From: Egor Kislitsyn <egor@kislitsyn.com>
Date: Tue, 5 May 2020 10:28:54 +0000 (+0400)
Subject: Merge branch 'develop' into global-status-expiration
X-Git-Url: https://git.squeep.com/?a=commitdiff_plain;h=decaa64f75f8bd69622fa5fba757f99719f09808;p=akkoma

Merge branch 'develop' into global-status-expiration
---

decaa64f75f8bd69622fa5fba757f99719f09808
diff --cc CHANGELOG.md
index 2d969e504,522285efe..9a38e4c11
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@@ -27,11 -36,13 +36,16 @@@ The format is based on [Keep a Changelo
  - Support pagination in conversations API
  - **Breaking**: SimplePolicy `:reject` and `:accept` allow deletions again
  - Fix follower/blocks import when nicknames starts with @
+ - Filtering of push notifications on activities from blocked domains
  
 +### Changed
 +- MFR policy to set global expiration for all local Create activities
 +
  ## [unreleased-patch]
+ ### Security
+ - Disallow re-registration of previously deleted users, which allowed viewing direct messages addressed to them
+ - Mastodon API: Fix `POST /api/v1/follow_requests/:id/authorize` allowing to force a follow from a local user even if they didn't request to follow
+ 
  ### Fixed
  - Logger configuration through AdminFE
  - HTTP Basic Authentication permissions issue
diff --cc test/web/activity_pub/activity_pub_test.exs
index 7f864eb53,84ead93bb..8d2e9844b
--- a/test/web/activity_pub/activity_pub_test.exs
+++ b/test/web/activity_pub/activity_pub_test.exs
@@@ -2404,19 -2405,50 +2405,66 @@@ defmodule Pleroma.Web.ActivityPub.Activ
       u4: %{r1: r4_1.id}}
    end
  
+   describe "maybe_update_follow_information/1" do
+     setup do
+       clear_config([:instance, :external_user_synchronization], true)
+ 
+       user = %{
+         local: false,
+         ap_id: "https://gensokyo.2hu/users/raymoo",
+         following_address: "https://gensokyo.2hu/users/following",
+         follower_address: "https://gensokyo.2hu/users/followers",
+         type: "Person"
+       }
+ 
+       %{user: user}
+     end
+ 
+     test "logs an error when it can't fetch the info", %{user: user} do
+       assert capture_log(fn ->
+                ActivityPub.maybe_update_follow_information(user)
+              end) =~ "Follower/Following counter update for #{user.ap_id} failed"
+     end
+ 
+     test "just returns the input if the user type is Application", %{
+       user: user
+     } do
+       user =
+         user
+         |> Map.put(:type, "Application")
+ 
+       refute capture_log(fn ->
+                assert ^user = ActivityPub.maybe_update_follow_information(user)
+              end) =~ "Follower/Following counter update for #{user.ap_id} failed"
+     end
+ 
+     test "it just returns the input if the user has no following/follower addresses", %{
+       user: user
+     } do
+       user =
+         user
+         |> Map.put(:following_address, nil)
+         |> Map.put(:follower_address, nil)
+ 
+       refute capture_log(fn ->
+                assert ^user = ActivityPub.maybe_update_follow_information(user)
+              end) =~ "Follower/Following counter update for #{user.ap_id} failed"
+     end
+   end
++
 +  describe "global activity expiration" do
 +    setup do: clear_config([:instance, :rewrite_policy])
 +
 +    test "creates an activity expiration for local Create activities" do
 +      Pleroma.Config.put(
 +        [:instance, :rewrite_policy],
 +        Pleroma.Web.ActivityPub.MRF.ActivityExpirationPolicy
 +      )
 +
 +      {:ok, %{id: id_create}} = ActivityBuilder.insert(%{"type" => "Create", "context" => "3hu"})
 +      {:ok, _follow} = ActivityBuilder.insert(%{"type" => "Follow", "context" => "3hu"})
 +
 +      assert [%{activity_id: ^id_create}] = Pleroma.ActivityExpiration |> Repo.all()
 +    end
 +  end
  end