[#1234] Merge remote-tracking branch 'remotes/upstream/develop' into 1234-mastodon...

# Conflicts:
#	lib/pleroma/web/activity_pub/activity_pub_controller.ex
#	lib/pleroma/web/router.ex

diff --cc lib/pleroma/web/activity_pub/activity_pub_controller.ex
index 7047b8254f1d84143537bef37ad915ce321a0752,705dbc1c2bc584981564d8545b5071595b21c761..4dc01a85bee8682629bd0c10a45cc1788bcb206d
--- 1/lib/pleroma/web/activity_pub/activity_pub_controller.ex
--- 2/lib/pleroma/web/activity_pub/activity_pub_controller.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
@@@ -23,11 -23,7 +23,13 @@@ defmodule Pleroma.Web.ActivityPub.Activ
  
    action_fallback(:errors)
  
+   plug(Pleroma.Plugs.Cache, [query_params: false] when action in [:activity, :object])
++
 +  plug(
 +    Pleroma.Plugs.OAuthScopesPlug,
 +    %{scopes: ["read:accounts"]} when action in [:followers, :following]
 +  )
 +
    plug(Pleroma.Web.FederatingPlug when action in [:inbox, :relay])
    plug(:set_requester_reachable when action in [:inbox])
    plug(:relay_active? when action in [:relay])

diff --cc lib/pleroma/web/mastodon_api/controllers/mastodon_api_controller.ex
index 704664f5fa65fe8727a3ed6dd5b04c64309cf626,060137b80e38fe45945c6d8d34892e3830f86c0b..c5632bb5e9e08484ee937a6ea022326b66395e44
--- 1/lib/pleroma/web/mastodon_api/controllers/mastodon_api_controller.ex
--- 2/lib/pleroma/web/mastodon_api/controllers/mastodon_api_controller.ex
+++ b/lib/pleroma/web/mastodon_api/controllers/mastodon_api_controller.ex
@@@ -53,166 -52,6 +53,173 @@@ defmodule Pleroma.Web.MastodonAPI.Masto
    require Logger
    require Pleroma.Constants
  
-     when action in [:user_statuses, :get_status, :get_context, :status_card, :get_poll]
 +  plug(Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug when action != :index)
 +
 +  @unauthenticated_access %{fallback: :proceed_unauthenticated, scopes: []}
 +
 +  plug(
 +    OAuthScopesPlug,
 +    %{scopes: ["read"], skip_instance_privacy_check: true} when action == :index
 +  )
 +
 +  plug(
 +    OAuthScopesPlug,
 +    %{scopes: ["read"]} when action in [:suggestions, :verify_app_credentials]
 +  )
 +
 +  plug(
 +    OAuthScopesPlug,
 +    %{scopes: ["write:accounts"]}
 +    # Note: the following actions are not permission-secured in Mastodon:
 +    when action in [
 +           :put_settings,
 +           :update_avatar,
 +           :update_banner,
 +           :update_background,
 +           :set_mascot
 +         ]
 +  )
 +
 +  plug(
 +    OAuthScopesPlug,
 +    %{scopes: ["write:accounts"]}
 +    when action in [:pin_status, :unpin_status, :update_credentials]
 +  )
 +
 +  plug(
 +    OAuthScopesPlug,
 +    %{scopes: ["read:statuses"]}
 +    when action in [
 +           :conversations,
 +           :scheduled_statuses,
 +           :show_scheduled_status,
 +           :home_timeline,
 +           :dm_timeline
 +         ]
 +  )
 +
 +  plug(
 +    OAuthScopesPlug,
 +    %{@unauthenticated_access | scopes: ["read:statuses"]}
++    when action in [
++           :user_statuses,
++           :get_statuses,
++           :get_status,
++           :get_context,
++           :status_card,
++           :get_poll
++         ]
 +  )
 +
 +  plug(
 +    OAuthScopesPlug,
 +    %{scopes: ["write:statuses"]}
 +    when action in [
 +           :update_scheduled_status,
 +           :delete_scheduled_status,
 +           :post_status,
 +           :delete_status,
 +           :reblog_status,
 +           :unreblog_status,
 +           :poll_vote
 +         ]
 +  )
 +
 +  plug(OAuthScopesPlug, %{scopes: ["write:conversations"]} when action == :conversation_read)
 +
 +  plug(
 +    OAuthScopesPlug,
 +    %{scopes: ["read:accounts"]}
 +    when action in [:endorsements, :verify_credentials, :followers, :following, :get_mascot]
 +  )
 +
 +  plug(
 +    OAuthScopesPlug,
 +    %{@unauthenticated_access | scopes: ["read:accounts"]}
 +    when action in [:user, :favourited_by, :reblogged_by]
 +  )
 +
 +  plug(
 +    OAuthScopesPlug,
 +    %{scopes: ["read:favourites"]} when action in [:favourites, :user_favourites]
 +  )
 +
 +  plug(
 +    OAuthScopesPlug,
 +    %{scopes: ["write:favourites"]} when action in [:fav_status, :unfav_status]
 +  )
 +
 +  plug(OAuthScopesPlug, %{scopes: ["read:filters"]} when action in [:get_filters, :get_filter])
 +
 +  plug(
 +    OAuthScopesPlug,
 +    %{scopes: ["write:filters"]} when action in [:create_filter, :update_filter, :delete_filter]
 +  )
 +
 +  plug(OAuthScopesPlug, %{scopes: ["read:lists"]} when action in [:account_lists, :list_timeline])
 +
 +  plug(OAuthScopesPlug, %{scopes: ["write:media"]} when action in [:upload, :update_media])
 +
 +  plug(
 +    OAuthScopesPlug,
 +    %{scopes: ["read:notifications"]} when action in [:notifications, :get_notification]
 +  )
 +
 +  plug(
 +    OAuthScopesPlug,
 +    %{scopes: ["write:notifications"]}
 +    when action in [:clear_notifications, :dismiss_notification, :destroy_multiple_notifications]
 +  )
 +
 +  plug(
 +    OAuthScopesPlug,
 +    %{scopes: ["write:reports"]}
 +    when action in [:create_report, :report_update_state, :report_respond]
 +  )
 +
 +  plug(
 +    OAuthScopesPlug,
 +    %{scopes: ["follow", "read:blocks"]} when action in [:blocks, :domain_blocks]
 +  )
 +
 +  plug(
 +    OAuthScopesPlug,
 +    %{scopes: ["follow", "write:blocks"]}
 +    when action in [:block, :unblock, :block_domain, :unblock_domain]
 +  )
 +
 +  plug(OAuthScopesPlug, %{scopes: ["read:follows"]} when action == :relationships)
 +  plug(OAuthScopesPlug, %{scopes: ["follow", "read:follows"]} when action == :follow_requests)
 +
 +  plug(
 +    OAuthScopesPlug,
 +    %{scopes: ["follow", "write:follows"]}
 +    when action in [
 +           :follow,
 +           :unfollow,
 +           :subscribe,
 +           :unsubscribe,
 +           :authorize_follow_request,
 +           :reject_follow_request
 +         ]
 +  )
 +
 +  plug(OAuthScopesPlug, %{scopes: ["follow", "read:mutes"]} when action == :mutes)
 +  plug(OAuthScopesPlug, %{scopes: ["follow", "write:mutes"]} when action in [:mute, :unmute])
 +
 +  plug(
 +    OAuthScopesPlug,
 +    %{scopes: ["write:mutes"]} when action in [:mute_conversation, :unmute_conversation]
 +  )
 +
 +  # Note: scopes not present in Mastodon: read:bookmarks, write:bookmarks
 +  plug(OAuthScopesPlug, %{scopes: ["read:bookmarks"]} when action == :bookmarks)
 +
 +  plug(
 +    OAuthScopesPlug,
 +    %{scopes: ["write:bookmarks"]} when action in [:bookmark_status, :unbookmark_status]
 +  )
 +
    @rate_limited_relations_actions ~w(follow unfollow)a
  
    @rate_limited_status_actions ~w(reblog_status unreblog_status fav_status unfav_status

diff --cc lib/pleroma/web/pleroma_api/pleroma_api_controller.ex
Simple merge

diff --cc lib/pleroma/web/router.ex
index 593da01fd555666fa28d0c7aaa1925ba4cd57a47,b0464037e83ab03dadd11ab3839a96b0b4cb12db..0b41eb2e0b68bc68f62e8fd69c75c6bf8186efdc
--- 1/lib/pleroma/web/router.ex
--- 2/lib/pleroma/web/router.ex
+++ b/lib/pleroma/web/router.ex
@@@ -192,13 -221,22 +192,14 @@@ defmodule Pleroma.Web.Router d
    scope "/api/pleroma", Pleroma.Web.TwitterAPI do
      pipe_through(:authenticated_api)
  
 -    scope [] do
 -      pipe_through(:oauth_write)
 -
 -      post("/change_email", UtilController, :change_email)
 -      post("/change_password", UtilController, :change_password)
 -      post("/delete_account", UtilController, :delete_account)
 -      put("/notification_settings", UtilController, :update_notificaton_settings)
 -      post("/disable_account", UtilController, :disable_account)
 -    end
++    post("/change_email", UtilController, :change_email)
 +    post("/change_password", UtilController, :change_password)
 +    post("/delete_account", UtilController, :delete_account)
 +    put("/notification_settings", UtilController, :update_notificaton_settings)
 +    post("/disable_account", UtilController, :disable_account)
  
 -    scope [] do
 -      pipe_through(:oauth_follow)
 -
 -      post("/blocks_import", UtilController, :blocks_import)
 -      post("/follow_import", UtilController, :follow_import)
 -    end
 +    post("/blocks_import", UtilController, :blocks_import)
 +    post("/follow_import", UtilController, :follow_import)
    end
  
    scope "/oauth", Pleroma.Web.OAuth do
@@@ -360,48 -414,51 +361,46 @@@
    scope "/api/v1", Pleroma.Web.MastodonAPI do
      pipe_through(:api)
  
--    post("/accounts", MastodonAPIController, :account_register)
--
      get("/instance", MastodonAPIController, :masto_instance)
      get("/instance/peers", MastodonAPIController, :peers)
++
      post("/apps", MastodonAPIController, :create_app)
      get("/apps/verify_credentials", MastodonAPIController, :verify_app_credentials)
--    get("/custom_emojis", MastodonAPIController, :custom_emojis)
- 
-     get("/statuses/:id/card", MastodonAPIController, :status_card)
  
 -    get("/statuses/:id/card", MastodonAPIController, :status_card)
 -
--    get("/statuses/:id/favourited_by", MastodonAPIController, :favourited_by)
--    get("/statuses/:id/reblogged_by", MastodonAPIController, :reblogged_by)
++    get("/custom_emojis", MastodonAPIController, :custom_emojis)
  
      get("/trends", MastodonAPIController, :empty_array)
  
      get("/accounts/search", SearchController, :account_search)
  
--    post(
--      "/pleroma/accounts/confirmation_resend",
--      MastodonAPIController,
--      :account_confirmation_resend
--    )
--
 -    scope [] do
 -      pipe_through(:oauth_read_or_public)
 +    get("/timelines/public", MastodonAPIController, :public_timeline)
 +    get("/timelines/tag/:tag", MastodonAPIController, :hashtag_timeline)
- 
-     get("/pleroma/accounts/:id/favourites", MastodonAPIController, :user_favourites)
- 
-     get("/search", SearchController, :search)
++    get("/timelines/list/:list_id", MastodonAPIController, :list_timeline)
  
 -      get("/timelines/public", MastodonAPIController, :public_timeline)
 -      get("/timelines/tag/:tag", MastodonAPIController, :hashtag_timeline)
 -      get("/timelines/list/:list_id", MastodonAPIController, :list_timeline)
 +    get("/polls/:id", MastodonAPIController, :get_poll)
  
 -      get("/statuses", MastodonAPIController, :get_statuses)
 -      get("/statuses/:id", MastodonAPIController, :get_status)
 -      get("/statuses/:id/context", MastodonAPIController, :get_context)
++    post("/accounts", MastodonAPIController, :account_register)
++    get("/accounts/:id", MastodonAPIController, :user)
 +    get("/accounts/:id/followers", MastodonAPIController, :followers)
 +    get("/accounts/:id/following", MastodonAPIController, :following)
++    get("/accounts/:id/statuses", MastodonAPIController, :user_statuses)
  
-     get("/timelines/list/:list_id", MastodonAPIController, :list_timeline)
- 
-     get("/accounts/:id", MastodonAPIController, :user)
 -      get("/polls/:id", MastodonAPIController, :get_poll)
++    get("/search", SearchController, :search)
  
-     get("/accounts/:id/statuses", MastodonAPIController, :user_statuses)
 -      get("/accounts/:id/statuses", MastodonAPIController, :user_statuses)
 -      get("/accounts/:id/followers", MastodonAPIController, :followers)
 -      get("/accounts/:id/following", MastodonAPIController, :following)
 -      get("/accounts/:id", MastodonAPIController, :user)
++    get("/statuses", MastodonAPIController, :get_statuses)
 +    get("/statuses/:id", MastodonAPIController, :get_status)
 +    get("/statuses/:id/context", MastodonAPIController, :get_context)
++    get("/statuses/:id/card", MastodonAPIController, :status_card)
++    get("/statuses/:id/favourited_by", MastodonAPIController, :favourited_by)
++    get("/statuses/:id/reblogged_by", MastodonAPIController, :reblogged_by)
+ 
 -      get("/search", SearchController, :search)
++    get("/pleroma/accounts/:id/favourites", MastodonAPIController, :user_favourites)
+ 
 -      get("/pleroma/accounts/:id/favourites", MastodonAPIController, :user_favourites)
 -    end
++    post(
++      "/pleroma/accounts/confirmation_resend",
++      MastodonAPIController,
++      :account_confirmation_resend
++    )
    end
  
    scope "/api/v2", Pleroma.Web.MastodonAPI do

diff --cc lib/pleroma/web/twitter_api/controllers/util_controller.ex
index 82ed0c287c952c5b84e3a50b5d086c4d0b34f540,867787c57303257f8730e9946f21444befbd9801..644a0ae6b5964c3aa12ccb797520bbdc4e21f562
--- 1/lib/pleroma/web/twitter_api/controllers/util_controller.ex
--- 2/lib/pleroma/web/twitter_api/controllers/util_controller.ex
+++ b/lib/pleroma/web/twitter_api/controllers/util_controller.ex
@@@ -19,25 -18,6 +19,26 @@@ defmodule Pleroma.Web.TwitterAPI.UtilCo
    alias Pleroma.Web.CommonAPI
    alias Pleroma.Web.WebFinger
  
 +  plug(
 +    OAuthScopesPlug,
 +    %{scopes: ["follow", "write:follows"]}
 +    when action in [:do_remote_follow, :follow_import]
 +  )
 +
 +  plug(OAuthScopesPlug, %{scopes: ["follow", "write:blocks"]} when action == :blocks_import)
 +
 +  plug(
 +    OAuthScopesPlug,
 +    %{scopes: ["write:accounts"]}
 +    when action in [
++           :change_email,
 +           :change_password,
 +           :delete_account,
 +           :update_notificaton_settings,
 +           :disable_account
 +         ]
 +  )
 +
    plug(Pleroma.Plugs.SetFormatPlug when action in [:config, :version])
  
    def help_test(conn, _params) do

diff --cc test/web/twitter_api/util_controller_test.exs
Simple merge