summaryrefslogtreecommitdiff
path: root/lib/pleroma
diff options
context:
space:
mode:
Diffstat (limited to 'lib/pleroma')
-rw-r--r--lib/pleroma/following_relationship.ex2
-rw-r--r--lib/pleroma/object.ex2
-rw-r--r--lib/pleroma/plugs/admin_secret_authentication_plug.ex22
-rw-r--r--lib/pleroma/plugs/oauth_plug.ex2
-rw-r--r--lib/pleroma/plugs/user_enabled_plug.ex10
-rw-r--r--lib/pleroma/user.ex90
-rw-r--r--lib/pleroma/user/search.ex5
-rw-r--r--lib/pleroma/web/activity_pub/mrf/object_age_policy.ex101
-rw-r--r--lib/pleroma/web/activity_pub/relay.ex1
-rw-r--r--lib/pleroma/web/mastodon_api/controllers/account_controller.ex2
-rw-r--r--lib/pleroma/web/nodeinfo/nodeinfo_controller.ex6
-rw-r--r--lib/pleroma/web/router.ex1
12 files changed, 192 insertions, 52 deletions
diff --git a/lib/pleroma/following_relationship.ex b/lib/pleroma/following_relationship.ex
index 2ffac17ee..3aff9fb76 100644
--- a/lib/pleroma/following_relationship.ex
+++ b/lib/pleroma/following_relationship.ex
@@ -101,7 +101,7 @@ defmodule Pleroma.FollowingRelationship do
|> select([r, u], u.follower_address)
|> Repo.all()
- if not user.local or user.nickname in [nil, "internal.fetch"] do
+ if not user.local or user.invisible do
following
else
[user.follower_address | following]
diff --git a/lib/pleroma/object.ex b/lib/pleroma/object.ex
index d9b41d710..cde0eddd9 100644
--- a/lib/pleroma/object.ex
+++ b/lib/pleroma/object.ex
@@ -63,7 +63,7 @@ defmodule Pleroma.Object do
end
defp warn_on_no_object_preloaded(ap_id) do
- "Object.normalize() called without preloaded object (#{ap_id}). Consider preloading the object"
+ "Object.normalize() called without preloaded object (#{inspect(ap_id)}). Consider preloading the object"
|> Logger.debug()
Logger.debug("Backtrace: #{inspect(Process.info(:erlang.self(), :current_stacktrace))}")
diff --git a/lib/pleroma/plugs/admin_secret_authentication_plug.ex b/lib/pleroma/plugs/admin_secret_authentication_plug.ex
index fdadd476e..49dea452d 100644
--- a/lib/pleroma/plugs/admin_secret_authentication_plug.ex
+++ b/lib/pleroma/plugs/admin_secret_authentication_plug.ex
@@ -16,14 +16,28 @@ defmodule Pleroma.Plugs.AdminSecretAuthenticationPlug do
def call(%{assigns: %{user: %User{}}} = conn, _), do: conn
- def call(%{params: %{"admin_token" => admin_token}} = conn, _) do
- if secret_token() && admin_token == secret_token() do
+ def call(conn, _) do
+ if secret_token() do
+ authenticate(conn)
+ else
conn
- |> assign(:user, %User{is_admin: true})
+ end
+ end
+
+ def authenticate(%{params: %{"admin_token" => admin_token}} = conn) do
+ if admin_token == secret_token() do
+ assign(conn, :user, %User{is_admin: true})
else
conn
end
end
- def call(conn, _), do: conn
+ def authenticate(conn) do
+ token = secret_token()
+
+ case get_req_header(conn, "x-admin-token") do
+ [^token] -> assign(conn, :user, %User{is_admin: true})
+ _ -> conn
+ end
+ end
end
diff --git a/lib/pleroma/plugs/oauth_plug.ex b/lib/pleroma/plugs/oauth_plug.ex
index fd004fcd2..11a5b7642 100644
--- a/lib/pleroma/plugs/oauth_plug.ex
+++ b/lib/pleroma/plugs/oauth_plug.ex
@@ -71,7 +71,7 @@ defmodule Pleroma.Plugs.OAuthPlug do
)
# credo:disable-for-next-line Credo.Check.Readability.MaxLineLength
- with %Token{user: %{deactivated: false} = user} = token_record <- Repo.one(query) do
+ with %Token{user: user} = token_record <- Repo.one(query) do
{:ok, user, token_record}
end
end
diff --git a/lib/pleroma/plugs/user_enabled_plug.ex b/lib/pleroma/plugs/user_enabled_plug.ex
index fbb4bf115..8d102ee5b 100644
--- a/lib/pleroma/plugs/user_enabled_plug.ex
+++ b/lib/pleroma/plugs/user_enabled_plug.ex
@@ -10,9 +10,13 @@ defmodule Pleroma.Plugs.UserEnabledPlug do
options
end
- def call(%{assigns: %{user: %User{deactivated: true}}} = conn, _) do
- conn
- |> assign(:user, nil)
+ def call(%{assigns: %{user: %User{} = user}} = conn, _) do
+ if User.auth_active?(user) do
+ conn
+ else
+ conn
+ |> assign(:user, nil)
+ end
end
def call(conn, _) do
diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index f1830509c..3010fe87f 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -67,8 +67,7 @@ defmodule Pleroma.User do
field(:source_data, :map, default: %{})
field(:note_count, :integer, default: 0)
field(:follower_count, :integer, default: 0)
- # Should be filled in only for remote users
- field(:following_count, :integer, default: nil)
+ field(:following_count, :integer, default: 0)
field(:locked, :boolean, default: false)
field(:confirmation_pending, :boolean, default: false)
field(:password_reset_pending, :boolean, default: false)
@@ -124,6 +123,9 @@ defmodule Pleroma.User do
timestamps()
end
+ @doc "Returns if the user should be allowed to authenticate"
+ def auth_active?(%User{deactivated: true}), do: false
+
def auth_active?(%User{confirmation_pending: true}),
do: !Pleroma.Config.get([:instance, :account_activation_required])
@@ -131,6 +133,8 @@ defmodule Pleroma.User do
def visible_for?(user, for_user \\ nil)
+ def visible_for?(%User{invisible: true}, _), do: false
+
def visible_for?(%User{id: user_id}, %User{id: for_id}) when user_id == for_id, do: true
def visible_for?(%User{} = user, for_user) do
@@ -174,19 +178,17 @@ defmodule Pleroma.User do
def ap_following(%User{} = user), do: "#{ap_id(user)}/following"
def user_info(%User{} = user, args \\ %{}) do
- following_count =
- Map.get(args, :following_count, user.following_count || following_count(user))
-
+ following_count = Map.get(args, :following_count, user.following_count)
follower_count = Map.get(args, :follower_count, user.follower_count)
%{
note_count: user.note_count,
locked: user.locked,
confirmation_pending: user.confirmation_pending,
- default_scope: user.default_scope
+ default_scope: user.default_scope,
+ follower_count: follower_count,
+ following_count: following_count
}
- |> Map.put(:following_count, following_count)
- |> Map.put(:follower_count, follower_count)
end
def follow_state(%User{} = user, %User{} = target) do
@@ -523,14 +525,9 @@ defmodule Pleroma.User do
@doc "A mass follow for local users. Respects blocks in both directions but does not create activities."
@spec follow_all(User.t(), list(User.t())) :: {atom(), User.t()}
def follow_all(follower, followeds) do
- followeds =
- Enum.reject(followeds, fn followed ->
- blocks?(follower, followed) || blocks?(followed, follower)
- end)
-
- Enum.each(followeds, &follow(follower, &1, "accept"))
-
- Enum.each(followeds, &update_follower_count/1)
+ followeds
+ |> Enum.reject(fn followed -> blocks?(follower, followed) || blocks?(followed, follower) end)
+ |> Enum.each(&follow(follower, &1, "accept"))
set_cache(follower)
end
@@ -550,11 +547,11 @@ defmodule Pleroma.User do
true ->
FollowingRelationship.follow(follower, followed, state)
- follower = maybe_update_following_count(follower)
-
{:ok, _} = update_follower_count(followed)
- set_cache(follower)
+ follower
+ |> update_following_count()
+ |> set_cache()
end
end
@@ -562,11 +559,12 @@ defmodule Pleroma.User do
if following?(follower, followed) and follower.ap_id != followed.ap_id do
FollowingRelationship.unfollow(follower, followed)
- follower = maybe_update_following_count(follower)
-
{:ok, followed} = update_follower_count(followed)
- set_cache(follower)
+ {:ok, follower} =
+ follower
+ |> update_following_count()
+ |> set_cache()
{:ok, follower, Utils.fetch_latest_follow(follower, followed)}
else
@@ -896,8 +894,8 @@ defmodule Pleroma.User do
end
end
- @spec maybe_update_following_count(User.t()) :: User.t()
- def maybe_update_following_count(%User{local: false} = user) do
+ @spec update_following_count(User.t()) :: User.t()
+ def update_following_count(%User{local: false} = user) do
if Pleroma.Config.get([:instance, :external_user_synchronization]) do
maybe_fetch_follow_information(user)
else
@@ -905,7 +903,13 @@ defmodule Pleroma.User do
end
end
- def maybe_update_following_count(user), do: user
+ def update_following_count(%User{local: true} = user) do
+ following_count = FollowingRelationship.following_count(user)
+
+ user
+ |> follow_information_changeset(%{following_count: following_count})
+ |> Repo.update!()
+ end
def set_unread_conversation_count(%User{local: true} = user) do
unread_query = Participation.unread_conversation_count_for_user(user)
@@ -1098,7 +1102,12 @@ defmodule Pleroma.User do
def deactivate(%User{} = user, status) do
with {:ok, user} <- set_activation_status(user, status) do
- Enum.each(get_followers(user), &invalidate_cache/1)
+ user
+ |> get_followers()
+ |> Enum.filter(& &1.local)
+ |> Enum.each(fn follower ->
+ follower |> update_following_count() |> set_cache()
+ end)
# Only update local user counts, remote will be update during the next pull.
user
@@ -1318,22 +1327,23 @@ defmodule Pleroma.User do
end
end
- @doc "Creates an internal service actor by URI if missing. Optionally takes nickname for addressing."
+ @doc """
+ Creates an internal service actor by URI if missing.
+ Optionally takes nickname for addressing.
+ """
def get_or_create_service_actor_by_ap_id(uri, nickname \\ nil) do
- with %User{} = user <- get_cached_by_ap_id(uri) do
- user
- else
- _ ->
- {:ok, user} =
- %User{}
- |> cast(%{}, [:ap_id, :nickname, :local])
- |> put_change(:ap_id, uri)
- |> put_change(:nickname, nickname)
- |> put_change(:local, true)
- |> put_change(:follower_address, uri <> "/followers")
- |> Repo.insert()
+ with user when is_nil(user) <- get_cached_by_ap_id(uri) do
+ {:ok, user} =
+ %User{
+ invisible: true,
+ local: true,
+ ap_id: uri,
+ nickname: nickname,
+ follower_address: uri <> "/followers"
+ }
+ |> Repo.insert()
- user
+ user
end
end
diff --git a/lib/pleroma/user/search.ex b/lib/pleroma/user/search.ex
index 09664db76..b1bb9d4da 100644
--- a/lib/pleroma/user/search.ex
+++ b/lib/pleroma/user/search.ex
@@ -45,6 +45,7 @@ defmodule Pleroma.User.Search do
for_user
|> base_query(following)
|> filter_blocked_user(for_user)
+ |> filter_invisible_users()
|> filter_blocked_domains(for_user)
|> fts_search(query_string)
|> trigram_rank(query_string)
@@ -98,6 +99,10 @@ defmodule Pleroma.User.Search do
defp base_query(_user, false), do: User
defp base_query(user, true), do: User.get_followers_query(user)
+ defp filter_invisible_users(query) do
+ from(q in query, where: q.invisible == false)
+ end
+
defp filter_blocked_user(query, %User{blocks: blocks})
when length(blocks) > 0 do
from(q in query, where: not (q.ap_id in ^blocks))
diff --git a/lib/pleroma/web/activity_pub/mrf/object_age_policy.ex b/lib/pleroma/web/activity_pub/mrf/object_age_policy.ex
new file mode 100644
index 000000000..8b36c1021
--- /dev/null
+++ b/lib/pleroma/web/activity_pub/mrf/object_age_policy.ex
@@ -0,0 +1,101 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ActivityPub.MRF.ObjectAgePolicy do
+ alias Pleroma.Config
+ alias Pleroma.User
+ alias Pleroma.Web.ActivityPub.MRF
+
+ require Pleroma.Constants
+
+ @moduledoc "Filter activities depending on their age"
+ @behaviour MRF
+
+ defp check_date(%{"published" => published} = message) do
+ with %DateTime{} = now <- DateTime.utc_now(),
+ {:ok, %DateTime{} = then, _} <- DateTime.from_iso8601(published),
+ max_ttl <- Config.get([:mrf_object_age, :threshold]),
+ {:ttl, false} <- {:ttl, DateTime.diff(now, then) > max_ttl} do
+ {:ok, message}
+ else
+ {:ttl, true} ->
+ {:reject, nil}
+
+ e ->
+ {:error, e}
+ end
+ end
+
+ defp check_reject(message, actions) do
+ if :reject in actions do
+ {:reject, nil}
+ else
+ {:ok, message}
+ end
+ end
+
+ defp check_delist(message, actions) do
+ if :delist in actions do
+ with %User{} = user <- User.get_cached_by_ap_id(message["actor"]) do
+ to = List.delete(message["to"], Pleroma.Constants.as_public()) ++ [user.follower_address]
+ cc = List.delete(message["cc"], user.follower_address) ++ [Pleroma.Constants.as_public()]
+
+ message =
+ message
+ |> Map.put("to", to)
+ |> Map.put("cc", cc)
+
+ {:ok, message}
+ else
+ # Unhandleable error: somebody is messing around, just drop the message.
+ _e ->
+ {:reject, nil}
+ end
+ else
+ {:ok, message}
+ end
+ end
+
+ defp check_strip_followers(message, actions) do
+ if :strip_followers in actions do
+ with %User{} = user <- User.get_cached_by_ap_id(message["actor"]) do
+ to = List.delete(message["to"], user.follower_address)
+ cc = List.delete(message["cc"], user.follower_address)
+
+ message =
+ message
+ |> Map.put("to", to)
+ |> Map.put("cc", cc)
+
+ {:ok, message}
+ else
+ # Unhandleable error: somebody is messing around, just drop the message.
+ _e ->
+ {:reject, nil}
+ end
+ else
+ {:ok, message}
+ end
+ end
+
+ @impl true
+ def filter(%{"type" => "Create", "published" => _} = message) do
+ with actions <- Config.get([:mrf_object_age, :actions]),
+ {:reject, _} <- check_date(message),
+ {:ok, message} <- check_reject(message, actions),
+ {:ok, message} <- check_delist(message, actions),
+ {:ok, message} <- check_strip_followers(message, actions) do
+ {:ok, message}
+ else
+ # check_date() is allowed to short-circuit the pipeline
+ e -> e
+ end
+ end
+
+ @impl true
+ def filter(message), do: {:ok, message}
+
+ @impl true
+ def describe, do: {:ok, %{}}
+end
diff --git a/lib/pleroma/web/activity_pub/relay.ex b/lib/pleroma/web/activity_pub/relay.ex
index fc2619680..99a804568 100644
--- a/lib/pleroma/web/activity_pub/relay.ex
+++ b/lib/pleroma/web/activity_pub/relay.ex
@@ -14,7 +14,6 @@ defmodule Pleroma.Web.ActivityPub.Relay do
relay_ap_id()
|> User.get_or_create_service_actor_by_ap_id()
- {:ok, actor} = User.set_invisible(actor, true)
actor
end
diff --git a/lib/pleroma/web/mastodon_api/controllers/account_controller.ex b/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
index 5b01b964b..5f2544640 100644
--- a/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
+++ b/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
@@ -238,7 +238,7 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
@doc "GET /api/v1/accounts/:id"
def show(%{assigns: %{user: for_user}} = conn, %{"id" => nickname_or_id}) do
with %User{} = user <- User.get_cached_by_nickname_or_id(nickname_or_id, for: for_user),
- true <- User.auth_active?(user) || user.id == for_user.id || User.superuser?(for_user) do
+ true <- User.visible_for?(user, for_user) do
render(conn, "show.json", user: user, for: for_user)
else
_e -> render_error(conn, :not_found, "Can't find user")
diff --git a/lib/pleroma/web/nodeinfo/nodeinfo_controller.ex b/lib/pleroma/web/nodeinfo/nodeinfo_controller.ex
index 486b9f6a4..abcf46034 100644
--- a/lib/pleroma/web/nodeinfo/nodeinfo_controller.ex
+++ b/lib/pleroma/web/nodeinfo/nodeinfo_controller.ex
@@ -120,6 +120,12 @@ defmodule Pleroma.Web.Nodeinfo.NodeinfoController do
banner: Config.get([:instance, :banner_upload_limit]),
background: Config.get([:instance, :background_upload_limit])
},
+ fieldsLimits: %{
+ maxFields: Config.get([:instance, :max_account_fields]),
+ maxRemoteFields: Config.get([:instance, :max_remote_account_fields]),
+ nameLength: Config.get([:instance, :account_field_name_length]),
+ valueLength: Config.get([:instance, :account_field_value_length])
+ },
accountActivationRequired: Config.get([:instance, :account_activation_required], false),
invitesEnabled: Config.get([:instance, :invites_enabled], false),
mailerEnabled: Config.get([Pleroma.Emails.Mailer, :enabled], false),
diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
index b654d00c7..0b54f4ab7 100644
--- a/lib/pleroma/web/router.ex
+++ b/lib/pleroma/web/router.ex
@@ -13,6 +13,7 @@ defmodule Pleroma.Web.Router do
pipeline :oauth do
plug(:fetch_session)
plug(Pleroma.Plugs.OAuthPlug)
+ plug(Pleroma.Plugs.UserEnabledPlug)
end
pipeline :api do
generated by cgit v1.2.3 (git 2.25.1) at 2025-04-25 15:45:17 +0000