+ }
+ }
+ end
+
+ def delete_account_operation do
+ %Operation{
+ tags: ["Account credentials"],
+ summary: "Delete Account",
+ security: [%{"oAuth" => ["write:accounts"]}],
+ operationId: "UtilController.delete_account",
+ parameters: [
+ Operation.parameter(:password, :query, :string, "Password")
+ ],
+ responses: %{
+ 200 =>
+ Operation.response("Success", "application/json", %Schema{
+ type: :object,
+ properties: %{status: %Schema{type: :string, example: "success"}}
+ }),
+ 403 => Operation.response("Error", "application/json", ApiError)
+ }
+ }
+ end
+
+ def captcha_operation do
+ %Operation{
+ summary: "Get a captcha",
+ operationId: "UtilController.captcha",
+ parameters: [],
+ responses: %{
+ 200 => Operation.response("Success", "application/json", %Schema{type: :object})
+ }
+ }
+ end
+
+ def healthcheck_operation do
+ %Operation{
+ tags: ["Accounts"],
+ summary: "Quick status check on the instance",
+ security: [%{"oAuth" => ["write:accounts"]}],
+ operationId: "UtilController.healthcheck",
+ parameters: [],
+ responses: %{
+ 200 => Operation.response("Healthy", "application/json", %Schema{type: :object}),
+ 503 =>
+ Operation.response("Disabled or Unhealthy", "application/json", %Schema{type: :object})
+ }
+ }
+ end
+
+ def remote_subscribe_operation do
+ %Operation{
+ tags: ["Accounts"],
+ summary: "Remote Subscribe",
+ operationId: "UtilController.remote_subscribe",
+ parameters: [],
+ responses: %{200 => Operation.response("Web Page", "test/html", %Schema{type: :string})}
+ }
+ end
+end
requestBody: request_body("Parameters", import_request(), required: true),
responses: %{
200 => ok_response(),
+ 403 => Operation.response("Error", "application/json", ApiError),
500 => Operation.response("Error", "application/json", ApiError)
},
security: [%{"oAuth" => ["write:follow"]}]
def cast(%Cast{value: value} = context) do
context
- |> Map.put(:value, Pleroma.Web.ControllerHelper.truthy_param?(value))
+ |> Map.put(:value, Pleroma.Web.Utils.Params.truthy_param?(value))
|> Cast.ok()
end
end
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Pleroma.Web.Auth.Authenticator do
- alias Pleroma.Registration
- alias Pleroma.User
-
- def implementation do
- Pleroma.Config.get(
- Pleroma.Web.Auth.Authenticator,
- Pleroma.Web.Auth.PleromaAuthenticator
- )
- end
-
- @callback get_user(Plug.Conn.t()) :: {:ok, User.t()} | {:error, any()}
- def get_user(plug), do: implementation().get_user(plug)
-
- @callback create_from_registration(Plug.Conn.t(), Registration.t()) ::
+ @callback get_user(Plug.Conn.t()) :: {:ok, user :: struct()} | {:error, any()}
+ @callback create_from_registration(Plug.Conn.t(), registration :: struct()) ::
{:ok, User.t()} | {:error, any()}
- def create_from_registration(plug, registration),
- do: implementation().create_from_registration(plug, registration)
-
- @callback get_registration(Plug.Conn.t()) :: {:ok, Registration.t()} | {:error, any()}
- def get_registration(plug), do: implementation().get_registration(plug)
-
+ @callback get_registration(Plug.Conn.t()) :: {:ok, registration :: struct()} | {:error, any()}
@callback handle_error(Plug.Conn.t(), any()) :: any()
- def handle_error(plug, error),
- do: implementation().handle_error(plug, error)
-
@callback auth_template() :: String.t() | nil
- def auth_template do
- # Note: `config :pleroma, :auth_template, "..."` support is deprecated
- implementation().auth_template() ||
- Pleroma.Config.get([:auth, :auth_template], Pleroma.Config.get(:auth_template)) ||
- "show.html"
- end
-
@callback oauth_consumer_template() :: String.t() | nil
- def oauth_consumer_template do
- implementation().oauth_consumer_template() ||
- Pleroma.Config.get([:auth, :oauth_consumer_template], "consumer.html")
- end
-
- @doc "Gets user by nickname or email for auth."
- @spec fetch_user(String.t()) :: User.t() | nil
- def fetch_user(name) do
- User.get_by_nickname_or_email(name)
- end
-
- # Gets name and password from conn
- #
- @spec fetch_credentials(Plug.Conn.t() | map()) ::
- {:ok, {name :: any, password :: any}} | {:error, :invalid_credentials}
- def fetch_credentials(%Plug.Conn{params: params} = _),
- do: fetch_credentials(params)
-
- def fetch_credentials(params) do
- case params do
- %{"authorization" => %{"name" => name, "password" => password}} ->
- {:ok, {name, password}}
-
- %{"grant_type" => "password", "username" => name, "password" => password} ->
- {:ok, {name, password}}
-
- _ ->
- {:error, :invalid_credentials}
- end
- end
end
--- /dev/null
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.Auth.Helpers do
+ alias Pleroma.User
+
+ @doc "Gets user by nickname or email for auth."
+ @spec fetch_user(String.t()) :: User.t() | nil
+ def fetch_user(name) do
+ User.get_by_nickname_or_email(name)
+ end
+
+ # Gets name and password from conn
+ #
+ @spec fetch_credentials(Plug.Conn.t() | map()) ::
+ {:ok, {name :: any, password :: any}} | {:error, :invalid_credentials}
+ def fetch_credentials(%Plug.Conn{params: params} = _),
+ do: fetch_credentials(params)
+
+ def fetch_credentials(params) do
+ case params do
+ %{"authorization" => %{"name" => name, "password" => password}} ->
+ {:ok, {name, password}}
+
+ %{"grant_type" => "password", "username" => name, "password" => password} ->
+ {:ok, {name, password}}
+
+ _ ->
+ {:error, :invalid_credentials}
+ end
+ end
+end
require Logger
- import Pleroma.Web.Auth.Authenticator,
- only: [fetch_credentials: 1, fetch_user: 1]
+ import Pleroma.Web.Auth.Helpers, only: [fetch_credentials: 1, fetch_user: 1]
@behaviour Pleroma.Web.Auth.Authenticator
@base Pleroma.Web.Auth.PleromaAuthenticator
alias Pleroma.User
alias Pleroma.Web.Plugs.AuthenticationPlug
- import Pleroma.Web.Auth.Authenticator,
- only: [fetch_credentials: 1, fetch_user: 1]
+ import Pleroma.Web.Auth.Helpers, only: [fetch_credentials: 1, fetch_user: 1]
@behaviour Pleroma.Web.Auth.Authenticator
--- /dev/null
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.Auth.WrapperAuthenticator do
+ @behaviour Pleroma.Web.Auth.Authenticator
+
+ defp implementation do
+ Pleroma.Config.get(
+ Pleroma.Web.Auth.Authenticator,
+ Pleroma.Web.Auth.PleromaAuthenticator
+ )
+ end
+
+ @impl true
+ def get_user(plug), do: implementation().get_user(plug)
+
+ @impl true
+ def create_from_registration(plug, registration),
+ do: implementation().create_from_registration(plug, registration)
+
+ @impl true
+ def get_registration(plug), do: implementation().get_registration(plug)
+
+ @impl true
+ def handle_error(plug, error),
+ do: implementation().handle_error(plug, error)
+
+ @impl true
+ def auth_template do
+ # Note: `config :pleroma, :auth_template, "..."` support is deprecated
+ implementation().auth_template() ||
+ Pleroma.Config.get([:auth, :auth_template], Pleroma.Config.get(:auth_template)) ||
+ "show.html"
+ end
+
+ @impl true
+ def oauth_consumer_template do
+ implementation().oauth_consumer_template() ||
+ Pleroma.Config.get([:auth, :oauth_consumer_template], "consumer.html")
+ end
+end
end
defp preview?(draft) do
- preview? = Pleroma.Web.ControllerHelper.truthy_param?(draft.params[:preview])
+ preview? = Pleroma.Web.Utils.Params.truthy_param?(draft.params[:preview])
%__MODULE__{draft | preview?: preview?}
end
defmodule Pleroma.Web.CommonAPI.Utils do
import Pleroma.Web.Gettext
- import Pleroma.Web.ControllerHelper, only: [truthy_param?: 1]
alias Calendar.Strftime
alias Pleroma.Activity
alias Pleroma.Web.CommonAPI.ActivityDraft
alias Pleroma.Web.MediaProxy
alias Pleroma.Web.Plugs.AuthenticationPlug
+ alias Pleroma.Web.Utils.Params
require Logger
require Pleroma.Constants
|> DateTime.add(expires_in)
|> DateTime.to_iso8601()
- key = if truthy_param?(data.poll[:multiple]), do: "anyOf", else: "oneOf"
+ key = if Params.truthy_param?(data.poll[:multiple]), do: "anyOf", else: "oneOf"
poll = %{"type" => "Question", key => option_notes, "closed" => end_time}
{:ok, {poll, emoji}}
attachment_links =
draft.params
|> Map.get("attachment_links", Config.get([:instance, :attachment_links]))
- |> truthy_param?()
+ |> Params.truthy_param?()
content_type = get_content_type(draft.params[:content_type])
use Pleroma.Web, :controller
alias Pleroma.Pagination
-
- # As in Mastodon API, per https://api.rubyonrails.org/classes/ActiveModel/Type/Boolean.html
- @falsy_param_values [false, 0, "0", "f", "F", "false", "False", "FALSE", "off", "OFF"]
-
- def explicitly_falsy_param?(value), do: value in @falsy_param_values
-
- # Note: `nil` and `""` are considered falsy values in Pleroma
- def falsy_param?(value),
- do: explicitly_falsy_param?(value) or value in [nil, ""]
-
- def truthy_param?(value), do: not falsy_param?(value)
+ alias Pleroma.Web.Utils.Params
def json_response(conn, status, _) when status in [204, :no_content] do
conn
# To do once OpenAPI transition mess is over: just `truthy_param?(params[:with_relationships])`
params
|> Map.get(:with_relationships, params["with_relationships"])
- |> truthy_param?()
+ |> Params.truthy_param?()
end
end
plug(Plug.Parsers,
parsers: [
:urlencoded,
- {:multipart, length: Config.get([:instance, :upload_limit])},
+ {:multipart, length: {Config, :get, [[:instance, :upload_limit]]}},
:json
],
pass: ["*/*"],
alias Pleroma.User
alias Pleroma.Web.MastodonAPI.AuthController
alias Pleroma.Web.OAuth.Token
- alias Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug
alias Pleroma.Web.Plugs.OAuthScopesPlug
plug(OAuthScopesPlug, %{scopes: ["write:accounts"]} when action == :put_settings)
# Note: :index action handles attempt of unauthenticated access to private instance with redirect
- plug(:skip_plug, EnsurePublicOrAuthenticatedPlug when action == :index)
+ plug(:skip_public_check when action == :index)
plug(
OAuthScopesPlug,
when action == :index
)
- plug(
- :skip_plug,
- [OAuthScopesPlug, EnsurePublicOrAuthenticatedPlug] when action == :manifest
- )
+ plug(:skip_auth when action == :manifest)
@doc "GET /web/*path"
def index(conn, _params) do
import Pleroma.Web.ControllerHelper,
only: [
add_link_headers: 2,
- truthy_param?: 1,
assign_account_by_id: 2,
embed_relationships?: 1,
json_response: 3
alias Pleroma.Web.MastodonAPI.MastodonAPIController
alias Pleroma.Web.MastodonAPI.StatusView
alias Pleroma.Web.OAuth.OAuthController
- alias Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug
alias Pleroma.Web.Plugs.OAuthScopesPlug
alias Pleroma.Web.Plugs.RateLimiter
alias Pleroma.Web.TwitterAPI.TwitterAPI
+ alias Pleroma.Web.Utils.Params
plug(Pleroma.Web.ApiSpec.CastAndValidate)
- plug(:skip_plug, [OAuthScopesPlug, EnsurePublicOrAuthenticatedPlug] when action == :create)
+ plug(:skip_auth when action == :create)
- plug(:skip_plug, EnsurePublicOrAuthenticatedPlug when action in [:show, :statuses])
+ plug(:skip_public_check when action in [:show, :statuses])
plug(
OAuthScopesPlug,
:accepts_chat_messages
]
|> Enum.reduce(%{}, fn key, acc ->
- Maps.put_if_present(acc, key, params[key], &{:ok, truthy_param?(&1)})
+ Maps.put_if_present(acc, key, params[key], &{:ok, Params.truthy_param?(&1)})
end)
|> Maps.put_if_present(:name, params[:display_name])
|> Maps.put_if_present(:bio, params[:note])
alias Pleroma.Web.OAuth.App
alias Pleroma.Web.OAuth.Scopes
alias Pleroma.Web.OAuth.Token
- alias Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug
- alias Pleroma.Web.Plugs.OAuthScopesPlug
action_fallback(Pleroma.Web.MastodonAPI.FallbackController)
- plug(
- :skip_plug,
- [OAuthScopesPlug, EnsurePublicOrAuthenticatedPlug]
- when action in [:create, :verify_credentials]
- )
+ plug(:skip_auth when action in [:create, :verify_credentials])
plug(Pleroma.Web.ApiSpec.CastAndValidate)
plug(Pleroma.Web.ApiSpec.CastAndValidate)
- plug(
- :skip_plug,
- [Pleroma.Web.Plugs.OAuthScopesPlug, Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug]
- when action == :index
- )
+ plug(:skip_auth when action == :index)
defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.CustomEmojiOperation
plug(Pleroma.Web.ApiSpec.CastAndValidate)
- plug(
- :skip_plug,
- [Pleroma.Web.Plugs.OAuthScopesPlug, Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug]
- when action in [:show, :peers]
- )
+ plug(:skip_auth when action in [:show, :peers])
defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.InstanceOperation
require Logger
- plug(
- :skip_plug,
- [Pleroma.Web.Plugs.OAuthScopesPlug, Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug]
- when action in [:empty_array, :empty_object]
- )
+ plug(:skip_auth when action in [:empty_array, :empty_object])
action_fallback(Pleroma.Web.MastodonAPI.FallbackController)
plug(Pleroma.Web.ApiSpec.CastAndValidate)
- plug(
- :skip_plug,
- Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug when action in [:index, :show]
- )
+ plug(:skip_public_check when action in [:index, :show])
@unauthenticated_access %{fallback: :proceed_unauthenticated, scopes: []}
alias Pleroma.Pagination
alias Pleroma.User
alias Pleroma.Web.ActivityPub.ActivityPub
- alias Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug
alias Pleroma.Web.Plugs.OAuthScopesPlug
alias Pleroma.Web.Plugs.RateLimiter
plug(Pleroma.Web.ApiSpec.CastAndValidate)
- plug(:skip_plug, EnsurePublicOrAuthenticatedPlug when action in [:public, :hashtag])
+ plug(:skip_public_check when action in [:public, :hashtag])
# TODO: Replace with a macro when there is a Phoenix release with the following commit in it:
# https://github.com/phoenixframework/phoenix/commit/2e8c63c01fec4dde5467dbbbf9705ff9e780735e
defmodule Pleroma.Web.Metadata.Providers.OpenGraph do
alias Pleroma.User
+ alias Pleroma.Web.MediaProxy
alias Pleroma.Web.Metadata
alias Pleroma.Web.Metadata.Providers.Provider
alias Pleroma.Web.Metadata.Utils
}) do
attachments = build_attachments(object)
scrubbed_content = Utils.scrub_html_and_truncate(object)
- # Zero width space
- content =
- if scrubbed_content != "" and scrubbed_content != "\u200B" do
- ": “" <> scrubbed_content <> "”"
- else
- ""
- end
- # Most previews only show og:title which is inconvenient. Instagram
- # hacks this by putting the description in the title and making the
- # description longer prefixed by how many likes and shares the post
- # has. Here we use the descriptive nickname in the title, and expand
- # the full account & nickname in the description. We also use the cute^Wevil
- # smart quotes around the status text like Instagram, too.
[
{:meta,
[
property: "og:title",
- content: "#{user.name}" <> content
+ content: Utils.user_name_string(user)
], []},
{:meta, [property: "og:url", content: url], []},
{:meta,
[
property: "og:description",
- content: "#{Utils.user_name_string(user)}" <> content
+ content: scrubbed_content
], []},
- {:meta, [property: "og:type", content: "website"], []}
+ {:meta, [property: "og:type", content: "article"], []}
] ++
if attachments == [] or Metadata.activity_nsfw?(object) do
[
- {:meta, [property: "og:image", content: Utils.attachment_url(User.avatar_url(user))],
+ {:meta, [property: "og:image", content: MediaProxy.preview_url(User.avatar_url(user))],
[]},
{:meta, [property: "og:image:width", content: 150], []},
{:meta, [property: "og:image:height", content: 150], []}
], []},
{:meta, [property: "og:url", content: user.uri || user.ap_id], []},
{:meta, [property: "og:description", content: truncated_bio], []},
- {:meta, [property: "og:type", content: "website"], []},
- {:meta, [property: "og:image", content: Utils.attachment_url(User.avatar_url(user))], []},
+ {:meta, [property: "og:type", content: "article"], []},
+ {:meta, [property: "og:image", content: MediaProxy.preview_url(User.avatar_url(user))],
+ []},
{:meta, [property: "og:image:width", content: 150], []},
{:meta, [property: "og:image:height", content: 150], []}
]
Enum.reduce(attachments, [], fn attachment, acc ->
rendered_tags =
Enum.reduce(attachment["url"], [], fn url, acc ->
- # TODO: Add additional properties to objects when we have the data available.
- # Also, Whatsapp only wants JPEG or PNGs. It seems that if we add a second og:image
+ # TODO: Whatsapp only wants JPEG or PNGs. It seems that if we add a second og:image
# object when a Video or GIF is attached it will display that in Whatsapp Rich Preview.
case Utils.fetch_media_type(@media_types, url["mediaType"]) do
"audio" ->
[
- {:meta, [property: "og:audio", content: Utils.attachment_url(url["href"])], []}
+ {:meta, [property: "og:audio", content: MediaProxy.url(url["href"])], []}
| acc
]
+ # Not using preview_url for this. It saves bandwidth, but the image dimensions will
+ # be wrong. We generate it on the fly and have no way to capture or analyze the
+ # image to get the dimensions. This can be an issue for apps/FEs rendering images
+ # in timelines too, but you can get clever with the aspect ratio metadata as a
+ # workaround.
"image" ->
[
- {:meta, [property: "og:image", content: Utils.attachment_url(url["href"])], []},
- {:meta, [property: "og:image:width", content: 150], []},
- {:meta, [property: "og:image:height", content: 150], []}
+ {:meta, [property: "og:image", content: MediaProxy.url(url["href"])], []},
+ {:meta, [property: "og:image:alt", content: attachment["name"]], []}
| acc
]
+ |> maybe_add_dimensions(url)
"video" ->
[
- {:meta, [property: "og:video", content: Utils.attachment_url(url["href"])], []}
+ {:meta, [property: "og:video", content: MediaProxy.url(url["href"])], []}
| acc
]
+ |> maybe_add_dimensions(url)
+ |> maybe_add_video_thumbnail(url)
_ ->
acc
end
defp build_attachments(_), do: []
+
+ # We can use url["mediaType"] to dynamically fill the metadata
+ defp maybe_add_dimensions(metadata, url) do
+ type = url["mediaType"] |> String.split("/") |> List.first()
+
+ cond do
+ !is_nil(url["height"]) && !is_nil(url["width"]) ->
+ metadata ++
+ [
+ {:meta, [property: "og:#{type}:width", content: "#{url["width"]}"], []},
+ {:meta, [property: "og:#{type}:height", content: "#{url["height"]}"], []}
+ ]
+
+ true ->
+ metadata
+ end
+ end
+
+ # Media Preview Proxy makes thumbnails of videos without resizing, so we can trust the
+ # width and height of the source video.
+ defp maybe_add_video_thumbnail(metadata, url) do
+ cond do
+ Pleroma.Config.get([:media_preview_proxy, :enabled], false) ->
+ metadata ++
+ [
+ {:meta, [property: "og:image:width", content: "#{url["width"]}"], []},
+ {:meta, [property: "og:image:height", content: "#{url["height"]}"], []},
+ {:meta, [property: "og:image", content: MediaProxy.preview_url(url["href"])], []}
+ ]
+
+ true ->
+ metadata
+ end
+ end
end
defmodule Pleroma.Web.Metadata.Providers.TwitterCard do
alias Pleroma.User
+ alias Pleroma.Web.MediaProxy
alias Pleroma.Web.Metadata
alias Pleroma.Web.Metadata.Providers.Provider
alias Pleroma.Web.Metadata.Utils
def build_tags(%{activity_id: id, object: object, user: user}) do
attachments = build_attachments(id, object)
scrubbed_content = Utils.scrub_html_and_truncate(object)
- # Zero width space
- content =
- if scrubbed_content != "" and scrubbed_content != "\u200B" do
- "“" <> scrubbed_content <> "”"
- else
- ""
- end
[
title_tag(user),
- {:meta, [property: "twitter:description", content: content], []}
+ {:meta, [property: "twitter:description", content: scrubbed_content], []}
] ++
if attachments == [] or Metadata.activity_nsfw?(object) do
[
end
def image_tag(user) do
- {:meta, [property: "twitter:image", content: Utils.attachment_url(User.avatar_url(user))], []}
+ {:meta, [property: "twitter:image", content: MediaProxy.preview_url(User.avatar_url(user))],
+ []}
end
defp build_attachments(id, %{data: %{"attachment" => attachments}}) do
Enum.reduce(attachments, [], fn attachment, acc ->
rendered_tags =
Enum.reduce(attachment["url"], [], fn url, acc ->
- # TODO: Add additional properties to objects when we have the data available.
case Utils.fetch_media_type(@media_types, url["mediaType"]) do
"audio" ->
[
| acc
]
+ # Not using preview_url for this. It saves bandwidth, but the image dimensions will
+ # be wrong. We generate it on the fly and have no way to capture or analyze the
+ # image to get the dimensions. This can be an issue for apps/FEs rendering images
+ # in timelines too, but you can get clever with the aspect ratio metadata as a
+ # workaround.
"image" ->
[
{:meta, [property: "twitter:card", content: "summary_large_image"], []},
{:meta,
[
property: "twitter:player",
- content: Utils.attachment_url(url["href"])
+ content: MediaProxy.url(url["href"])
], []}
| acc
]
+ |> maybe_add_dimensions(url)
- # TODO: Need the true width and height values here or Twitter renders an iFrame with
- # a bad aspect ratio
"video" ->
+ # fallback to old placeholder values
+ height = url["height"] || 480
+ width = url["width"] || 480
+
[
{:meta, [property: "twitter:card", content: "player"], []},
{:meta, [property: "twitter:player", content: player_url(id)], []},
- {:meta, [property: "twitter:player:width", content: "480"], []},
- {:meta, [property: "twitter:player:height", content: "480"], []}
+ {:meta, [property: "twitter:player:width", content: "#{width}"], []},
+ {:meta, [property: "twitter:player:height", content: "#{height}"], []},
+ {:meta, [property: "twitter:player:stream", content: MediaProxy.url(url["href"])],
+ []},
+ {:meta,
+ [property: "twitter:player:stream:content_type", content: url["mediaType"]], []}
| acc
]
defp player_url(id) do
Pleroma.Web.Router.Helpers.o_status_url(Pleroma.Web.Endpoint, :notice_player, id)
end
+
+ # Videos have problems without dimensions, but we used to not provide WxH for images.
+ # A default (read: incorrect) fallback for images is likely to cause rendering bugs.
+ defp maybe_add_dimensions(metadata, url) do
+ cond do
+ !is_nil(url["height"]) && !is_nil(url["width"]) ->
+ metadata ++
+ [
+ {:meta, [property: "twitter:player:width", content: "#{url["width"]}"], []},
+ {:meta, [property: "twitter:player:height", content: "#{url["height"]}"], []}
+ ]
+
+ true ->
+ metadata
+ end
+ end
end
alias Pleroma.Emoji
alias Pleroma.Formatter
alias Pleroma.HTML
- alias Pleroma.Web.MediaProxy
def scrub_html_and_truncate(%{data: %{"content" => content}} = object) do
content
def scrub_html(content), do: content
- def attachment_url(url) do
- MediaProxy.preview_url(url)
- end
-
def user_name_string(user) do
"#{user.name} " <>
if user.local do
alias Pleroma.Registration
alias Pleroma.Repo
alias Pleroma.User
- alias Pleroma.Web.Auth.Authenticator
- alias Pleroma.Web.ControllerHelper
+ alias Pleroma.Web.Auth.WrapperAuthenticator, as: Authenticator
alias Pleroma.Web.OAuth.App
alias Pleroma.Web.OAuth.Authorization
alias Pleroma.Web.OAuth.MFAController
alias Pleroma.Web.OAuth.Token.Strategy.RefreshToken
alias Pleroma.Web.OAuth.Token.Strategy.Revoke, as: RevokeToken
alias Pleroma.Web.Plugs.RateLimiter
+ alias Pleroma.Web.Utils.Params
require Logger
plug(:fetch_session)
plug(:fetch_flash)
- plug(:skip_plug, [
- Pleroma.Web.Plugs.OAuthScopesPlug,
- Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug
- ])
+ plug(:skip_auth)
plug(RateLimiter, [name: :authentication] when action == :create_authorization)
end
def authorize(%Plug.Conn{assigns: %{token: %Token{}}} = conn, %{"force_login" => _} = params) do
- if ControllerHelper.truthy_param?(params["force_login"]) do
+ if Params.truthy_param?(params["force_login"]) do
do_authorize(conn, params)
else
handle_existing_authorization(conn, params)
alias Pleroma.User
alias Pleroma.Web.ActivityPub.ActivityPub
alias Pleroma.Web.MastodonAPI.StatusView
- alias Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug
alias Pleroma.Web.Plugs.OAuthScopesPlug
alias Pleroma.Web.Plugs.RateLimiter
plug(Pleroma.Web.ApiSpec.CastAndValidate)
- plug(
- :skip_plug,
- [OAuthScopesPlug, EnsurePublicOrAuthenticatedPlug] when action == :confirmation_resend
- )
+ plug(:skip_auth when action == :confirmation_resend)
plug(
OAuthScopesPlug,
]
)
- @skip_plugs [
- Pleroma.Web.Plugs.OAuthScopesPlug,
- Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug
- ]
- plug(:skip_plug, @skip_plugs when action in [:index, :archive, :show])
+ plug(:skip_auth when action in [:index, :archive, :show])
defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.PleromaEmojiPackOperation
get("/oauth_tokens", TwitterAPI.Controller, :oauth_tokens)
delete("/oauth_tokens/:id", TwitterAPI.Controller, :revoke_token)
-
- post(
- "/qvitter/statuses/notifications/read",
- TwitterAPI.Controller,
- :mark_notifications_as_read
- )
end
scope "/", Pleroma.Web do
<% end %>
<%= if Pleroma.Config.oauth_consumer_enabled?() do %>
- <%= render @view_module, Pleroma.Web.Auth.Authenticator.oauth_consumer_template(), assigns %>
+ <%= render @view_module, Pleroma.Web.Auth.WrapperAuthenticator.oauth_consumer_template(), assigns %>
<% end %>
defmodule Pleroma.Web.TwitterAPI.Controller do
use Pleroma.Web, :controller
- alias Pleroma.Notification
alias Pleroma.User
alias Pleroma.Web.OAuth.Token
- alias Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug
alias Pleroma.Web.Plugs.OAuthScopesPlug
alias Pleroma.Web.TwitterAPI.TokenView
require Logger
- plug(
- OAuthScopesPlug,
- %{scopes: ["write:notifications"]} when action == :mark_notifications_as_read
- )
-
- plug(
- :skip_plug,
- [OAuthScopesPlug, EnsurePublicOrAuthenticatedPlug] when action == :confirm_email
- )
-
+ plug(:skip_auth when action == :confirm_email)
plug(:skip_plug, OAuthScopesPlug when action in [:oauth_tokens, :revoke_token])
action_fallback(:errors)
|> put_resp_content_type("application/json")
|> send_resp(status, json)
end
-
- def mark_notifications_as_read(
- %{assigns: %{user: user}} = conn,
- %{"latest_id" => latest_id} = params
- ) do
- Notification.set_read_up_to(user, latest_id)
-
- notifications = Notification.for_user(user, params)
-
- conn
- # XXX: This is a hack because pleroma-fe still uses that API.
- |> put_view(Pleroma.Web.MastodonAPI.NotificationView)
- |> render("index.json", %{notifications: notifications, for: user})
- end
-
- def mark_notifications_as_read(%{assigns: %{user: _user}} = conn, _) do
- bad_request_reply(conn, "You need to specify latest_id")
- end
-
- defp bad_request_reply(conn, error_message) do
- json = error_json(conn, error_message)
- json_reply(conn, 400, json)
- end
-
- defp error_json(conn, error_message) do
- %{"error" => error_message, "request" => conn.request_path} |> Jason.encode!()
- end
end
alias Pleroma.MFA
alias Pleroma.Object.Fetcher
alias Pleroma.User
- alias Pleroma.Web.Auth.Authenticator
alias Pleroma.Web.Auth.TOTPAuthenticator
+ alias Pleroma.Web.Auth.WrapperAuthenticator
alias Pleroma.Web.CommonAPI
@status_types ["Article", "Event", "Note", "Video", "Page", "Question"]
#
def do_follow(conn, %{"authorization" => %{"name" => _, "password" => _, "id" => id}}) do
with {_, %User{} = followee} <- {:fetch_user, User.get_cached_by_id(id)},
- {_, {:ok, user}, _} <- {:auth, Authenticator.get_user(conn), followee},
+ {_, {:ok, user}, _} <- {:auth, WrapperAuthenticator.get_user(conn), followee},
{_, _, _, false} <- {:mfa_required, followee, user, MFA.require?(user)},
{:ok, _, _, _} <- CommonAPI.follow(user, followee) do
redirect(conn, to: "/users/#{followee.id}")
alias Pleroma.Config
alias Pleroma.Emoji
alias Pleroma.Healthcheck
- alias Pleroma.Notification
alias Pleroma.User
alias Pleroma.Web.CommonAPI
alias Pleroma.Web.Plugs.OAuthScopesPlug
alias Pleroma.Web.WebFinger
+ plug(Pleroma.Web.ApiSpec.CastAndValidate when action != :remote_subscribe)
plug(Pleroma.Web.Plugs.FederatingPlug when action == :remote_subscribe)
plug(
]
)
- plug(OAuthScopesPlug, %{scopes: ["write:notifications"]} when action == :notifications_read)
+ defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.TwitterUtilOperation
def remote_subscribe(conn, %{"nickname" => nick, "profile" => _}) do
with %User{} = user <- User.get_cached_by_nickname(nick),
end
end
- def notifications_read(%{assigns: %{user: user}} = conn, %{"id" => notification_id}) do
- with {:ok, _} <- Notification.read_one(user, notification_id) do
- json(conn, %{status: "success"})
- else
- {:error, message} ->
- conn
- |> put_resp_content_type("application/json")
- |> send_resp(403, Jason.encode!(%{"error" => message}))
- end
- end
-
def frontend_configurations(conn, _params) do
render(conn, "frontend_configurations.json")
end
end
end
- def change_password(%{assigns: %{user: user}} = conn, params) do
- case CommonAPI.Utils.confirm_current_password(user, params["password"]) do
+ def change_password(%{assigns: %{user: user}} = conn, %{
+ password: password,
+ new_password: new_password,
+ new_password_confirmation: new_password_confirmation
+ }) do
+ case CommonAPI.Utils.confirm_current_password(user, password) do
{:ok, user} ->
with {:ok, _user} <-
User.reset_password(user, %{
- password: params["new_password"],
- password_confirmation: params["new_password_confirmation"]
+ password: new_password,
+ password_confirmation: new_password_confirmation
}) do
json(conn, %{status: "success"})
else
end
end
- def change_email(%{assigns: %{user: user}} = conn, params) do
- case CommonAPI.Utils.confirm_current_password(user, params["password"]) do
+ def change_email(%{assigns: %{user: user}} = conn, %{password: password, email: email}) do
+ case CommonAPI.Utils.confirm_current_password(user, password) do
{:ok, user} ->
- with {:ok, _user} <- User.change_email(user, params["email"]) do
+ with {:ok, _user} <- User.change_email(user, email) do
json(conn, %{status: "success"})
else
{:error, changeset} ->
end
def delete_account(%{assigns: %{user: user}} = conn, params) do
- password = params["password"] || ""
+ password = params[:password] || ""
case CommonAPI.Utils.confirm_current_password(user, password) do
{:ok, user} ->
end
def disable_account(%{assigns: %{user: user}} = conn, params) do
- case CommonAPI.Utils.confirm_current_password(user, params["password"]) do
+ case CommonAPI.Utils.confirm_current_password(user, params[:password]) do
{:ok, user} ->
User.set_activation_async(user, false)
json(conn, %{status: "success"})
--- /dev/null
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.Utils.Guards do
+ @moduledoc """
+ Project-wide custom guards.
+ See: https://hexdocs.pm/elixir/master/patterns-and-guards.html#custom-patterns-and-guards-expressions
+ """
+
+ @doc "Checks for non-empty string"
+ defguard not_empty_string(string) when is_binary(string) and string != ""
+end
--- /dev/null
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.Utils.Params do
+ # As in Mastodon API, per https://api.rubyonrails.org/classes/ActiveModel/Type/Boolean.html
+ @falsy_param_values [false, 0, "0", "f", "F", "false", "False", "FALSE", "off", "OFF"]
+
+ defp explicitly_falsy_param?(value), do: value in @falsy_param_values
+
+ # Note: `nil` and `""` are considered falsy values in Pleroma
+ defp falsy_param?(value),
+ do: explicitly_falsy_param?(value) or value in [nil, ""]
+
+ def truthy_param?(value), do: not falsy_param?(value)
+end
{:phoenix_pubsub, "~> 2.0"},
{:phoenix_ecto, "~> 4.0"},
{:ecto_enum, "~> 1.4"},
- {:ecto_explain, "~> 0.1.2"},
- {:ecto_sql, "~> 3.4.4"},
+ {:ecto_sql, "~> 3.6.2"},
{:postgrex, ">= 0.15.5"},
{:oban, "~> 2.3.4"},
{:gettext, "~> 0.18"},
{:floki, "~> 0.27"},
{:timex, "~> 3.6"},
{:ueberauth, "~> 0.4"},
- {:linkify, "~> 0.5.0"},
+ {:linkify, "~> 0.5.1"},
{:http_signatures, "~> 0.1.0"},
{:telemetry, "~> 0.3"},
{:poolboy, "~> 1.5"},
{:majic,
git: "https://git.pleroma.social/pleroma/elixir-libraries/majic.git",
ref: "289cda1b6d0d70ccb2ba508a2b0bd24638db2880"},
- {:eblurhash,
- git: "https://github.com/zotonic/eblurhash.git",
- ref: "04a0b76eadf4de1be17726f39b6313b88708fd12"},
+ {:eblurhash, "~> 1.1.0"},
{:open_api_spex, "~> 3.10"},
+ # indirect dependency version override
+ {:plug, "~> 1.10.4", override: true},
+
## dev & test
{:ex_doc, "~> 0.22", only: :dev, runtime: false},
{:ex_machina, "~> 2.4", only: :test},
"deep_merge": {:hex, :deep_merge, "1.0.0", "b4aa1a0d1acac393bdf38b2291af38cb1d4a52806cf7a4906f718e1feb5ee961", [:mix], [], "hexpm", "ce708e5f094b9cd4e8f2be4f00d2f4250c4095be93f8cd6d018c753894885430"},
"earmark": {:hex, :earmark, "1.4.15", "2c7f924bf495ec1f65bd144b355d0949a05a254d0ec561740308a54946a67888", [:mix], [{:earmark_parser, ">= 1.4.13", [hex: :earmark_parser, repo: "hexpm", optional: false]}], "hexpm", "3b1209b85bc9f3586f370f7c363f6533788fb4e51db23aa79565875e7f9999ee"},
"earmark_parser": {:hex, :earmark_parser, "1.4.13", "0c98163e7d04a15feb62000e1a891489feb29f3d10cb57d4f845c405852bbef8", [:mix], [], "hexpm", "d602c26af3a0af43d2f2645613f65841657ad6efc9f0e361c3b6c06b578214ba"},
- "eblurhash": {:git, "https://github.com/zotonic/eblurhash.git", "04a0b76eadf4de1be17726f39b6313b88708fd12", [ref: "04a0b76eadf4de1be17726f39b6313b88708fd12"]},
- "ecto": {:hex, :ecto, "3.4.6", "08f7afad3257d6eb8613309af31037e16c36808dfda5a3cd0cb4e9738db030e4", [:mix], [{:decimal, "~> 1.6 or ~> 2.0", [hex: :decimal, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}, {:telemetry, "~> 0.4", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "6f13a9e2a62e75c2dcfc7207bfc65645ab387af8360db4c89fee8b5a4bf3f70b"},
+ "eblurhash": {:hex, :eblurhash, "1.1.0", "e10ccae762598507ebfacf0b645ed49520f2afa3e7e9943e73a91117dffce415", [:rebar3], [], "hexpm", "2e6b889d09fddd374e3c5ac57c486138768763264e99ac1074ae5fa7fc9ab51d"},
+ "ecto": {:hex, :ecto, "3.6.2", "efdf52acfc4ce29249bab5417415bd50abd62db7b0603b8bab0d7b996548c2bc", [:mix], [{:decimal, "~> 1.6 or ~> 2.0", [hex: :decimal, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}, {:telemetry, "~> 0.4", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "efad6dfb04e6f986b8a3047822b0f826d9affe8e4ebdd2aeedbfcb14fd48884e"},
"ecto_enum": {:hex, :ecto_enum, "1.4.0", "d14b00e04b974afc69c251632d1e49594d899067ee2b376277efd8233027aec8", [:mix], [{:ecto, ">= 3.0.0", [hex: :ecto, repo: "hexpm", optional: false]}, {:ecto_sql, "> 3.0.0", [hex: :ecto_sql, repo: "hexpm", optional: false]}, {:mariaex, ">= 0.0.0", [hex: :mariaex, repo: "hexpm", optional: true]}, {:postgrex, ">= 0.0.0", [hex: :postgrex, repo: "hexpm", optional: true]}], "hexpm", "8fb55c087181c2b15eee406519dc22578fa60dd82c088be376d0010172764ee4"},
- "ecto_explain": {:hex, :ecto_explain, "0.1.2", "a9d504cbd4adc809911f796d5ef7ebb17a576a6d32286c3d464c015bd39d5541", [:mix], [], "hexpm", "1d0e7798ae30ecf4ce34e912e5354a0c1c832b7ebceba39298270b9a9f316330"},
- "ecto_sql": {:hex, :ecto_sql, "3.4.5", "30161f81b167d561a9a2df4329c10ae05ff36eca7ccc84628f2c8b9fa1e43323", [:mix], [{:db_connection, "~> 2.2", [hex: :db_connection, repo: "hexpm", optional: false]}, {:ecto, "~> 3.4.3", [hex: :ecto, repo: "hexpm", optional: false]}, {:myxql, "~> 0.3.0 or ~> 0.4.0", [hex: :myxql, repo: "hexpm", optional: true]}, {:postgrex, "~> 0.15.0", [hex: :postgrex, repo: "hexpm", optional: true]}, {:tds, "~> 2.1.0", [hex: :tds, repo: "hexpm", optional: true]}, {:telemetry, "~> 0.4.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "31990c6a3579b36a3c0841d34a94c275e727de8b84f58509da5f1b2032c98ac2"},
+ "ecto_sql": {:hex, :ecto_sql, "3.6.2", "9526b5f691701a5181427634c30655ac33d11e17e4069eff3ae1176c764e0ba3", [:mix], [{:db_connection, "~> 2.2", [hex: :db_connection, repo: "hexpm", optional: false]}, {:ecto, "~> 3.6.2", [hex: :ecto, repo: "hexpm", optional: false]}, {:myxql, "~> 0.4.0 or ~> 0.5.0", [hex: :myxql, repo: "hexpm", optional: true]}, {:postgrex, "~> 0.15.0 or ~> 1.0", [hex: :postgrex, repo: "hexpm", optional: true]}, {:tds, "~> 2.1.1", [hex: :tds, repo: "hexpm", optional: true]}, {:telemetry, "~> 0.4.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "5ec9d7e6f742ea39b63aceaea9ac1d1773d574ea40df5a53ef8afbd9242fdb6b"},
"eimp": {:hex, :eimp, "1.0.14", "fc297f0c7e2700457a95a60c7010a5f1dcb768a083b6d53f49cd94ab95a28f22", [:rebar3], [{:p1_utils, "1.0.18", [hex: :p1_utils, repo: "hexpm", optional: false]}], "hexpm", "501133f3112079b92d9e22da8b88bf4f0e13d4d67ae9c15c42c30bd25ceb83b6"},
"elixir_make": {:hex, :elixir_make, "0.6.2", "7dffacd77dec4c37b39af867cedaabb0b59f6a871f89722c25b28fcd4bd70530", [:mix], [], "hexpm", "03e49eadda22526a7e5279d53321d1cced6552f344ba4e03e619063de75348d9"},
"esshd": {:hex, :esshd, "0.1.1", "d4dd4c46698093a40a56afecce8a46e246eb35463c457c246dacba2e056f31b5", [:mix], [], "hexpm", "d73e341e3009d390aa36387dc8862860bf9f874c94d9fd92ade2926376f49981"},
"jose": {:hex, :jose, "1.11.1", "59da64010c69aad6cde2f5b9248b896b84472e99bd18f246085b7b9fe435dcdb", [:mix, :rebar3], [], "hexpm", "078f6c9fb3cd2f4cfafc972c814261a7d1e8d2b3685c0a76eb87e158efff1ac5"},
"jumper": {:hex, :jumper, "1.0.1", "3c00542ef1a83532b72269fab9f0f0c82bf23a35e27d278bfd9ed0865cecabff", [:mix], [], "hexpm", "318c59078ac220e966d27af3646026db9b5a5e6703cb2aa3e26bcfaba65b7433"},
"libring": {:hex, :libring, "1.4.0", "41246ba2f3fbc76b3971f6bce83119dfec1eee17e977a48d8a9cfaaf58c2a8d6", [:mix], [], "hexpm"},
- "linkify": {:hex, :linkify, "0.5.0", "e0ea8de73ff44742d6a889721221f4c4eccaad5284957ee9832ffeb347602d54", [:mix], [], "hexpm", "4ccd958350aee7c51c89e21f05b15d30596ebbba707e051d21766be1809df2d7"},
+ "linkify": {:hex, :linkify, "0.5.1", "6dc415cbc948b2f6ecec7cb226aab7ba9d3a1815bb501ae33e042334d707ecee", [:mix], [], "hexpm", "a3128c7e22fada4aa7214009501d8131e1fa3faf2f0a68b33dba379dc84ff944"},
"majic": {:git, "https://git.pleroma.social/pleroma/elixir-libraries/majic.git", "289cda1b6d0d70ccb2ba508a2b0bd24638db2880", [ref: "289cda1b6d0d70ccb2ba508a2b0bd24638db2880"]},
"makeup": {:hex, :makeup, "1.0.5", "d5a830bc42c9800ce07dd97fa94669dfb93d3bf5fcf6ea7a0c67b2e0e4a7f26c", [:mix], [{:nimble_parsec, "~> 0.5 or ~> 1.0", [hex: :nimble_parsec, repo: "hexpm", optional: false]}], "hexpm", "cfa158c02d3f5c0c665d0af11512fed3fba0144cf1aadee0f2ce17747fba2ca9"},
"makeup_elixir": {:hex, :makeup_elixir, "0.14.1", "4f0e96847c63c17841d42c08107405a005a2680eb9c7ccadfd757bd31dabccfb", [:mix], [{:makeup, "~> 1.0", [hex: :makeup, repo: "hexpm", optional: false]}], "hexpm", "f2438b1a80eaec9ede832b5c41cd4f373b38fd7aa33e3b22d9db79e640cbde11"},
"phoenix_html": {:hex, :phoenix_html, "2.14.3", "51f720d0d543e4e157ff06b65de38e13303d5778a7919bcc696599e5934271b8", [:mix], [{:plug, "~> 1.5", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm", "efd697a7fff35a13eeeb6b43db884705cba353a1a41d127d118fda5f90c8e80f"},
"phoenix_pubsub": {:hex, :phoenix_pubsub, "2.0.0", "a1ae76717bb168cdeb10ec9d92d1480fec99e3080f011402c0a2d68d47395ffb", [:mix], [], "hexpm", "c52d948c4f261577b9c6fa804be91884b381a7f8f18450c5045975435350f771"},
"phoenix_swoosh": {:hex, :phoenix_swoosh, "0.3.3", "039435dd975f7e55953525b88f1d596f26c6141412584c16f4db109708a8ee68", [:mix], [{:hackney, "~> 1.9", [hex: :hackney, repo: "hexpm", optional: false]}, {:phoenix, "~> 1.4", [hex: :phoenix, repo: "hexpm", optional: false]}, {:phoenix_html, "~> 2.14", [hex: :phoenix_html, repo: "hexpm", optional: false]}, {:swoosh, "~> 1.0", [hex: :swoosh, repo: "hexpm", optional: false]}], "hexpm", "4a540cea32e05356541737033d666ee7fea7700eb2101bf76783adbfe06601cd"},
- "plug": {:hex, :plug, "1.11.1", "f2992bac66fdae679453c9e86134a4201f6f43a687d8ff1cd1b2862d53c80259", [:mix], [{:mime, "~> 1.0", [hex: :mime, repo: "hexpm", optional: false]}, {:plug_crypto, "~> 1.1.1 or ~> 1.2", [hex: :plug_crypto, repo: "hexpm", optional: false]}, {:telemetry, "~> 0.4", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "23524e4fefbb587c11f0833b3910bfb414bf2e2534d61928e920f54e3a1b881f"},
+ "plug": {:hex, :plug, "1.10.4", "41eba7d1a2d671faaf531fa867645bd5a3dce0957d8e2a3f398ccff7d2ef017f", [:mix], [{:mime, "~> 1.0", [hex: :mime, repo: "hexpm", optional: false]}, {:plug_crypto, "~> 1.1.1 or ~> 1.2", [hex: :plug_crypto, repo: "hexpm", optional: false]}, {:telemetry, "~> 0.4", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "ad1e233fe73d2eec56616568d260777b67f53148a999dc2d048f4eb9778fe4a0"},
"plug_cowboy": {:hex, :plug_cowboy, "2.5.0", "51c998f788c4e68fc9f947a5eba8c215fbb1d63a520f7604134cab0270ea6513", [:mix], [{:cowboy, "~> 2.7", [hex: :cowboy, repo: "hexpm", optional: false]}, {:cowboy_telemetry, "~> 0.3", [hex: :cowboy_telemetry, repo: "hexpm", optional: false]}, {:plug, "~> 1.7", [hex: :plug, repo: "hexpm", optional: false]}, {:telemetry, "~> 0.4", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "5b2c8925a5e2587446f33810a58c01e66b3c345652eeec809b76ba007acde71a"},
"plug_crypto": {:hex, :plug_crypto, "1.2.2", "05654514ac717ff3a1843204b424477d9e60c143406aa94daf2274fdd280794d", [:mix], [], "hexpm", "87631c7ad914a5a445f0a3809f99b079113ae4ed4b867348dd9eec288cecb6db"},
"plug_static_index_html": {:hex, :plug_static_index_html, "1.0.0", "840123d4d3975585133485ea86af73cb2600afd7f2a976f9f5fd8b3808e636a0", [:mix], [{:plug, "~> 1.0", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm", "79fd4fcf34d110605c26560cbae8f23c603ec4158c08298bd4360fdea90bb5cf"},
--- /dev/null
+defmodule Pleroma.Repo.Migrations.DeleteHashtagsObjectsCascade do
+ use Ecto.Migration
+
+ def up do
+ execute("ALTER TABLE hashtags_objects DROP CONSTRAINT hashtags_objects_object_id_fkey")
+
+ alter table(:hashtags_objects) do
+ modify(:object_id, references(:objects, on_delete: :delete_all))
+ end
+ end
+
+ def down do
+ execute("ALTER TABLE hashtags_objects DROP CONSTRAINT hashtags_objects_object_id_fkey")
+
+ alter table(:hashtags_objects) do
+ modify(:object_id, references(:objects, on_delete: :nothing))
+ end
+ end
+end
defmodule Fixtures.Modules.GoodMRF do
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
@impl true
def filter(a), do: {:ok, a}
assert capture_log(fn ->
Mix.Tasks.Pleroma.Ecto.Migrate.run()
- end) =~ "[info] Already up"
+ end) =~ "[info] Migrations already up"
Logger.configure(level: level)
end
use Pleroma.DataCase, async: true
alias Pleroma.Upload.Filter.AnalyzeMetadata
- test "adds the image dimensions" do
+ test "adds the dimensions and blurhash for images" do
upload = %Pleroma.Upload{
name: "an… image.jpg",
content_type: "image/jpeg",
tempfile: Path.absname("test/fixtures/image.jpg")
}
- assert {:ok, :filtered, %{width: 1024, height: 768}} = AnalyzeMetadata.filter(upload)
+ {:ok, :filtered, meta} = AnalyzeMetadata.filter(upload)
+
+ assert %{width: 1024, height: 768} = meta
+ assert meta.blurhash
+ end
+
+ test "adds the dimensions for videos" do
+ upload = %Pleroma.Upload{
+ name: "coolvideo.mp4",
+ content_type: "video/mp4",
+ path: Path.absname("test/fixtures/video.mp4"),
+ tempfile: Path.absname("test/fixtures/video.mp4")
+ }
+
+ assert {:ok, :filtered, %{width: 480, height: 480}} = AnalyzeMetadata.filter(upload)
end
end
follower_count: 9,
following_count: 9001,
is_locked: true,
- is_confirmed: false,
+ is_confirmed: true,
password_reset_pending: true,
- is_approved: false,
+ is_approved: true,
registration_reason: "ahhhhh",
confirmation_token: "qqqq",
domain_blocks: ["lain.com"],
email: nil,
name: nil,
password_hash: nil,
- keys: nil,
- public_key: nil,
+ keys: "RSA begin buplic key",
+ public_key: "--PRIVATE KEYE--",
avatar: %{},
tags: [],
last_refreshed_at: nil,
} = user
end
+ test "delete/1 purges a remote user" do
+ user =
+ insert(:user, %{
+ name: "qqqqqqq",
+ avatar: %{"a" => "b"},
+ banner: %{"a" => "b"},
+ local: false
+ })
+
+ {:ok, job} = User.delete(user)
+ {:ok, _} = ObanHelpers.perform(job)
+ user = User.get_by_id(user.id)
+
+ assert user.name == nil
+ assert user.avatar == %{}
+ assert user.banner == %{}
+ end
+
test "get_public_key_for_ap_id fetches a user that's not in the db" do
assert {:ok, _key} = User.get_public_key_for_ap_id("http://mastodon.example.org/users/admin")
end
activity: %{
"@context" => "https://www.w3.org/ns/activitystreams",
"type" => "Create",
- "object" => %{"type" => "Note", "content" => "AP C2S test"},
- "to" => "https://www.w3.org/ns/activitystreams#Public",
- "cc" => []
+ "object" => %{
+ "type" => "Note",
+ "content" => "AP C2S test",
+ "to" => "https://www.w3.org/ns/activitystreams#Public",
+ "cc" => []
+ }
}
]
end
user = User.get_cached_by_ap_id(note_activity.data["actor"])
data = %{
- type: "Delete",
- object: %{
- id: note_object.data["id"]
+ "type" => "Delete",
+ "object" => %{
+ "id" => note_object.data["id"]
}
}
- conn =
+ result =
conn
|> assign(:user, user)
|> put_req_header("content-type", "application/activity+json")
|> post("/users/#{user.nickname}/outbox", data)
+ |> json_response(201)
- result = json_response(conn, 201)
assert Activity.get_by_ap_id(result["id"])
assert object = Object.get_by_ap_id(note_object.data["id"])
|> put_req_header("content-type", "application/activity+json")
|> post("/users/#{user.nickname}/outbox", data)
- assert json_response(conn, 400)
+ assert json_response(conn, 403)
end
test "it increases like count when receiving a like action", %{conn: conn} do
|> post("/users/#{user.nickname}/outbox", activity)
|> json_response(400)
- assert result == "Note is over the character limit"
+ assert result == "Character limit (5 characters) exceeded, contains 11 characters"
end
end
"object" => %{
"type" => "Note",
"content" => "AP C2S test, attachment",
- "attachment" => [object]
- },
- "to" => "https://www.w3.org/ns/activitystreams#Public",
- "cc" => []
+ "attachment" => [object],
+ "to" => "https://www.w3.org/ns/activitystreams#Public",
+ "cc" => []
+ }
}
activity_response =
assert {:ok, _object, _meta} = ObjectValidator.validate(valid_announce, [])
end
+ test "keeps announced object context", %{valid_announce: valid_announce} do
+ assert %Object{data: %{"context" => object_context}} =
+ Object.get_cached_by_ap_id(valid_announce["object"])
+
+ {:ok, %{"context" => context}, _} =
+ valid_announce
+ |> Map.put("context", "https://example.org/invalid_context_id")
+ |> ObjectValidator.validate([])
+
+ assert context == object_context
+ end
+
test "returns an error if the object can't be found", %{valid_announce: valid_announce} do
without_object =
valid_announce
assert {:object, {"can't find object", []}} in cng.errors
end
- test "returns an error if we don't have the actor", %{valid_announce: valid_announce} do
- nonexisting_actor =
- valid_announce
- |> Map.put("actor", "https://gensokyo.2hu/users/raymoo")
-
- {:error, cng} = ObjectValidator.validate(nonexisting_actor, [])
-
- assert {:actor, {"can't find user", []}} in cng.errors
- end
-
test "returns an error if the actor already announced the object", %{
valid_announce: valid_announce,
announcer: announcer,
assert LikeValidator.cast_and_validate(valid_like).valid?
end
- test "sets the 'to' field to the object actor if no recipients are given", %{
+ test "Add object actor from 'to' field if it doesn't owns the like", %{valid_like: valid_like} do
+ user = insert(:user)
+
+ object_actor = valid_like["actor"]
+
+ valid_like =
+ valid_like
+ |> Map.put("actor", user.ap_id)
+ |> Map.put("to", [])
+
+ {:ok, object, _meta} = ObjectValidator.validate(valid_like, [])
+ assert object_actor in object["to"]
+ end
+
+ test "Removes object actor from 'to' field if it owns the like", %{
valid_like: valid_like,
user: user
} do
- without_recipients =
+ valid_like =
valid_like
- |> Map.delete("to")
+ |> Map.put("to", [user.ap_id])
- {:ok, object, _meta} = ObjectValidator.validate(without_recipients, [])
-
- assert object["to"] == [user.ap_id]
+ {:ok, object, _meta} = ObjectValidator.validate(valid_like, [])
+ refute user.ap_id in object["to"]
end
test "sets the context field to the context of the object if no context is given", %{
assert object["context"] == post_activity.data["context"]
end
- test "it errors when the actor is missing or not known", %{valid_like: valid_like} do
- without_actor = Map.delete(valid_like, "actor")
-
- refute LikeValidator.cast_and_validate(without_actor).valid?
-
- with_invalid_actor = Map.put(valid_like, "actor", "invalidactor")
-
- refute LikeValidator.cast_and_validate(with_invalid_actor).valid?
- end
-
test "it errors when the object is missing or not known", %{valid_like: valid_like} do
without_object = Map.delete(valid_like, "object")
assert {:ok, %Activity{} = activity} = Relay.publish(note)
assert activity.data["type"] == "Announce"
assert activity.data["actor"] == service_actor.ap_id
- assert activity.data["to"] == [service_actor.follower_address]
+ assert service_actor.follower_address in activity.data["to"]
assert called(Pleroma.Web.Federator.publish(activity))
end
assert {:error, _e} = Transmogrifier.handle_incoming(data)
end
-
- test "it does not clobber the addressing on announce activities" do
- user = insert(:user)
- {:ok, activity} = CommonAPI.post(user, %{status: "hey"})
-
- data =
- File.read!("test/fixtures/mastodon-announce.json")
- |> Jason.decode!()
- |> Map.put("object", Object.normalize(activity, fetch: false).data["id"])
- |> Map.put("to", ["http://mastodon.example.org/users/admin/followers"])
- |> Map.put("cc", [])
-
- _user =
- insert(:user,
- local: false,
- ap_id: data["actor"],
- follower_address: "http://mastodon.example.org/users/admin/followers"
- )
-
- {:ok, %Activity{data: data, local: false}} = Transmogrifier.handle_incoming(data)
-
- assert data["to"] == ["http://mastodon.example.org/users/admin/followers"]
- end
end
]
}
- res =
- assert conn
- |> put_req_header("content-type", "application/json")
- |> post("/api/pleroma/admin/config", %{"configs" => [params]})
- |> json_response_and_validate_schema(200)
-
- assert res == %{
- "configs" => [
- %{
- "db" => [":instance_thumbnail"],
- "group" => ":pleroma",
- "key" => ":instance",
- "value" => params["value"]
- }
- ],
- "need_reboot" => false
- }
-
- _res =
- assert conn
- |> get("/api/v1/instance")
- |> json_response_and_validate_schema(200)
+ assert conn
+ |> put_req_header("content-type", "application/json")
+ |> post("/api/pleroma/admin/config", %{"configs" => [params]})
+ |> json_response_and_validate_schema(200) ==
+ %{
+ "configs" => [
+ %{
+ "db" => [":instance_thumbnail"],
+ "group" => ":pleroma",
+ "key" => ":instance",
+ "value" => params["value"]
+ }
+ ],
+ "need_reboot" => false
+ }
- assert res = %{"thumbnail" => "https://example.com/media/new_thumbnail.jpg"}
+ assert conn
+ |> get("/api/v1/instance")
+ |> json_response_and_validate_schema(200)
+ |> Map.take(["thumbnail"]) ==
+ %{"thumbnail" => "https://example.com/media/new_thumbnail.jpg"}
end
test "Concurrent Limiter", %{conn: conn} do
defmodule Pleroma.Web.Auth.AuthenticatorTest do
use Pleroma.Web.ConnCase, async: true
- alias Pleroma.Web.Auth.Authenticator
+ alias Pleroma.Web.Auth.Helpers
import Pleroma.Factory
describe "fetch_user/1" do
test "returns user by name" do
user = insert(:user)
- assert Authenticator.fetch_user(user.nickname) == user
+ assert Helpers.fetch_user(user.nickname) == user
end
test "returns user by email" do
user = insert(:user)
- assert Authenticator.fetch_user(user.email) == user
+ assert Helpers.fetch_user(user.email) == user
end
test "returns nil" do
- assert Authenticator.fetch_user("email") == nil
+ assert Helpers.fetch_user("email") == nil
end
end
describe "fetch_credentials/1" do
test "returns name and password from authorization params" do
params = %{"authorization" => %{"name" => "test", "password" => "test-pass"}}
- assert Authenticator.fetch_credentials(params) == {:ok, {"test", "test-pass"}}
+ assert Helpers.fetch_credentials(params) == {:ok, {"test", "test-pass"}}
end
test "returns name and password with grant_type 'password'" do
params = %{"grant_type" => "password", "username" => "test", "password" => "test-pass"}
- assert Authenticator.fetch_credentials(params) == {:ok, {"test", "test-pass"}}
+ assert Helpers.fetch_credentials(params) == {:ok, {"test", "test-pass"}}
end
test "returns error" do
- assert Authenticator.fetch_credentials(%{}) == {:error, :invalid_credentials}
+ assert Helpers.fetch_credentials(%{}) == {:error, :invalid_credentials}
end
end
end
{:ok, post_2} = CommonAPI.post(user, %{status: "second post"})
response_1 = get(conn, "/api/v1/accounts/#{user.id}/statuses?limit=1")
- assert [res] = json_response(response_1, 200)
+ assert [res] = json_response_and_validate_schema(response_1, 200)
assert res["id"] == post_2.id
response_2 = get(conn, "/api/v1/accounts/#{user.id}/statuses?limit=1&max_id=#{res["id"]}")
- assert [res] = json_response(response_2, 200)
+ assert [res] = json_response_and_validate_schema(response_2, 200)
assert res["id"] == post_1.id
refute response_1 == response_2
assert [] ==
conn
|> get("/api/v1/timelines/home")
- |> json_response(200)
+ |> json_response_and_validate_schema(200)
assert %{"showing_reblogs" => true} =
conn
assert [%{"id" => ^reblog_id}] =
conn
|> get("/api/v1/timelines/home")
- |> json_response(200)
+ |> json_response_and_validate_schema(200)
end
test "following with reblogs" do
assert [%{"id" => ^reblog_id}] =
conn
|> get("/api/v1/timelines/home")
- |> json_response(200)
+ |> json_response_and_validate_schema(200)
assert %{"showing_reblogs" => false} =
conn
assert [] ==
conn
|> get("/api/v1/timelines/home")
- |> json_response(200)
+ |> json_response_and_validate_schema(200)
end
test "following / unfollowing errors", %{user: user, conn: conn} do
res_conn = get(conn, "/api/v1/statuses/#{direct.id}/context")
- assert %{"ancestors" => [], "descendants" => []} == json_response(res_conn, 200)
+ assert %{"ancestors" => [], "descendants" => []} ==
+ json_response_and_validate_schema(res_conn, 200)
end
test "Removes a conversation", %{user: user_one, conn: conn} do
defmodule Pleroma.Web.MastodonAPI.MediaControllerTest do
use Pleroma.Web.ConnCase
+ import ExUnit.CaptureLog
+
alias Pleroma.Object
alias Pleroma.User
alias Pleroma.Web.ActivityPub.ActivityPub
object = Object.get_by_id(media["id"])
assert object.data["actor"] == user.ap_id
end
+
+ test "/api/v2/media, upload_limit", %{conn: conn, user: user} do
+ desc = "Description of the binary"
+
+ upload_limit = Config.get([:instance, :upload_limit]) * 8 + 8
+
+ assert :ok ==
+ File.write(Path.absname("test/tmp/large_binary.data"), <<0::size(upload_limit)>>)
+
+ large_binary = %Plug.Upload{
+ content_type: nil,
+ path: Path.absname("test/tmp/large_binary.data"),
+ filename: "large_binary.data"
+ }
+
+ assert capture_log(fn ->
+ assert %{"error" => "file_too_large"} =
+ conn
+ |> put_req_header("content-type", "multipart/form-data")
+ |> post("/api/v2/media", %{
+ "file" => large_binary,
+ "description" => desc
+ })
+ |> json_response_and_validate_schema(400)
+ end) =~
+ "[error] Elixir.Pleroma.Upload store (using Pleroma.Uploaders.Local) failed: :file_too_large"
+
+ clear_config([:instance, :upload_limit], upload_limit)
+
+ assert response =
+ conn
+ |> put_req_header("content-type", "multipart/form-data")
+ |> post("/api/v2/media", %{
+ "file" => large_binary,
+ "description" => desc
+ })
+ |> json_response_and_validate_schema(202)
+
+ assert media_id = response["id"]
+
+ %{conn: conn} = oauth_access(["read:media"], user: user)
+
+ media =
+ conn
+ |> get("/api/v1/media/#{media_id}")
+ |> json_response_and_validate_schema(200)
+
+ assert media["type"] == "unknown"
+ assert media["description"] == desc
+ assert media["id"]
+
+ assert :ok == File.rm(Path.absname("test/tmp/large_binary.data"))
+ end
end
describe "Update media description" do
conn
|> get("/api/v1/media/#{object.id}")
- |> json_response(403)
+ |> json_response_and_validate_schema(403)
end
end
end
"sensitive" => 0
})
+ # Idempotency plug response means detection fail
assert %{"id" => second_id} = json_response(conn_two, 200)
assert id == second_id
|> assign(:token, insert(:oauth_token, user: user3, scopes: ["read:statuses"]))
|> get("api/v1/timelines/home")
- [reblogged_activity] = json_response(conn3, 200)
+ [reblogged_activity] = json_response_and_validate_schema(conn3, 200)
assert reblogged_activity["reblog"]["in_reply_to_id"] == replied_to.id
local = Utils.as_local_public()
assert %{"content" => "cofe", "id" => id, "visibility" => "local"} =
- json_response(conn_one, 200)
+ json_response_and_validate_schema(conn_one, 200)
assert %Activity{id: ^id, data: %{"to" => [^local]}} = Activity.get_by_id(id)
end
%{conn: auth_conn} = oauth_access(["read:statuses"])
res_conn = get(auth_conn, "#{base_uri}?local=true")
- assert length(json_response(res_conn, 200)) == 1
+ assert length(json_response_and_validate_schema(res_conn, 200)) == 1
res_conn = get(auth_conn, "#{base_uri}?local=false")
- assert length(json_response(res_conn, 200)) == 2
+ assert length(json_response_and_validate_schema(res_conn, 200)) == 2
end
test "with default settings on private instances, returns 403 for unauthenticated users", %{
for local <- [true, false] do
res_conn = get(conn, "#{base_uri}?local=#{local}")
- assert json_response(res_conn, :unauthorized) == error_response
+ assert json_response_and_validate_schema(res_conn, :unauthorized) == error_response
end
ensure_authenticated_access(base_uri)
for local <- [true, false] do
res_conn = get(conn, "#{base_uri}?local=#{local}")
- assert json_response(res_conn, :unauthorized) == error_response
+ assert json_response_and_validate_schema(res_conn, :unauthorized) == error_response
end
ensure_authenticated_access(base_uri)
clear_config([:restrict_unauthenticated, :timelines, :federated], true)
res_conn = get(conn, "#{base_uri}?local=true")
- assert length(json_response(res_conn, 200)) == 1
+ assert length(json_response_and_validate_schema(res_conn, 200)) == 1
res_conn = get(conn, "#{base_uri}?local=false")
- assert json_response(res_conn, :unauthorized) == error_response
+ assert json_response_and_validate_schema(res_conn, :unauthorized) == error_response
ensure_authenticated_access(base_uri)
end
clear_config([:restrict_unauthenticated, :timelines, :federated], false)
res_conn = get(conn, "#{base_uri}?local=true")
- assert json_response(res_conn, :unauthorized) == error_response
+ assert json_response_and_validate_schema(res_conn, :unauthorized) == error_response
# Note: local activities get delivered as part of federated timeline
res_conn = get(conn, "#{base_uri}?local=false")
- assert length(json_response(res_conn, 200)) == 2
+ assert length(json_response_and_validate_schema(res_conn, 200)) == 2
ensure_authenticated_access(base_uri)
end
|> assign(:token, insert(:oauth_token, user: user, scopes: ["write:accounts"]))
|> put("/api/web/settings", %{"data" => %{"programming" => "socks"}})
- assert _result = json_response(conn, 200)
+ assert %{} = json_response(conn, 200)
user = User.get_cached_by_ap_id(user.ap_id)
assert user.mastofe_settings == %{"programming" => "socks"}
"attachment" => [
%{
"url" => [
- %{"mediaType" => "image/png", "href" => "https://pleroma.gov/tenshi.png"}
+ %{
+ "mediaType" => "image/png",
+ "href" => "https://pleroma.gov/tenshi.png",
+ "height" => 1024,
+ "width" => 1280
+ }
]
},
%{
},
%{
"url" => [
- %{"mediaType" => "video/webm", "href" => "https://pleroma.gov/about/juche.webm"}
+ %{
+ "mediaType" => "video/webm",
+ "href" => "https://pleroma.gov/about/juche.webm",
+ "height" => 600,
+ "width" => 800
+ }
]
},
%{
assert Enum.all?(
[
{:meta, [property: "og:image", content: "https://pleroma.gov/tenshi.png"], []},
+ {:meta, [property: "og:image:width", content: "1280"], []},
+ {:meta, [property: "og:image:height", content: "1024"], []},
{:meta,
[property: "og:audio", content: "http://www.gnu.org/music/free-software-song.au"],
[]},
{:meta, [property: "og:video", content: "https://pleroma.gov/about/juche.webm"],
- []}
+ []},
+ {:meta, [property: "og:video:width", content: "800"], []},
+ {:meta, [property: "og:video:height", content: "600"], []}
],
fn element -> element in result end
)
refute {:meta, [property: "og:image", content: "https://misskey.microsoft/corndog.png"], []} in result
end
+
+ test "video attachments have image thumbnail with WxH metadata with Preview Proxy enabled" do
+ clear_config([:media_proxy, :enabled], true)
+ clear_config([:media_preview_proxy, :enabled], true)
+ user = insert(:user)
+
+ note =
+ insert(:note, %{
+ data: %{
+ "actor" => user.ap_id,
+ "id" => "https://pleroma.gov/objects/whatever",
+ "content" => "test video post",
+ "sensitive" => false,
+ "attachment" => [
+ %{
+ "url" => [
+ %{
+ "mediaType" => "video/webm",
+ "href" => "https://pleroma.gov/about/juche.webm",
+ "height" => 600,
+ "width" => 800
+ }
+ ]
+ }
+ ]
+ }
+ })
+
+ result = OpenGraph.build_tags(%{object: note, url: note.data["id"], user: user})
+
+ assert {:meta, [property: "og:image:width", content: "800"], []} in result
+ assert {:meta, [property: "og:image:height", content: "600"], []} in result
+
+ assert {:meta,
+ [
+ property: "og:image",
+ content:
+ "http://localhost:4001/proxy/preview/LzAnlke-l5oZbNzWsrHfprX1rGw/aHR0cHM6Ly9wbGVyb21hLmdvdi9hYm91dC9qdWNoZS53ZWJt/juche.webm"
+ ], []} in result
+ end
+
+ test "video attachments have no image thumbnail with Preview Proxy disabled" do
+ clear_config([:media_proxy, :enabled], true)
+ clear_config([:media_preview_proxy, :enabled], false)
+ user = insert(:user)
+
+ note =
+ insert(:note, %{
+ data: %{
+ "actor" => user.ap_id,
+ "id" => "https://pleroma.gov/objects/whatever",
+ "content" => "test video post",
+ "sensitive" => false,
+ "attachment" => [
+ %{
+ "url" => [
+ %{
+ "mediaType" => "video/webm",
+ "href" => "https://pleroma.gov/about/juche.webm",
+ "height" => 600,
+ "width" => 800
+ }
+ ]
+ }
+ ]
+ }
+ })
+
+ result = OpenGraph.build_tags(%{object: note, url: note.data["id"], user: user})
+
+ refute {:meta, [property: "og:image:width", content: "800"], []} in result
+ refute {:meta, [property: "og:image:height", content: "600"], []} in result
+
+ refute {:meta,
+ [
+ property: "og:image",
+ content:
+ "http://localhost:4001/proxy/preview/LzAnlke-l5oZbNzWsrHfprX1rGw/aHR0cHM6Ly9wbGVyb21hLmdvdi9hYm91dC9qdWNoZS53ZWJt/juche.webm"
+ ], []} in result
+ end
end
alias Pleroma.User
alias Pleroma.Web.CommonAPI
alias Pleroma.Web.Endpoint
+ alias Pleroma.Web.MediaProxy
alias Pleroma.Web.Metadata.Providers.TwitterCard
alias Pleroma.Web.Metadata.Utils
alias Pleroma.Web.Router
test "it renders twitter card for user info" do
user = insert(:user, name: "Jimmy Hendriks", bio: "born 19 March 1994")
- avatar_url = Utils.attachment_url(User.avatar_url(user))
+ avatar_url = MediaProxy.preview_url(User.avatar_url(user))
res = TwitterCard.build_tags(%{user: user})
assert res == [
assert [
{:meta, [property: "twitter:title", content: Utils.user_name_string(user)], []},
- {:meta, [property: "twitter:description", content: "“pleroma in a nutshell”"], []},
+ {:meta, [property: "twitter:description", content: "pleroma in a nutshell"], []},
{:meta, [property: "twitter:image", content: "http://localhost:4001/images/avi.png"],
[]},
{:meta, [property: "twitter:card", content: "summary"], []}
assert [
{:meta, [property: "twitter:title", content: Utils.user_name_string(user)], []},
- {:meta, [property: "twitter:description", content: "“pleroma in a nutshell”"], []},
+ {:meta, [property: "twitter:description", content: "pleroma in a nutshell"], []},
{:meta, [property: "twitter:image", content: "http://localhost:4001/images/avi.png"],
[]},
{:meta, [property: "twitter:card", content: "summary"], []}
"content" => "pleroma in a nutshell",
"attachment" => [
%{
- "url" => [%{"mediaType" => "image/png", "href" => "https://pleroma.gov/tenshi.png"}]
+ "url" => [
+ %{
+ "mediaType" => "image/png",
+ "href" => "https://pleroma.gov/tenshi.png",
+ "height" => 1024,
+ "width" => 1280
+ }
+ ]
},
%{
"url" => [
},
%{
"url" => [
- %{"mediaType" => "video/webm", "href" => "https://pleroma.gov/about/juche.webm"}
+ %{
+ "mediaType" => "video/webm",
+ "href" => "https://pleroma.gov/about/juche.webm",
+ "height" => 600,
+ "width" => 800
+ }
]
}
]
assert [
{:meta, [property: "twitter:title", content: Utils.user_name_string(user)], []},
- {:meta, [property: "twitter:description", content: "“pleroma in a nutshell”"], []},
+ {:meta, [property: "twitter:description", content: "pleroma in a nutshell"], []},
{:meta, [property: "twitter:card", content: "summary_large_image"], []},
{:meta, [property: "twitter:player", content: "https://pleroma.gov/tenshi.png"], []},
+ {:meta, [property: "twitter:player:width", content: "1280"], []},
+ {:meta, [property: "twitter:player:height", content: "1024"], []},
{:meta, [property: "twitter:card", content: "player"], []},
{:meta,
[
property: "twitter:player",
content: Router.Helpers.o_status_url(Endpoint, :notice_player, activity.id)
], []},
- {:meta, [property: "twitter:player:width", content: "480"], []},
- {:meta, [property: "twitter:player:height", content: "480"], []}
+ {:meta, [property: "twitter:player:width", content: "800"], []},
+ {:meta, [property: "twitter:player:height", content: "600"], []},
+ {:meta,
+ [
+ property: "twitter:player:stream",
+ content: "https://pleroma.gov/about/juche.webm"
+ ], []},
+ {:meta, [property: "twitter:player:stream:content_type", content: "video/webm"], []}
] == result
end
end
assert %{"error" => "Insufficient permissions: follow | write:follows."} ==
json_response(conn, 403)
else
- assert json_response(conn, 200)
+ assert json_response_and_validate_schema(conn, 200)
end
end
end
{:ok, _, socket} =
socket(UserSocket, "", %{user_name: user.nickname})
- |> subscribe_and_join(ShoutChannel, "shout:public")
+ |> subscribe_and_join(ShoutChannel, "chat:public")
{:ok, socket: socket}
end
alias Pleroma.Repo
alias Pleroma.User
- alias Pleroma.Web.CommonAPI
alias Pleroma.Web.OAuth.Token
import Pleroma.Factory
- describe "POST /api/qvitter/statuses/notifications/read" do
- test "without valid credentials", %{conn: conn} do
- conn = post(conn, "/api/qvitter/statuses/notifications/read", %{"latest_id" => 1_234_567})
- assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
- end
-
- test "with credentials, without any params" do
- %{conn: conn} = oauth_access(["write:notifications"])
-
- conn = post(conn, "/api/qvitter/statuses/notifications/read")
-
- assert json_response(conn, 400) == %{
- "error" => "You need to specify latest_id",
- "request" => "/api/qvitter/statuses/notifications/read"
- }
- end
-
- test "with credentials, with params" do
- %{user: current_user, conn: conn} =
- oauth_access(["read:notifications", "write:notifications"])
-
- other_user = insert(:user)
-
- {:ok, _activity} =
- CommonAPI.post(other_user, %{
- status: "Hey @#{current_user.nickname}"
- })
-
- response_conn =
- conn
- |> get("/api/v1/notifications")
-
- [notification] = json_response(response_conn, 200)
-
- assert notification["pleroma"]["is_seen"] == false
-
- response_conn =
- conn
- |> post("/api/qvitter/statuses/notifications/read", %{"latest_id" => notification["id"]})
-
- [notification] = response = json_response(response_conn, 200)
-
- assert length(response) == 1
-
- assert notification["pleroma"]["is_seen"] == true
- end
- end
-
describe "GET /api/account/confirm_email/:id/:token" do
setup do
{:ok, user} =
test "it updates notification settings", %{user: user, conn: conn} do
conn
- |> put("/api/pleroma/notification_settings", %{
- "block_from_strangers" => true,
- "bar" => 1
- })
- |> json_response(:ok)
+ |> put(
+ "/api/pleroma/notification_settings?#{
+ URI.encode_query(%{
+ block_from_strangers: true
+ })
+ }"
+ )
+ |> json_response_and_validate_schema(:ok)
user = refresh_record(user)
test "it updates notification settings to enable hiding contents", %{user: user, conn: conn} do
conn
- |> put("/api/pleroma/notification_settings", %{"hide_notification_contents" => "1"})
- |> json_response(:ok)
+ |> put(
+ "/api/pleroma/notification_settings?#{
+ URI.encode_query(%{
+ hide_notification_contents: 1
+ })
+ }"
+ )
+ |> json_response_and_validate_schema(:ok)
user = refresh_record(user)
response =
conn
|> get("/api/pleroma/frontend_configurations")
- |> json_response(:ok)
+ |> json_response_and_validate_schema(:ok)
assert response == Jason.encode!(config |> Enum.into(%{})) |> Jason.decode!()
end
emoji =
conn
|> get("/api/pleroma/emoji")
- |> json_response(200)
+ |> json_response_and_validate_schema(200)
assert Enum.all?(emoji, fn
{_key,
response =
conn
|> get("/api/pleroma/healthcheck")
- |> json_response(503)
+ |> json_response_and_validate_schema(503)
assert response == %{}
end
response =
conn
|> get("/api/pleroma/healthcheck")
- |> json_response(200)
+ |> json_response_and_validate_schema(200)
assert %{
"active" => _,
response =
conn
|> get("/api/pleroma/healthcheck")
- |> json_response(503)
+ |> json_response_and_validate_schema(503)
assert %{
"active" => _,
test "with valid permissions and password, it disables the account", %{conn: conn, user: user} do
response =
conn
- |> post("/api/pleroma/disable_account", %{"password" => "test"})
- |> json_response(:ok)
+ |> post("/api/pleroma/disable_account?password=test")
+ |> json_response_and_validate_schema(:ok)
assert response == %{"status" => "success"}
ObanHelpers.perform_all()
response =
conn
- |> post("/api/pleroma/disable_account", %{"password" => "test1"})
- |> json_response(:ok)
+ |> post("/api/pleroma/disable_account?password=test1")
+ |> json_response_and_validate_schema(:ok)
assert response == %{"error" => "Invalid password."}
user = User.get_cached_by_id(user.id)
conn =
conn
|> assign(:token, nil)
- |> post("/api/pleroma/change_email")
-
- assert json_response(conn, 403) == %{"error" => "Insufficient permissions: write:accounts."}
+ |> post(
+ "/api/pleroma/change_email?#{
+ URI.encode_query(%{password: "hi", email: "test@test.com"})
+ }"
+ )
+
+ assert json_response_and_validate_schema(conn, 403) == %{
+ "error" => "Insufficient permissions: write:accounts."
+ }
end
test "with proper permissions and invalid password", %{conn: conn} do
conn =
- post(conn, "/api/pleroma/change_email", %{
- "password" => "hi",
- "email" => "test@test.com"
- })
-
- assert json_response(conn, 200) == %{"error" => "Invalid password."}
+ post(
+ conn,
+ "/api/pleroma/change_email?#{
+ URI.encode_query(%{password: "hi", email: "test@test.com"})
+ }"
+ )
+
+ assert json_response_and_validate_schema(conn, 200) == %{"error" => "Invalid password."}
end
test "with proper permissions, valid password and invalid email", %{
conn: conn
} do
conn =
- post(conn, "/api/pleroma/change_email", %{
- "password" => "test",
- "email" => "foobar"
- })
+ post(
+ conn,
+ "/api/pleroma/change_email?#{URI.encode_query(%{password: "test", email: "foobar"})}"
+ )
- assert json_response(conn, 200) == %{"error" => "Email has invalid format."}
+ assert json_response_and_validate_schema(conn, 200) == %{
+ "error" => "Email has invalid format."
+ }
end
test "with proper permissions, valid password and no email", %{
conn: conn
} do
- conn =
- post(conn, "/api/pleroma/change_email", %{
- "password" => "test"
- })
+ conn = post(conn, "/api/pleroma/change_email?#{URI.encode_query(%{password: "test"})}")
- assert json_response(conn, 200) == %{"error" => "Email can't be blank."}
+ assert %{"error" => "Missing field: email."} = json_response_and_validate_schema(conn, 400)
end
test "with proper permissions, valid password and blank email", %{
conn: conn
} do
conn =
- post(conn, "/api/pleroma/change_email", %{
- "password" => "test",
- "email" => ""
- })
+ post(
+ conn,
+ "/api/pleroma/change_email?#{URI.encode_query(%{password: "test", email: ""})}"
+ )
- assert json_response(conn, 200) == %{"error" => "Email can't be blank."}
+ assert json_response_and_validate_schema(conn, 200) == %{"error" => "Email can't be blank."}
end
test "with proper permissions, valid password and non unique email", %{
user = insert(:user)
conn =
- post(conn, "/api/pleroma/change_email", %{
- "password" => "test",
- "email" => user.email
- })
+ post(
+ conn,
+ "/api/pleroma/change_email?#{URI.encode_query(%{password: "test", email: user.email})}"
+ )
- assert json_response(conn, 200) == %{"error" => "Email has already been taken."}
+ assert json_response_and_validate_schema(conn, 200) == %{
+ "error" => "Email has already been taken."
+ }
end
test "with proper permissions, valid password and valid email", %{
conn: conn
} do
conn =
- post(conn, "/api/pleroma/change_email", %{
- "password" => "test",
- "email" => "cofe@foobar.com"
- })
-
- assert json_response(conn, 200) == %{"status" => "success"}
+ post(
+ conn,
+ "/api/pleroma/change_email?#{
+ URI.encode_query(%{password: "test", email: "cofe@foobar.com"})
+ }"
+ )
+
+ assert json_response_and_validate_schema(conn, 200) == %{"status" => "success"}
end
end
conn =
conn
|> assign(:token, nil)
- |> post("/api/pleroma/change_password")
-
- assert json_response(conn, 403) == %{"error" => "Insufficient permissions: write:accounts."}
+ |> post(
+ "/api/pleroma/change_password?#{
+ URI.encode_query(%{
+ password: "hi",
+ new_password: "newpass",
+ new_password_confirmation: "newpass"
+ })
+ }"
+ )
+
+ assert json_response_and_validate_schema(conn, 403) == %{
+ "error" => "Insufficient permissions: write:accounts."
+ }
end
test "with proper permissions and invalid password", %{conn: conn} do
conn =
- post(conn, "/api/pleroma/change_password", %{
- "password" => "hi",
- "new_password" => "newpass",
- "new_password_confirmation" => "newpass"
- })
-
- assert json_response(conn, 200) == %{"error" => "Invalid password."}
+ post(
+ conn,
+ "/api/pleroma/change_password?#{
+ URI.encode_query(%{
+ password: "hi",
+ new_password: "newpass",
+ new_password_confirmation: "newpass"
+ })
+ }"
+ )
+
+ assert json_response_and_validate_schema(conn, 200) == %{"error" => "Invalid password."}
end
test "with proper permissions, valid password and new password and confirmation not matching",
conn: conn
} do
conn =
- post(conn, "/api/pleroma/change_password", %{
- "password" => "test",
- "new_password" => "newpass",
- "new_password_confirmation" => "notnewpass"
- })
-
- assert json_response(conn, 200) == %{
+ post(
+ conn,
+ "/api/pleroma/change_password?#{
+ URI.encode_query(%{
+ password: "test",
+ new_password: "newpass",
+ new_password_confirmation: "notnewpass"
+ })
+ }"
+ )
+
+ assert json_response_and_validate_schema(conn, 200) == %{
"error" => "New password does not match confirmation."
}
end
conn: conn
} do
conn =
- post(conn, "/api/pleroma/change_password", %{
- "password" => "test",
- "new_password" => "",
- "new_password_confirmation" => ""
- })
-
- assert json_response(conn, 200) == %{
+ post(
+ conn,
+ "/api/pleroma/change_password?#{
+ URI.encode_query(%{password: "test", new_password: "", new_password_confirmation: ""})
+ }"
+ )
+
+ assert json_response_and_validate_schema(conn, 200) == %{
"error" => "New password can't be blank."
}
end
user: user
} do
conn =
- post(conn, "/api/pleroma/change_password", %{
- "password" => "test",
- "new_password" => "newpass",
- "new_password_confirmation" => "newpass"
- })
-
- assert json_response(conn, 200) == %{"status" => "success"}
+ post(
+ conn,
+ "/api/pleroma/change_password?#{
+ URI.encode_query(%{
+ password: "test",
+ new_password: "newpass",
+ new_password_confirmation: "newpass"
+ })
+ }"
+ )
+
+ assert json_response_and_validate_schema(conn, 200) == %{"status" => "success"}
fetched_user = User.get_cached_by_id(user.id)
assert Pleroma.Password.Pbkdf2.verify_pass("newpass", fetched_user.password_hash) == true
end
|> assign(:token, nil)
|> post("/api/pleroma/delete_account")
- assert json_response(conn, 403) ==
+ assert json_response_and_validate_schema(conn, 403) ==
%{"error" => "Insufficient permissions: write:accounts."}
end
for params <- [%{"password" => "hi"}, %{}] do
ret_conn = post(conn, "/api/pleroma/delete_account", params)
- assert json_response(ret_conn, 200) == %{"error" => "Invalid password."}
+ assert json_response_and_validate_schema(ret_conn, 200) == %{
+ "error" => "Invalid password."
+ }
end
end
test "with proper permissions and valid password", %{conn: conn, user: user} do
- conn = post(conn, "/api/pleroma/delete_account", %{"password" => "test"})
+ conn = post(conn, "/api/pleroma/delete_account?password=test")
ObanHelpers.perform_all()
- assert json_response(conn, 200) == %{"status" => "success"}
+ assert json_response_and_validate_schema(conn, 200) == %{"status" => "success"}
user = User.get_by_id(user.id)
refute user.is_active
# Displaying a warning to prevent unintentional clearing of all but one keys in section
if Keyword.keyword?(temp_setting) and length(temp_setting) == 1 do
Logger.warn(
- "Please change to `clear_config([section]); clear_config([section, key], value)`: " <>
- "#{inspect(config_path)}, #{inspect(temp_setting)}"
+ "Please change `clear_config([section], key: value)` to `clear_config([section, key], value)`"
)
end
# SPDX-License-Identifier: AGPL-3.0-only
defmodule MRFModuleMock do
- @behaviour Pleroma.Web.ActivityPub.MRF
+ @behaviour Pleroma.Web.ActivityPub.MRF.Policy
@impl true
def filter(message), do: {:ok, message}
projects / akkoma / commitdiff