diff options
Diffstat (limited to 'lib')
50 files changed, 1596 insertions, 918 deletions
diff --git a/lib/pleroma/activity.ex b/lib/pleroma/activity.ex index cdfe7ea9e..66854dc2d 100644 --- a/lib/pleroma/activity.ex +++ b/lib/pleroma/activity.ex @@ -113,4 +113,14 @@ defmodule Pleroma.Activity do end def mastodon_notification_type(%Activity{}), do: nil + + def all_by_actor_and_id(actor, status_ids \\ []) + def all_by_actor_and_id(_actor, []), do: [] + + def all_by_actor_and_id(actor, status_ids) do + Activity + |> where([s], s.id in ^status_ids) + |> where([s], s.actor == ^actor) + |> Repo.all() + end end diff --git a/lib/pleroma/emails/admin_email.ex b/lib/pleroma/emails/admin_email.ex new file mode 100644 index 000000000..9b20c7e08 --- /dev/null +++ b/lib/pleroma/emails/admin_email.ex @@ -0,0 +1,63 @@ +# Pleroma: A lightweight social networking server +# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/> +# SPDX-License-Identifier: AGPL-3.0-only + +defmodule Pleroma.AdminEmail do + @moduledoc "Admin emails" + + import Swoosh.Email + + alias Pleroma.Web.Router.Helpers + + defp instance_config, do: Pleroma.Config.get(:instance) + defp instance_name, do: instance_config()[:name] + defp instance_email, do: instance_config()[:email] + + defp user_url(user) do + Helpers.o_status_url(Pleroma.Web.Endpoint, :feed_redirect, user.nickname) + end + + def report(to, reporter, account, statuses, comment) do + comment_html = + if comment do + "<p>Comment: #{comment}" + else + "" + end + + statuses_html = + if length(statuses) > 0 do + statuses_list_html = + statuses + |> Enum.map(fn %{id: id} -> + status_url = Helpers.o_status_url(Pleroma.Web.Endpoint, :notice, id) + "<li><a href=\"#{status_url}\">#{status_url}</li>" + end) + |> Enum.join("\n") + + """ + <p> Statuses: + <ul> + #{statuses_list_html} + </ul> + </p> + """ + else + "" + end + + html_body = """ + <p>Reported by: <a href="#{user_url(reporter)}">#{reporter.nickname}</a></p> + <p>Reported Account: <a href="#{user_url(account)}">#{account.nickname}</a></p> + #{comment_html} + #{statuses_html} + """ + + new() + |> to({to.name, to.email}) + |> from({instance_name(), instance_email()}) + |> reply_to({reporter.name, reporter.email}) + |> subject("#{instance_name()} Report") + |> html_body(html_body) + end +end diff --git a/lib/pleroma/emails/mailer.ex b/lib/pleroma/emails/mailer.ex index 8d12641f2..f7e3aa78b 100644 --- a/lib/pleroma/emails/mailer.ex +++ b/lib/pleroma/emails/mailer.ex @@ -4,4 +4,10 @@ defmodule Pleroma.Mailer do use Swoosh.Mailer, otp_app: :pleroma + + def deliver_async(email, config \\ []) do + Pleroma.Jobs.enqueue(:mailer, __MODULE__, [:deliver_async, email, config]) + end + + def perform(:deliver_async, email, config), do: deliver(email, config) end diff --git a/lib/pleroma/formatter.ex b/lib/pleroma/formatter.ex index f31aafa0d..048c032ed 100644 --- a/lib/pleroma/formatter.ex +++ b/lib/pleroma/formatter.ex @@ -8,33 +8,51 @@ defmodule Pleroma.Formatter do alias Pleroma.User alias Pleroma.Web.MediaProxy - @tag_regex ~r/((?<=[^&])|\A)(\#)(\w+)/u @markdown_characters_regex ~r/(`|\*|_|{|}|[|]|\(|\)|#|\+|-|\.|!)/ + @link_regex ~r{((?:http(s)?:\/\/)?[\w.-]+(?:\.[\w\.-]+)+[\w\-\._~%:/?#[\]@!\$&'\(\)\*\+,;=.]+)|[0-9a-z+\-\.]+:[0-9a-z$-_.+!*'(),]+}ui - # Modified from https://www.w3.org/TR/html5/forms.html#valid-e-mail-address - @mentions_regex ~r/@[a-zA-Z0-9.!#$%&'*+\/=?^_`{|}~-]*@?[a-zA-Z0-9_-](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*/u - - def parse_tags(text, data \\ %{}) do - Regex.scan(@tag_regex, text) - |> Enum.map(fn ["#" <> tag = full_tag | _] -> {full_tag, String.downcase(tag)} end) - |> (fn map -> - if data["sensitive"] in [true, "True", "true", "1"], - do: [{"#nsfw", "nsfw"}] ++ map, - else: map - end).() + @auto_linker_config hashtag: true, + hashtag_handler: &Pleroma.Formatter.hashtag_handler/4, + mention: true, + mention_handler: &Pleroma.Formatter.mention_handler/4 + + def mention_handler("@" <> nickname, buffer, opts, acc) do + case User.get_cached_by_nickname(nickname) do + %User{id: id} = user -> + ap_id = get_ap_id(user) + nickname_text = get_nickname_text(nickname, opts) |> maybe_escape(opts) + + link = + "<span class='h-card'><a data-user='#{id}' class='u-url mention' href='#{ap_id}'>@<span>#{ + nickname_text + }</span></a></span>" + + {link, %{acc | mentions: MapSet.put(acc.mentions, {"@" <> nickname, user})}} + + _ -> + {buffer, acc} + end end - @doc "Parses mentions text and returns list {nickname, user}." - @spec parse_mentions(binary()) :: list({binary(), User.t()}) - def parse_mentions(text) do - Regex.scan(@mentions_regex, text) - |> List.flatten() - |> Enum.uniq() - |> Enum.map(fn nickname -> - with nickname <- String.trim_leading(nickname, "@"), - do: {"@" <> nickname, User.get_cached_by_nickname(nickname)} - end) - |> Enum.filter(fn {_match, user} -> user end) + def hashtag_handler("#" <> tag = tag_text, _buffer, _opts, acc) do + tag = String.downcase(tag) + url = "#{Pleroma.Web.base_url()}/tag/#{tag}" + link = "<a class='hashtag' data-tag='#{tag}' href='#{url}' rel='tag'>#{tag_text}</a>" + + {link, %{acc | tags: MapSet.put(acc.tags, {tag_text, tag})}} + end + + @doc """ + Parses a text and replace plain text links with HTML. Returns a tuple with a result text, mentions, and hashtags. + """ + @spec linkify(String.t(), keyword()) :: + {String.t(), [{String.t(), User.t()}], [{String.t(), String.t()}]} + def linkify(text, options \\ []) do + options = options ++ @auto_linker_config + acc = %{mentions: MapSet.new(), tags: MapSet.new()} + {text, %{mentions: mentions, tags: tags}} = AutoLinker.link_map(text, acc, options) + + {text, MapSet.to_list(mentions), MapSet.to_list(tags)} end def emojify(text) do @@ -48,9 +66,7 @@ defmodule Pleroma.Formatter do emoji = HTML.strip_tags(emoji) file = HTML.strip_tags(file) - String.replace( - text, - ":#{emoji}:", + html = if not strip do "<img height='32px' width='32px' alt='#{emoji}' title='#{emoji}' src='#{ MediaProxy.url(file) @@ -58,8 +74,8 @@ defmodule Pleroma.Formatter do else "" end - ) - |> HTML.filter_tags() + + String.replace(text, ":#{emoji}:", html) |> HTML.filter_tags() end) end @@ -75,12 +91,10 @@ defmodule Pleroma.Formatter do def get_emoji(_), do: [] - @link_regex ~r/[0-9a-z+\-\.]+:[0-9a-z$-_.+!*'(),]+/ui - - @uri_schemes Application.get_env(:pleroma, :uri_schemes, []) - @valid_schemes Keyword.get(@uri_schemes, :valid_schemes, []) + def html_escape({text, mentions, hashtags}, type) do + {html_escape(text, type), mentions, hashtags} + end - # TODO: make it use something other than @link_regex def html_escape(text, "text/html") do HTML.filter_tags(text) end @@ -94,112 +108,6 @@ defmodule Pleroma.Formatter do |> Enum.join("") end - @doc """ - Escapes a special characters in mention names. - """ - @spec mentions_escape(String.t(), list({String.t(), any()})) :: String.t() - def mentions_escape(text, mentions) do - mentions - |> Enum.reduce(text, fn {name, _}, acc -> - escape_name = String.replace(name, @markdown_characters_regex, "\\\\\\1") - String.replace(acc, name, escape_name) - end) - end - - @doc "changes scheme:... urls to html links" - def add_links({subs, text}) do - links = - text - |> String.split([" ", "\t", "<br>"]) - |> Enum.filter(fn word -> String.starts_with?(word, @valid_schemes) end) - |> Enum.filter(fn word -> Regex.match?(@link_regex, word) end) - |> Enum.map(fn url -> {Ecto.UUID.generate(), url} end) - |> Enum.sort_by(fn {_, url} -> -String.length(url) end) - - uuid_text = - links - |> Enum.reduce(text, fn {uuid, url}, acc -> String.replace(acc, url, uuid) end) - - subs = - subs ++ - Enum.map(links, fn {uuid, url} -> - {uuid, "<a href=\"#{url}\">#{url}</a>"} - end) - - {subs, uuid_text} - end - - @doc "Adds the links to mentioned users" - def add_user_links({subs, text}, mentions, options \\ []) do - mentions = - mentions - |> Enum.sort_by(fn {name, _} -> -String.length(name) end) - |> Enum.map(fn {name, user} -> {name, user, Ecto.UUID.generate()} end) - - uuid_text = - mentions - |> Enum.reduce(text, fn {match, _user, uuid}, text -> - String.replace(text, match, uuid) - end) - - subs = - subs ++ - Enum.map(mentions, fn {match, %User{id: id, ap_id: ap_id, info: info}, uuid} -> - ap_id = - if is_binary(info.source_data["url"]) do - info.source_data["url"] - else - ap_id - end - - nickname = - if options[:format] == :full do - User.full_nickname(match) - else - User.local_nickname(match) - end - - {uuid, - "<span class='h-card'><a data-user='#{id}' class='u-url mention' href='#{ap_id}'>" <> - "@<span>#{nickname}</span></a></span>"} - end) - - {subs, uuid_text} - end - - @doc "Adds the hashtag links" - def add_hashtag_links({subs, text}, tags) do - tags = - tags - |> Enum.sort_by(fn {name, _} -> -String.length(name) end) - |> Enum.map(fn {name, short} -> {name, short, Ecto.UUID.generate()} end) - - uuid_text = - tags - |> Enum.reduce(text, fn {match, _short, uuid}, text -> - String.replace(text, ~r/((?<=[^&])|(\A))#{match}/, uuid) - end) - - subs = - subs ++ - Enum.map(tags, fn {tag_text, tag, uuid} -> - url = - "<a class='hashtag' data-tag='#{tag}' href='#{Pleroma.Web.base_url()}/tag/#{tag}' rel='tag'>#{ - tag_text - }</a>" - - {uuid, url} - end) - - {subs, uuid_text} - end - - def finalize({subs, text}) do - Enum.reduce(subs, text, fn {uuid, replacement}, result_text -> - String.replace(result_text, uuid, replacement) - end) - end - def truncate(text, max_length \\ 200, omission \\ "...") do # Remove trailing whitespace text = Regex.replace(~r/([^ \t\r\n])([ \t]+$)/u, text, "\\g{1}") @@ -211,4 +119,16 @@ defmodule Pleroma.Formatter do String.slice(text, 0, length_with_omission) <> omission end end + + defp get_ap_id(%User{info: %{source_data: %{"url" => url}}}) when is_binary(url), do: url + defp get_ap_id(%User{ap_id: ap_id}), do: ap_id + + defp get_nickname_text(nickname, %{mentions_format: :full}), do: User.full_nickname(nickname) + defp get_nickname_text(nickname, _), do: User.local_nickname(nickname) + + defp maybe_escape(str, %{mentions_escape: true}) do + String.replace(str, @markdown_characters_regex, "\\\\\\1") + end + + defp maybe_escape(str, _), do: str end diff --git a/lib/pleroma/gopher/server.ex b/lib/pleroma/gopher/server.ex index 32cb817d2..ba9614029 100644 --- a/lib/pleroma/gopher/server.ex +++ b/lib/pleroma/gopher/server.ex @@ -37,6 +37,7 @@ end defmodule Pleroma.Gopher.Server.ProtocolHandler do alias Pleroma.Web.ActivityPub.ActivityPub + alias Pleroma.Web.ActivityPub.Visibility alias Pleroma.Activity alias Pleroma.HTML alias Pleroma.User @@ -110,7 +111,7 @@ defmodule Pleroma.Gopher.Server.ProtocolHandler do def response("/notices/" <> id) do with %Activity{} = activity <- Repo.get(Activity, id), - true <- ActivityPub.is_public?(activity) do + true <- Visibility.is_public?(activity) do activities = ActivityPub.fetch_activities_for_context(activity.data["context"]) |> render_activities diff --git a/lib/pleroma/plugs/oauth_scopes_plug.ex b/lib/pleroma/plugs/oauth_scopes_plug.ex new file mode 100644 index 000000000..f2bfa2b1a --- /dev/null +++ b/lib/pleroma/plugs/oauth_scopes_plug.ex @@ -0,0 +1,41 @@ +# Pleroma: A lightweight social networking server +# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/> +# SPDX-License-Identifier: AGPL-3.0-only + +defmodule Pleroma.Plugs.OAuthScopesPlug do + import Plug.Conn + + @behaviour Plug + + def init(%{scopes: _} = options), do: options + + def call(%Plug.Conn{assigns: assigns} = conn, %{scopes: scopes} = options) do + op = options[:op] || :| + token = assigns[:token] + + cond do + is_nil(token) -> + conn + + op == :| && scopes -- token.scopes != scopes -> + conn + + op == :& && scopes -- token.scopes == [] -> + conn + + options[:fallback] == :proceed_unauthenticated -> + conn + |> assign(:user, nil) + |> assign(:token, nil) + + true -> + missing_scopes = scopes -- token.scopes + error_message = "Insufficient permissions: #{Enum.join(missing_scopes, " #{op} ")}." + + conn + |> put_resp_content_type("application/json") + |> send_resp(403, Jason.encode!(%{error: error_message})) + |> halt() + end + end +end diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex index 18bb56667..50e7e7ccd 100644 --- a/lib/pleroma/user.ex +++ b/lib/pleroma/user.ex @@ -22,6 +22,7 @@ defmodule Pleroma.User do alias Pleroma.Web.OAuth alias Pleroma.Web.ActivityPub.Utils alias Pleroma.Web.ActivityPub.ActivityPub + alias Pleroma.Web.RelMe require Logger @@ -273,7 +274,7 @@ defmodule Pleroma.User do Pleroma.Config.get([:instance, :account_activation_required]) do user |> Pleroma.UserEmail.account_confirmation_email() - |> Pleroma.Mailer.deliver() + |> Pleroma.Mailer.deliver_async() else {:ok, :noop} end @@ -547,11 +548,8 @@ defmodule Pleroma.User do end def get_followers_query(user, page) do - from( - u in get_followers_query(user, nil), - limit: 20, - offset: ^((page - 1) * 20) - ) + from(u in get_followers_query(user, nil)) + |> paginate(page, 20) end def get_followers_query(user), do: get_followers_query(user, nil) @@ -577,11 +575,8 @@ defmodule Pleroma.User do end def get_friends_query(user, page) do - from( - u in get_friends_query(user, nil), - limit: 20, - offset: ^((page - 1) * 20) - ) + from(u in get_friends_query(user, nil)) + |> paginate(page, 20) end def get_friends_query(user), do: get_friends_query(user, nil) @@ -613,71 +608,65 @@ defmodule Pleroma.User do ), where: fragment( - "? @> ?", + "coalesce((?)->'object'->>'id', (?)->>'object') = ?", a.data, - ^%{"object" => user.ap_id} + a.data, + ^user.ap_id ) ) end - def update_follow_request_count(%User{} = user) do - subquery = + def get_follow_requests(%User{} = user) do + users = user |> User.get_follow_requests_query() - |> select([a], %{count: count(a.id)}) + |> join(:inner, [a], u in User, a.actor == u.ap_id) + |> where([a, u], not fragment("? @> ?", u.following, ^[user.follower_address])) + |> group_by([a, u], u.id) + |> select([a, u], u) + |> Repo.all() + {:ok, users} + end + + def increase_note_count(%User{} = user) do User |> where(id: ^user.id) - |> join(:inner, [u], s in subquery(subquery)) - |> update([u, s], + |> update([u], set: [ info: fragment( - "jsonb_set(?, '{follow_request_count}', ?::varchar::jsonb, true)", + "jsonb_set(?, '{note_count}', ((?->>'note_count')::int + 1)::varchar::jsonb, true)", u.info, - s.count + u.info ) ] ) |> Repo.update_all([], returning: true) |> case do - {1, [user]} -> {:ok, user} + {1, [user]} -> set_cache(user) _ -> {:error, user} end end - def get_follow_requests(%User{} = user) do - q = get_follow_requests_query(user) - reqs = Repo.all(q) - - users = - Enum.map(reqs, fn req -> req.actor end) - |> Enum.uniq() - |> Enum.map(fn ap_id -> get_by_ap_id(ap_id) end) - |> Enum.filter(fn u -> !is_nil(u) end) - |> Enum.filter(fn u -> !following?(u, user) end) - - {:ok, users} - end - - def increase_note_count(%User{} = user) do - info_cng = User.Info.add_to_note_count(user.info, 1) - - cng = - change(user) - |> put_embed(:info, info_cng) - - update_and_set_cache(cng) - end - def decrease_note_count(%User{} = user) do - info_cng = User.Info.add_to_note_count(user.info, -1) - - cng = - change(user) - |> put_embed(:info, info_cng) - - update_and_set_cache(cng) + User + |> where(id: ^user.id) + |> update([u], + set: [ + info: + fragment( + "jsonb_set(?, '{note_count}', (greatest(0, (?->>'note_count')::int - 1))::varchar::jsonb, true)", + u.info, + u.info + ) + ] + ) + |> Repo.update_all([], returning: true) + |> case do + {1, [user]} -> set_cache(user) + _ -> {:error, user} + end end def update_note_count(%User{} = user) do @@ -701,24 +690,29 @@ defmodule Pleroma.User do def update_follower_count(%User{} = user) do follower_count_query = - from( - u in User, - where: ^user.follower_address in u.following, - where: u.id != ^user.id, - select: count(u.id) - ) - - follower_count = Repo.one(follower_count_query) - - info_cng = - user.info - |> User.Info.set_follower_count(follower_count) + User + |> where([u], ^user.follower_address in u.following) + |> where([u], u.id != ^user.id) + |> select([u], %{count: count(u.id)}) - cng = - change(user) - |> put_embed(:info, info_cng) - - update_and_set_cache(cng) + User + |> where(id: ^user.id) + |> join(:inner, [u], s in subquery(follower_count_query)) + |> update([u, s], + set: [ + info: + fragment( + "jsonb_set(?, '{follower_count}', ?::varchar::jsonb, true)", + u.info, + s.count + ) + ] + ) + |> Repo.update_all([], returning: true) + |> case do + {1, [user]} -> set_cache(user) + _ -> {:error, user} + end end def get_users_from_set_query(ap_ids, false) do @@ -755,6 +749,46 @@ defmodule Pleroma.User do Repo.all(query) end + @spec search_for_admin(binary(), %{ + admin: Pleroma.User.t(), + local: boolean(), + page: number(), + page_size: number() + }) :: {:ok, [Pleroma.User.t()], number()} + def search_for_admin(term, %{admin: admin, local: local, page: page, page_size: page_size}) do + term = String.trim_leading(term, "@") + + local_paginated_query = + User + |> maybe_local_user_query(local) + |> paginate(page, page_size) + + search_query = fts_search_subquery(term, local_paginated_query) + + count = + term + |> fts_search_subquery() + |> maybe_local_user_query(local) + |> Repo.aggregate(:count, :id) + + {:ok, do_search(search_query, admin), count} + end + + @spec all_for_admin(number(), number()) :: {:ok, [Pleroma.User.t()], number()} + def all_for_admin(page, page_size) do + query = from(u in User, order_by: u.id) + + paginated_query = + query + |> paginate(page, page_size) + + count = + query + |> Repo.aggregate(:count, :id) + + {:ok, Repo.all(paginated_query), count} + end + def search(query, resolve \\ false, for_user \\ nil) do # Strip the beginning @ off if there is a query query = String.trim_leading(query, "@") @@ -788,9 +822,9 @@ defmodule Pleroma.User do boost_search_results(results, for_user) end - defp fts_search_subquery(query) do + defp fts_search_subquery(term, query \\ User) do processed_query = - query + term |> String.replace(~r/\W+/, " ") |> String.trim() |> String.split() @@ -798,7 +832,7 @@ defmodule Pleroma.User do |> Enum.join(" | ") from( - u in User, + u in query, select_merge: %{ search_rank: fragment( @@ -828,19 +862,19 @@ defmodule Pleroma.User do ) end - defp trigram_search_subquery(query) do + defp trigram_search_subquery(term) do from( u in User, select_merge: %{ search_rank: fragment( "similarity(?, trim(? || ' ' || coalesce(?, '')))", - ^query, + ^term, u.nickname, u.name ) }, - where: fragment("trim(? || ' ' || coalesce(?, '')) % ?", u.nickname, u.name, ^query) + where: fragment("trim(? || ' ' || coalesce(?, '')) % ?", u.nickname, u.name, ^term) ) end @@ -888,6 +922,30 @@ defmodule Pleroma.User do ) end + def mute(muter, %User{ap_id: ap_id}) do + info_cng = + muter.info + |> User.Info.add_to_mutes(ap_id) + + cng = + change(muter) + |> put_embed(:info, info_cng) + + update_and_set_cache(cng) + end + + def unmute(muter, %{ap_id: ap_id}) do + info_cng = + muter.info + |> User.Info.remove_from_mutes(ap_id) + + cng = + change(muter) + |> put_embed(:info, info_cng) + + update_and_set_cache(cng) + end + def block(blocker, %User{ap_id: ap_id} = blocked) do # sever any follow relationships to prevent leaks per activitypub (Pleroma issue #213) blocker = @@ -930,6 +988,9 @@ defmodule Pleroma.User do update_and_set_cache(cng) end + def mutes?(nil, _), do: false + def mutes?(user, %{ap_id: ap_id}), do: Enum.member?(user.info.mutes, ap_id) + def blocks?(user, %{ap_id: ap_id}) do blocks = user.info.blocks domain_blocks = user.info.domain_blocks @@ -941,6 +1002,9 @@ defmodule Pleroma.User do end) end + def muted_users(user), + do: Repo.all(from(u in User, where: u.ap_id in ^user.info.mutes)) + def blocked_users(user), do: Repo.all(from(u in User, where: u.ap_id in ^user.info.blocks)) @@ -968,9 +1032,13 @@ defmodule Pleroma.User do update_and_set_cache(cng) end - def local_user_query do + def maybe_local_user_query(query, local) do + if local, do: local_user_query(query), else: query + end + + def local_user_query(query \\ User) do from( - u in User, + u in query, where: u.local == true, where: not is_nil(u.nickname) ) @@ -1158,9 +1226,6 @@ defmodule Pleroma.User do def parse_bio(bio, _user) when bio == "", do: bio def parse_bio(bio, user) do - mentions = Formatter.parse_mentions(bio) - tags = Formatter.parse_tags(bio) - emoji = (user.info.source_data["tag"] || []) |> Enum.filter(fn %{"type" => t} -> t == "Emoji" end) @@ -1168,8 +1233,15 @@ defmodule Pleroma.User do {String.trim(name, ":"), url} end) + # TODO: get profile URLs other than user.ap_id + profile_urls = [user.ap_id] + bio - |> CommonUtils.format_input(mentions, tags, "text/plain", user_links: [format: :full]) + |> CommonUtils.format_input("text/plain", + mentions_format: :full, + rel: &RelMe.maybe_put_rel_me(&1, profile_urls) + ) + |> elem(0) |> Formatter.emojify(emoji) end @@ -1255,4 +1327,20 @@ defmodule Pleroma.User do inserted_at: NaiveDateTime.utc_now() } end + + def all_superusers do + from( + u in User, + where: u.local == true, + where: fragment("?->'is_admin' @> 'true' OR ?->'is_moderator' @> 'true'", u.info, u.info) + ) + |> Repo.all() + end + + defp paginate(query, page, page_size) do + from(u in query, + limit: ^page_size, + offset: ^((page - 1) * page_size) + ) + end end diff --git a/lib/pleroma/user/info.ex b/lib/pleroma/user/info.ex index 9099d7fbb..818b64645 100644 --- a/lib/pleroma/user/info.ex +++ b/lib/pleroma/user/info.ex @@ -12,13 +12,13 @@ defmodule Pleroma.User.Info do field(:source_data, :map, default: %{}) field(:note_count, :integer, default: 0) field(:follower_count, :integer, default: 0) - field(:follow_request_count, :integer, default: 0) field(:locked, :boolean, default: false) field(:confirmation_pending, :boolean, default: false) field(:confirmation_token, :string, default: nil) field(:default_scope, :string, default: "public") field(:blocks, {:array, :string}, default: []) field(:domain_blocks, {:array, :string}, default: []) + field(:mutes, {:array, :string}, default: []) field(:deactivated, :boolean, default: false) field(:no_rich_text, :boolean, default: false) field(:ap_enabled, :boolean, default: false) @@ -74,6 +74,14 @@ defmodule Pleroma.User.Info do |> validate_required([:follower_count]) end + def set_mutes(info, mutes) do + params = %{mutes: mutes} + + info + |> cast(params, [:mutes]) + |> validate_required([:mutes]) + end + def set_blocks(info, blocks) do params = %{blocks: blocks} @@ -82,6 +90,14 @@ defmodule Pleroma.User.Info do |> validate_required([:blocks]) end + def add_to_mutes(info, muted) do + set_mutes(info, Enum.uniq([muted | info.mutes])) + end + + def remove_from_mutes(info, muted) do + set_mutes(info, List.delete(info.mutes, muted)) + end + def add_to_block(info, blocked) do set_blocks(info, Enum.uniq([blocked | info.blocks])) end diff --git a/lib/pleroma/web/activity_pub/activity_pub.ex b/lib/pleroma/web/activity_pub/activity_pub.ex index 3650d330a..98639883e 100644 --- a/lib/pleroma/web/activity_pub/activity_pub.ex +++ b/lib/pleroma/web/activity_pub/activity_pub.ex @@ -18,6 +18,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do import Ecto.Query import Pleroma.Web.ActivityPub.Utils + import Pleroma.Web.ActivityPub.Visibility require Logger @@ -80,6 +81,14 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do defp check_remote_limit(_), do: true + def increase_note_count_if_public(actor, object) do + if is_public?(object), do: User.increase_note_count(actor), else: {:ok, actor} + end + + def decrease_note_count_if_public(actor, object) do + if is_public?(object), do: User.decrease_note_count(actor), else: {:ok, actor} + end + def insert(map, local \\ true) when is_map(map) do with nil <- Activity.normalize(map), map <- lazy_put_activity_defaults(map), @@ -162,7 +171,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do ), {:ok, activity} <- insert(create_data, local), # Changing note count prior to enqueuing federation task in order to avoid race conditions on updating user.info - {:ok, _actor} <- User.increase_note_count(actor), + {:ok, _actor} <- increase_note_count_if_public(actor, activity), :ok <- maybe_federate(activity) do {:ok, activity} end @@ -174,8 +183,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do with data <- %{"to" => to, "type" => "Accept", "actor" => actor.ap_id, "object" => object}, {:ok, activity} <- insert(data, local), - :ok <- maybe_federate(activity), - _ <- User.update_follow_request_count(actor) do + :ok <- maybe_federate(activity) do {:ok, activity} end end @@ -186,8 +194,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do with data <- %{"to" => to, "type" => "Reject", "actor" => actor.ap_id, "object" => object}, {:ok, activity} <- insert(data, local), - :ok <- maybe_federate(activity), - _ <- User.update_follow_request_count(actor) do + :ok <- maybe_federate(activity) do {:ok, activity} end end @@ -285,8 +292,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do def follow(follower, followed, activity_id \\ nil, local \\ true) do with data <- make_follow_data(follower, followed, activity_id), {:ok, activity} <- insert(data, local), - :ok <- maybe_federate(activity), - _ <- User.update_follow_request_count(followed) do + :ok <- maybe_federate(activity) do {:ok, activity} end end @@ -296,8 +302,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do {:ok, follow_activity} <- update_follow_state(follow_activity, "cancelled"), unfollow_data <- make_unfollow_data(follower, followed, follow_activity, activity_id), {:ok, activity} <- insert(unfollow_data, local), - :ok <- maybe_federate(activity), - _ <- User.update_follow_request_count(followed) do + :ok <- maybe_federate(activity) do {:ok, activity} end end @@ -305,7 +310,8 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do def delete(%Object{data: %{"id" => id, "actor" => actor}} = object, local \\ true) do user = User.get_cached_by_ap_id(actor) - to = object.data["to"] || [] ++ object.data["cc"] || + to = + object.data["to"] || [] ++ object.data["cc"] || [] ++ [user.follower_address, "https://www.w3.org/ns/activitystreams#Public"] data = %{ @@ -318,7 +324,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do with {:ok, _} <- Object.delete(object), {:ok, activity} <- insert(data, local), # Changing note count prior to enqueuing federation task in order to avoid race conditions on updating user.info - {:ok, _actor} <- User.decrease_note_count(user), + {:ok, _actor} <- decrease_note_count_if_public(user, object), :ok <- maybe_federate(activity) do {:ok, activity} end @@ -356,6 +362,31 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do end end + def flag( + %{ + actor: actor, + context: context, + account: account, + statuses: statuses, + content: content + } = params + ) do + additional = params[:additional] || %{} + + # only accept false as false value + local = !(params[:local] == false) + + %{ + actor: actor, + context: context, + account: account, + statuses: statuses, + content: content + } + |> make_flag_data(additional) + |> insert(local) + end + def fetch_activities_for_context(context, opts \\ %{}) do public = ["https://www.w3.org/ns/activitystreams#Public"] @@ -398,6 +429,30 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do @valid_visibilities ~w[direct unlisted public private] defp restrict_visibility(query, %{visibility: visibility}) + when is_list(visibility) do + if Enum.all?(visibility, &(&1 in @valid_visibilities)) do + query = + from( + a in query, + where: + fragment( + "activity_visibility(?, ?, ?) = ANY (?)", + a.actor, + a.recipients, + a.data, + ^visibility + ) + ) + + Ecto.Adapters.SQL.to_sql(:all, Repo, query) + + query + else + Logger.error("Could not restrict visibility to #{visibility}") + end + end + + defp restrict_visibility(query, %{visibility: visibility}) when visibility in @valid_visibilities do query = from( @@ -579,6 +634,20 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do defp restrict_reblogs(query, _), do: query + defp restrict_muted(query, %{"with_muted" => val}) when val in [true, "true", "1"], do: query + + defp restrict_muted(query, %{"muting_user" => %User{info: info}}) do + mutes = info.mutes + + from( + activity in query, + where: fragment("not (? = ANY(?))", activity.actor, ^mutes), + where: fragment("not (?->'to' \\?| ?)", activity.data, ^mutes) + ) + end + + defp restrict_muted(query, _), do: query + defp restrict_blocked(query, %{"blocking_user" => %User{info: info}}) do blocks = info.blocks || [] domain_blocks = info.domain_blocks || [] @@ -632,6 +701,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do |> restrict_type(opts) |> restrict_favorited_by(opts) |> restrict_blocked(opts) + |> restrict_muted(opts) |> restrict_media(opts) |> restrict_visibility(opts) |> restrict_replies(opts) @@ -788,11 +858,16 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do digest = "SHA-256=" <> (:crypto.hash(:sha256, json) |> Base.encode64()) + date = + NaiveDateTime.utc_now() + |> Timex.format!("{WDshort}, {0D} {Mshort} {YYYY} {h24}:{m}:{s} GMT") + signature = Pleroma.Web.HTTPSignatures.sign(actor, %{ host: host, "content-length": byte_size(json), - digest: digest + digest: digest, + date: date }) with {:ok, %{status: code}} when code in 200..299 <- @@ -802,6 +877,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do json, [ {"Content-Type", "application/activity+json"}, + {"Date", date}, {"signature", signature}, {"digest", digest} ] @@ -871,57 +947,6 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do end end - def is_public?(%Object{data: %{"type" => "Tombstone"}}), do: false - def is_public?(%Object{data: data}), do: is_public?(data) - def is_public?(%Activity{data: data}), do: is_public?(data) - def is_public?(%{"directMessage" => true}), do: false - - def is_public?(data) do - "https://www.w3.org/ns/activitystreams#Public" in (data["to"] ++ (data["cc"] || [])) - end - - def is_private?(activity) do - unless is_public?(activity) do - follower_address = User.get_cached_by_ap_id(activity.data["actor"]).follower_address - Enum.any?(activity.data["to"], &(&1 == follower_address)) - else - false - end - end - - def is_direct?(%Activity{data: %{"directMessage" => true}}), do: true - def is_direct?(%Object{data: %{"directMessage" => true}}), do: true - - def is_direct?(activity) do - !is_public?(activity) && !is_private?(activity) - end - - def visible_for_user?(activity, nil) do - is_public?(activity) - end - - def visible_for_user?(activity, user) do - x = [user.ap_id | user.following] - y = activity.data["to"] ++ (activity.data["cc"] || []) - visible_for_user?(activity, nil) || Enum.any?(x, &(&1 in y)) - end - - # guard - def entire_thread_visible_for_user?(nil, _user), do: false - - # child - def entire_thread_visible_for_user?( - %Activity{data: %{"object" => %{"inReplyTo" => parent_id}}} = tail, - user - ) - when is_binary(parent_id) do - parent = Activity.get_in_reply_to_activity(tail) - visible_for_user?(tail, user) && entire_thread_visible_for_user?(parent, user) - end - - # root - def entire_thread_visible_for_user?(tail, user), do: visible_for_user?(tail, user) - # filter out broken threads def contain_broken_threads(%Activity{} = activity, %User{} = user) do entire_thread_visible_for_user?(activity, user) diff --git a/lib/pleroma/web/activity_pub/activity_pub_controller.ex b/lib/pleroma/web/activity_pub/activity_pub_controller.ex index 2bea51311..ff924a536 100644 --- a/lib/pleroma/web/activity_pub/activity_pub_controller.ex +++ b/lib/pleroma/web/activity_pub/activity_pub_controller.ex @@ -11,6 +11,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do alias Pleroma.Web.ActivityPub.ObjectView alias Pleroma.Web.ActivityPub.UserView alias Pleroma.Web.ActivityPub.ActivityPub + alias Pleroma.Web.ActivityPub.Visibility alias Pleroma.Web.ActivityPub.Relay alias Pleroma.Web.ActivityPub.Transmogrifier alias Pleroma.Web.ActivityPub.Utils @@ -49,7 +50,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do def object(conn, %{"uuid" => uuid}) do with ap_id <- o_status_url(conn, :object, uuid), %Object{} = object <- Object.get_cached_by_ap_id(ap_id), - {_, true} <- {:public?, ActivityPub.is_public?(object)} do + {_, true} <- {:public?, Visibility.is_public?(object)} do conn |> put_resp_header("content-type", "application/activity+json") |> json(ObjectView.render("object.json", %{object: object})) @@ -62,7 +63,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do def object_likes(conn, %{"uuid" => uuid, "page" => page}) do with ap_id <- o_status_url(conn, :object, uuid), %Object{} = object <- Object.get_cached_by_ap_id(ap_id), - {_, true} <- {:public?, ActivityPub.is_public?(object)}, + {_, true} <- {:public?, Visibility.is_public?(object)}, likes <- Utils.get_object_likes(object) do {page, _} = Integer.parse(page) @@ -78,7 +79,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do def object_likes(conn, %{"uuid" => uuid}) do with ap_id <- o_status_url(conn, :object, uuid), %Object{} = object <- Object.get_cached_by_ap_id(ap_id), - {_, true} <- {:public?, ActivityPub.is_public?(object)}, + {_, true} <- {:public?, Visibility.is_public?(object)}, likes <- Utils.get_object_likes(object) do conn |> put_resp_header("content-type", "application/activity+json") @@ -92,7 +93,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do def activity(conn, %{"uuid" => uuid}) do with ap_id <- o_status_url(conn, :activity, uuid), %Activity{} = activity <- Activity.normalize(ap_id), - {_, true} <- {:public?, ActivityPub.is_public?(activity)} do + {_, true} <- {:public?, Visibility.is_public?(activity)} do conn |> put_resp_header("content-type", "application/activity+json") |> json(ObjectView.render("object.json", %{object: activity})) diff --git a/lib/pleroma/web/activity_pub/transmogrifier.ex b/lib/pleroma/web/activity_pub/transmogrifier.ex index 41d89a02b..88007aa16 100644 --- a/lib/pleroma/web/activity_pub/transmogrifier.ex +++ b/lib/pleroma/web/activity_pub/transmogrifier.ex @@ -12,6 +12,7 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do alias Pleroma.Repo alias Pleroma.Web.ActivityPub.ActivityPub alias Pleroma.Web.ActivityPub.Utils + alias Pleroma.Web.ActivityPub.Visibility import Ecto.Query @@ -489,7 +490,7 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do with actor <- get_actor(data), %User{} = actor <- User.get_or_fetch_by_ap_id(actor), {:ok, object} <- get_obj_helper(object_id) || fetch_obj_helper(object_id), - public <- ActivityPub.is_public?(data), + public <- Visibility.is_public?(data), {:ok, activity, _object} <- ActivityPub.announce(actor, object, id, false, public) do {:ok, activity} else diff --git a/lib/pleroma/web/activity_pub/utils.ex b/lib/pleroma/web/activity_pub/utils.ex index 6a89374d0..88f4779c8 100644 --- a/lib/pleroma/web/activity_pub/utils.ex +++ b/lib/pleroma/web/activity_pub/utils.ex @@ -598,4 +598,20 @@ defmodule Pleroma.Web.ActivityPub.Utils do } |> Map.merge(additional) end + + #### Flag-related helpers + + def make_flag_data(params, additional) do + status_ap_ids = Enum.map(params.statuses || [], & &1.data["id"]) + object = [params.account.ap_id] ++ status_ap_ids + + %{ + "type" => "Flag", + "actor" => params.actor.ap_id, + "content" => params.content, + "object" => object, + "context" => params.context + } + |> Map.merge(additional) + end end diff --git a/lib/pleroma/web/activity_pub/views/user_view.ex b/lib/pleroma/web/activity_pub/views/user_view.ex index c8e154989..415cbd47a 100644 --- a/lib/pleroma/web/activity_pub/views/user_view.ex +++ b/lib/pleroma/web/activity_pub/views/user_view.ex @@ -188,14 +188,24 @@ defmodule Pleroma.Web.ActivityPub.UserView do end activities = ActivityPub.fetch_user_activities(user, nil, params) - min_id = Enum.at(Enum.reverse(activities), 0).id - max_id = Enum.at(activities, 0).id - collection = - Enum.map(activities, fn act -> - {:ok, data} = Transmogrifier.prepare_outgoing(act.data) - data - end) + {max_id, min_id, collection} = + if length(activities) > 0 do + { + Enum.at(Enum.reverse(activities), 0).id, + Enum.at(activities, 0).id, + Enum.map(activities, fn act -> + {:ok, data} = Transmogrifier.prepare_outgoing(act.data) + data + end) + } + else + { + 0, + 0, + [] + } + end iri = "#{user.ap_id}/outbox" diff --git a/lib/pleroma/web/activity_pub/visibility.ex b/lib/pleroma/web/activity_pub/visibility.ex new file mode 100644 index 000000000..db52fe933 --- /dev/null +++ b/lib/pleroma/web/activity_pub/visibility.ex @@ -0,0 +1,56 @@ +defmodule Pleroma.Web.ActivityPub.Visibility do + alias Pleroma.Activity + alias Pleroma.Object + alias Pleroma.User + + def is_public?(%Object{data: %{"type" => "Tombstone"}}), do: false + def is_public?(%Object{data: data}), do: is_public?(data) + def is_public?(%Activity{data: data}), do: is_public?(data) + def is_public?(%{"directMessage" => true}), do: false + + def is_public?(data) do + "https://www.w3.org/ns/activitystreams#Public" in (data["to"] ++ (data["cc"] || [])) + end + + def is_private?(activity) do + unless is_public?(activity) do + follower_address = User.get_cached_by_ap_id(activity.data["actor"]).follower_address + Enum.any?(activity.data["to"], &(&1 == follower_address)) + else + false + end + end + + def is_direct?(%Activity{data: %{"directMessage" => true}}), do: true + def is_direct?(%Object{data: %{"directMessage" => true}}), do: true + + def is_direct?(activity) do + !is_public?(activity) && !is_private?(activity) + end + + def visible_for_user?(activity, nil) do + is_public?(activity) + end + + def visible_for_user?(activity, user) do + x = [user.ap_id | user.following] + y = [activity.actor] ++ activity.data["to"] ++ (activity.data["cc"] || []) + visible_for_user?(activity, nil) || Enum.any?(x, &(&1 in y)) + end + + # guard + def entire_thread_visible_for_user?(nil, _user), do: false + + # child + def entire_thread_visible_for_user?( + %Activity{data: %{"object" => %{"inReplyTo" => parent_id}}} = tail, + user + ) + when is_binary(parent_id) do + parent = Activity.get_in_reply_to_activity(tail) + visible_for_user?(tail, user) && entire_thread_visible_for_user?(parent, user) + end + + # root + def entire_thread_visible_for_user?(tail, user), do: visible_for_user?(tail, user) +end diff --git a/lib/pleroma/web/admin_api/admin_api_controller.ex b/lib/pleroma/web/admin_api/admin_api_controller.ex index 9ec50bb90..aae02cab8 100644 --- a/lib/pleroma/web/admin_api/admin_api_controller.ex +++ b/lib/pleroma/web/admin_api/admin_api_controller.ex @@ -3,9 +3,12 @@ # SPDX-License-Identifier: AGPL-3.0-only defmodule Pleroma.Web.AdminAPI.AdminAPIController do + @users_page_size 50 + use Pleroma.Web, :controller alias Pleroma.User alias Pleroma.Web.ActivityPub.Relay + alias Pleroma.Web.MastodonAPI.Admin.AccountView import Pleroma.Web.ControllerHelper, only: [json_response: 3] @@ -41,6 +44,15 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do |> json(user.nickname) end + def user_toggle_activation(conn, %{"nickname" => nickname}) do + user = User.get_by_nickname(nickname) + + {:ok, updated_user} = User.deactivate(user, !user.info.deactivated) + + conn + |> json(AccountView.render("show.json", %{user: updated_user})) + end + def tag_users(conn, %{"nicknames" => nicknames, "tags" => tags}) do with {:ok, _} <- User.tag(nicknames, tags), do: json_response(conn, :no_content, "") @@ -51,6 +63,42 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do do: json_response(conn, :no_content, "") end + def list_users(conn, params) do + {page, page_size} = page_params(params) + + with {:ok, users, count} <- User.all_for_admin(page, page_size), + do: + conn + |> json( + AccountView.render("index.json", + users: users, + count: count, + page_size: page_size + ) + ) + end + + def search_users(%{assigns: %{user: admin}} = conn, %{"query" => query} = params) do + {page, page_size} = page_params(params) + + with {:ok, users, count} <- + User.search_for_admin(query, %{ + admin: admin, + local: params["local"] == "true", + page: page, + page_size: page_size + }), + do: + conn + |> json( + AccountView.render("index.json", + users: users, + count: count, + page_size: page_size + ) + ) + end + def right_add(conn, %{"permission_group" => permission_group, "nickname" => nickname}) when permission_group in ["moderator", "admin"] do user = User.get_by_nickname(nickname) @@ -194,4 +242,26 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do |> put_status(500) |> json("Something went wrong") end + + defp page_params(params) do + {get_page(params["page"]), get_page_size(params["page_size"])} + end + + defp get_page(page_string) when is_nil(page_string), do: 1 + + defp get_page(page_string) do + case Integer.parse(page_string) do + {page, _} -> page + :error -> 1 + end + end + + defp get_page_size(page_size_string) when is_nil(page_size_string), do: @users_page_size + + defp get_page_size(page_size_string) do + case Integer.parse(page_size_string) do + {page_size, _} -> page_size + :error -> @users_page_size + end + end end diff --git a/lib/pleroma/web/auth/authenticator.ex b/lib/pleroma/web/auth/authenticator.ex new file mode 100644 index 000000000..82267c595 --- /dev/null +++ b/lib/pleroma/web/auth/authenticator.ex @@ -0,0 +1,25 @@ +# Pleroma: A lightweight social networking server +# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/> +# SPDX-License-Identifier: AGPL-3.0-only + +defmodule Pleroma.Web.Auth.Authenticator do + alias Pleroma.User + + def implementation do + Pleroma.Config.get( + Pleroma.Web.Auth.Authenticator, + Pleroma.Web.Auth.PleromaAuthenticator + ) + end + + @callback get_user(Plug.Conn.t()) :: {:ok, User.t()} | {:error, any()} + def get_user(plug), do: implementation().get_user(plug) + + @callback handle_error(Plug.Conn.t(), any()) :: any() + def handle_error(plug, error), do: implementation().handle_error(plug, error) + + @callback auth_template() :: String.t() | nil + def auth_template do + implementation().auth_template() || Pleroma.Config.get(:auth_template, "show.html") + end +end diff --git a/lib/pleroma/web/auth/pleroma_authenticator.ex b/lib/pleroma/web/auth/pleroma_authenticator.ex new file mode 100644 index 000000000..3cc19af01 --- /dev/null +++ b/lib/pleroma/web/auth/pleroma_authenticator.ex @@ -0,0 +1,28 @@ +# Pleroma: A lightweight social networking server +# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/> +# SPDX-License-Identifier: AGPL-3.0-only + +defmodule Pleroma.Web.Auth.PleromaAuthenticator do + alias Pleroma.User + alias Comeonin.Pbkdf2 + + @behaviour Pleroma.Web.Auth.Authenticator + + def get_user(%Plug.Conn{} = conn) do + %{"authorization" => %{"name" => name, "password" => password}} = conn.params + + with {_, %User{} = user} <- {:user, User.get_by_nickname_or_email(name)}, + {_, true} <- {:checkpw, Pbkdf2.checkpw(password, user.password_hash)} do + {:ok, user} + else + error -> + {:error, error} + end + end + + def handle_error(%Plug.Conn{} = _conn, error) do + error + end + + def auth_template, do: nil +end diff --git a/lib/pleroma/web/common_api/common_api.ex b/lib/pleroma/web/common_api/common_api.ex index 90b208e54..7114d6de6 100644 --- a/lib/pleroma/web/common_api/common_api.ex +++ b/lib/pleroma/web/common_api/common_api.ex @@ -82,40 +82,20 @@ defmodule Pleroma.Web.CommonAPI do def get_visibility(_), do: "public" - defp get_content_type(content_type) do - if Enum.member?(Pleroma.Config.get([:instance, :allowed_post_formats]), content_type) do - content_type - else - "text/plain" - end - end - def post(user, %{"status" => status} = data) do visibility = get_visibility(data) limit = Pleroma.Config.get([:instance, :limit]) with status <- String.trim(status), attachments <- attachments_from_ids(data), - mentions <- Formatter.parse_mentions(status), inReplyTo <- get_replied_to_activity(data["in_reply_to_status_id"]), - {to, cc} <- to_for_user_and_mentions(user, mentions, inReplyTo, visibility), - tags <- Formatter.parse_tags(status, data), - content_html <- + {content_html, mentions, tags} <- make_content_html( status, - mentions, attachments, - tags, - get_content_type(data["content_type"]), - Enum.member?( - [true, "true"], - Map.get( - data, - "no_attachment_links", - Pleroma.Config.get([:instance, :no_attachment_links], false) - ) - ) + data ), + {to, cc} <- to_for_user_and_mentions(user, mentions, inReplyTo, visibility), context <- make_context(inReplyTo), cw <- data["spoiler_text"], full_payload <- String.trim(status <> (data["spoiler_text"] || "")), @@ -243,4 +223,31 @@ defmodule Pleroma.Web.CommonAPI do _ -> true end end + + def report(user, data) do + with {:account_id, %{"account_id" => account_id}} <- {:account_id, data}, + {:account, %User{} = account} <- {:account, User.get_by_id(account_id)}, + {:ok, {content_html, _, _}} <- make_report_content_html(data["comment"]), + {:ok, statuses} <- get_report_statuses(account, data), + {:ok, activity} <- + ActivityPub.flag(%{ + context: Utils.generate_context_id(), + actor: user, + account: account, + statuses: statuses, + content: content_html + }) do + Enum.each(User.all_superusers(), fn superuser -> + superuser + |> Pleroma.AdminEmail.report(user, account, statuses, content_html) + |> Pleroma.Mailer.deliver_async() + end) + + {:ok, activity} + else + {:error, err} -> {:error, err} + {:account_id, %{}} -> {:error, "Valid `account_id` required"} + {:account, nil} -> {:error, "Account not found"} + end + end end diff --git a/lib/pleroma/web/common_api/utils.ex b/lib/pleroma/web/common_api/utils.ex index abdeee947..e4b9102c5 100644 --- a/lib/pleroma/web/common_api/utils.ex +++ b/lib/pleroma/web/common_api/utils.ex @@ -10,7 +10,7 @@ defmodule Pleroma.Web.CommonAPI.Utils do alias Pleroma.Object alias Pleroma.Repo alias Pleroma.User - alias Pleroma.Web + alias Pleroma.Config alias Pleroma.Web.Endpoint alias Pleroma.Web.MediaProxy alias Pleroma.Web.ActivityPub.Utils @@ -100,24 +100,45 @@ defmodule Pleroma.Web.CommonAPI.Utils do def make_content_html( status, - mentions, attachments, - tags, - content_type, - no_attachment_links \\ false + data ) do + no_attachment_links = + data + |> Map.get("no_attachment_links", Config.get([:instance, :no_attachment_links])) + |> Kernel.in([true, "true"]) + + content_type = get_content_type(data["content_type"]) + status - |> format_input(mentions, tags, content_type) + |> format_input(content_type) |> maybe_add_attachments(attachments, no_attachment_links) + |> maybe_add_nsfw_tag(data) + end + + defp get_content_type(content_type) do + if Enum.member?(Config.get([:instance, :allowed_post_formats]), content_type) do + content_type + else + "text/plain" + end + end + + defp maybe_add_nsfw_tag({text, mentions, tags}, %{"sensitive" => sensitive}) + when sensitive in [true, "True", "true", "1"] do + {text, mentions, [{"#nsfw", "nsfw"} | tags]} end + defp maybe_add_nsfw_tag(data, _), do: data + def make_context(%Activity{data: %{"context" => context}}), do: context def make_context(_), do: Utils.generate_context_id() - def maybe_add_attachments(text, _attachments, true = _no_links), do: text + def maybe_add_attachments(parsed, _attachments, true = _no_links), do: parsed - def maybe_add_attachments(text, attachments, _no_links) do - add_attachments(text, attachments) + def maybe_add_attachments({text, mentions, tags}, attachments, _no_links) do + text = add_attachments(text, attachments) + {text, mentions, tags} end def add_attachments(text, attachments) do @@ -135,56 +156,39 @@ defmodule Pleroma.Web.CommonAPI.Utils do Enum.join([text | attachment_text], "<br>") end - def format_input(text, mentions, tags, format, options \\ []) + def format_input(text, format, options \\ []) @doc """ Formatting text to plain text. """ - def format_input(text, mentions, tags, "text/plain", options) do + def format_input(text, "text/plain", options) do text |> Formatter.html_escape("text/plain") - |> String.replace(~r/\r?\n/, "<br>") - |> (&{[], &1}).() - |> Formatter.add_links() - |> Formatter.add_user_links(mentions, options[:user_links] || []) - |> Formatter.add_hashtag_links(tags) - |> Formatter.finalize() + |> Formatter.linkify(options) + |> (fn {text, mentions, tags} -> + {String.replace(text, ~r/\r?\n/, "<br>"), mentions, tags} + end).() end @doc """ Formatting text to html. """ - def format_input(text, mentions, _tags, "text/html", options) do + def format_input(text, "text/html", options) do text |> Formatter.html_escape("text/html") - |> (&{[], &1}).() - |> Formatter.add_user_links(mentions, options[:user_links] || []) - |> Formatter.finalize() + |> Formatter.linkify(options) end @doc """ Formatting text to markdown. """ - def format_input(text, mentions, tags, "text/markdown", options) do + def format_input(text, "text/markdown", options) do + options = Keyword.put(options, :mentions_escape, true) + text - |> Formatter.mentions_escape(mentions) - |> Earmark.as_html!() + |> Formatter.linkify(options) + |> (fn {text, mentions, tags} -> {Earmark.as_html!(text), mentions, tags} end).() |> Formatter.html_escape("text/html") - |> (&{[], &1}).() - |> Formatter.add_user_links(mentions, options[:user_links] || []) - |> Formatter.add_hashtag_links(tags) - |> Formatter.finalize() - end - - def add_tag_links(text, tags) do - tags = - tags - |> Enum.sort_by(fn {tag, _} -> -String.length(tag) end) - - Enum.reduce(tags, text, fn {full, tag}, text -> - url = "<a href='#{Web.base_url()}/tag/#{tag}' rel='tag'>##{tag}</a>" - String.replace(text, full, url) - end) end def make_note_data( @@ -322,4 +326,22 @@ defmodule Pleroma.Web.CommonAPI.Utils do end def maybe_extract_mentions(_), do: [] + + def make_report_content_html(nil), do: {:ok, {nil, [], []}} + + def make_report_content_html(comment) do + max_size = Pleroma.Config.get([:instance, :max_report_comment_size], 1000) + + if String.length(comment) <= max_size do + {:ok, format_input(comment, "text/plain")} + else + {:error, "Comment must be up to #{max_size} characters"} + end + end + + def get_report_statuses(%User{ap_id: actor}, %{"status_ids" => status_ids}) do + {:ok, Activity.all_by_actor_and_id(actor, status_ids)} + end + + def get_report_statuses(_, _), do: {:ok, nil} end diff --git a/lib/pleroma/web/controller_helper.ex b/lib/pleroma/web/controller_helper.ex index 14e3d19fd..5915ea40e 100644 --- a/lib/pleroma/web/controller_helper.ex +++ b/lib/pleroma/web/controller_helper.ex @@ -5,6 +5,11 @@ defmodule Pleroma.Web.ControllerHelper do use Pleroma.Web, :controller + def oauth_scopes(params, default) do + # Note: `scopes` is used by Mastodon — supporting it but sticking to OAuth's standard `scope` wherever we control it + Pleroma.Web.OAuth.parse_scopes(params["scope"] || params["scopes"], default) + end + def json_response(conn, status, json) do conn |> put_status(status) diff --git a/lib/pleroma/web/federator/federator.ex b/lib/pleroma/web/federator/federator.ex index d4e2a9742..fbfe97dbc 100644 --- a/lib/pleroma/web/federator/federator.ex +++ b/lib/pleroma/web/federator/federator.ex @@ -9,6 +9,7 @@ defmodule Pleroma.Web.Federator do alias Pleroma.Web.Websub alias Pleroma.Web.Salmon alias Pleroma.Web.ActivityPub.ActivityPub + alias Pleroma.Web.ActivityPub.Visibility alias Pleroma.Web.ActivityPub.Relay alias Pleroma.Web.ActivityPub.Transmogrifier alias Pleroma.Web.ActivityPub.Utils @@ -94,7 +95,7 @@ defmodule Pleroma.Web.Federator do with actor when not is_nil(actor) <- User.get_cached_by_ap_id(activity.data["actor"]) do {:ok, actor} = WebFinger.ensure_keys_present(actor) - if ActivityPub.is_public?(activity) do + if Visibility.is_public?(activity) do if OStatus.is_representable?(activity) do Logger.info(fn -> "Sending #{activity.data["id"]} out via WebSub" end) Websub.publish(Pleroma.Web.OStatus.feed_path(actor), actor, activity) diff --git a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex index e2715bd08..056be49b0 100644 --- a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex +++ b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex @@ -24,13 +24,17 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do alias Pleroma.Web.MastodonAPI.MastodonView alias Pleroma.Web.MastodonAPI.PushSubscriptionView alias Pleroma.Web.MastodonAPI.StatusView + alias Pleroma.Web.MastodonAPI.ReportView alias Pleroma.Web.ActivityPub.ActivityPub alias Pleroma.Web.ActivityPub.Utils + alias Pleroma.Web.ActivityPub.Visibility alias Pleroma.Web.OAuth.App alias Pleroma.Web.OAuth.Authorization alias Pleroma.Web.OAuth.Token + import Pleroma.Web.ControllerHelper, only: [oauth_scopes: 2] import Ecto.Query + require Logger @httpoison Application.get_env(:pleroma, :httpoison) @@ -39,7 +43,14 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do action_fallback(:errors) def create_app(conn, params) do - with cs <- App.register_changeset(%App{}, params), + scopes = oauth_scopes(params, ["read"]) + + app_attrs = + params + |> Map.drop(["scope", "scopes"]) + |> Map.put("scopes", scopes) + + with cs <- App.register_changeset(%App{}, app_attrs), false <- cs.changes[:client_name] == @local_mastodon_name, {:ok, app} <- Repo.insert(cs) do res = %{ @@ -232,6 +243,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do params |> Map.put("type", ["Create", "Announce"]) |> Map.put("blocking_user", user) + |> Map.put("muting_user", user) |> Map.put("user", user) activities = @@ -254,6 +266,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do |> Map.put("type", ["Create", "Announce"]) |> Map.put("local_only", local_only) |> Map.put("blocking_user", user) + |> Map.put("muting_user", user) |> ActivityPub.fetch_public_activities() |> Enum.reverse() @@ -295,7 +308,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do def get_status(%{assigns: %{user: user}} = conn, %{"id" => id}) do with %Activity{} = activity <- Repo.get(Activity, id), - true <- ActivityPub.visible_for_user?(activity, user) do + true <- Visibility.visible_for_user?(activity, user) do conn |> put_view(StatusView) |> try_render("status.json", %{activity: activity, for: user}) @@ -437,7 +450,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do def bookmark_status(%{assigns: %{user: user}} = conn, %{"id" => id}) do with %Activity{} = activity <- Repo.get(Activity, id), %User{} = user <- User.get_by_nickname(user.nickname), - true <- ActivityPub.visible_for_user?(activity, user), + true <- Visibility.visible_for_user?(activity, user), {:ok, user} <- User.bookmark(user, activity.data["object"]["id"]) do conn |> put_view(StatusView) @@ -448,7 +461,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do def unbookmark_status(%{assigns: %{user: user}} = conn, %{"id" => id}) do with %Activity{} = activity <- Repo.get(Activity, id), %User{} = user <- User.get_by_nickname(user.nickname), - true <- ActivityPub.visible_for_user?(activity, user), + true <- Visibility.visible_for_user?(activity, user), {:ok, user} <- User.unbookmark(user, activity.data["object"]["id"]) do conn |> put_view(StatusView) @@ -620,6 +633,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do |> Map.put("type", "Create") |> Map.put("local_only", local_only) |> Map.put("blocking_user", user) + |> Map.put("muting_user", user) |> Map.put("tag", tags) |> Map.put("tag_all", tag_all) |> Map.put("tag_reject", tag_reject) @@ -763,6 +777,41 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do end end + def mute(%{assigns: %{user: muter}} = conn, %{"id" => id}) do + with %User{} = muted <- Repo.get(User, id), + {:ok, muter} <- User.mute(muter, muted) do + conn + |> put_view(AccountView) + |> render("relationship.json", %{user: muter, target: muted}) + else + {:error, message} -> + conn + |> put_resp_content_type("application/json") + |> send_resp(403, Jason.encode!(%{"error" => message})) + end + end + + def unmute(%{assigns: %{user: muter}} = conn, %{"id" => id}) do + with %User{} = muted <- Repo.get(User, id), + {:ok, muter} <- User.unmute(muter, muted) do + conn + |> put_view(AccountView) + |> render("relationship.json", %{user: muter, target: muted}) + else + {:error, message} -> + conn + |> put_resp_content_type("application/json") + |> send_resp(403, Jason.encode!(%{"error" => message})) + end + end + + def mutes(%{assigns: %{user: user}} = conn, _) do + with muted_accounts <- User.muted_users(user) do + res = AccountView.render("accounts.json", users: muted_accounts, for: user, as: :user) + json(conn, res) + end + end + def block(%{assigns: %{user: blocker}} = conn, %{"id" => id}) do with %User{} = blocked <- Repo.get(User, id), {:ok, blocker} <- User.block(blocker, blocked), @@ -819,7 +868,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do if Regex.match?(~r/https?:/, query) do with {:ok, object} <- ActivityPub.fetch_object_from_id(query), %Activity{} = activity <- Activity.get_create_by_object_ap_id(object.data["id"]), - true <- ActivityPub.visible_for_user?(activity, user) do + true <- Visibility.visible_for_user?(activity, user) do [activity] else _e -> [] @@ -845,7 +894,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do end def search2(%{assigns: %{user: user}} = conn, %{"q" => query} = params) do - accounts = User.search(query, params["resolve"] == "true", user) + accounts = User.search(query, resolve: params["resolve"] == "true", for_user: user) statuses = status_search(user, query) @@ -870,7 +919,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do end def search(%{assigns: %{user: user}} = conn, %{"q" => query} = params) do - accounts = User.search(query, params["resolve"] == "true", user) + accounts = User.search(query, resolve: params["resolve"] == "true", for_user: user) statuses = status_search(user, query) @@ -892,7 +941,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do end def account_search(%{assigns: %{user: user}} = conn, %{"q" => query} = params) do - accounts = User.search(query, params["resolve"] == "true", user) + accounts = User.search(query, resolve: params["resolve"] == "true", for_user: user) res = AccountView.render("accounts.json", users: accounts, for: user, as: :user) @@ -1018,6 +1067,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do params |> Map.put("type", "Create") |> Map.put("blocking_user", user) + |> Map.put("muting_user", user) # we must filter the following list for the user to avoid leaking statuses the user # does not actually have permission to see (for more info, peruse security issue #270). @@ -1215,7 +1265,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do response_type: "code", client_id: app.client_id, redirect_uri: ".", - scope: app.scopes + scope: Enum.join(app.scopes, " ") ) conn @@ -1225,12 +1275,26 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do defp get_or_make_app() do find_attrs = %{client_name: @local_mastodon_name, redirect_uris: "."} + scopes = ["read", "write", "follow", "push"] with %App{} = app <- Repo.get_by(App, find_attrs) do + {:ok, app} = + if app.scopes == scopes do + {:ok, app} + else + app + |> Ecto.Changeset.change(%{scopes: scopes}) + |> Repo.update() + end + {:ok, app} else _e -> - cs = App.register_changeset(%App{}, Map.put(find_attrs, :scopes, "read,write,follow")) + cs = + App.register_changeset( + %App{}, + Map.put(find_attrs, :scopes, scopes) + ) Repo.insert(cs) end @@ -1455,9 +1519,9 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do end end - def status_card(conn, %{"id" => status_id}) do + def status_card(%{assigns: %{user: user}} = conn, %{"id" => status_id}) do with %Activity{} = activity <- Repo.get(Activity, status_id), - true <- ActivityPub.is_public?(activity) do + true <- Visibility.visible_for_user?(activity, user) do data = StatusView.render( "card.json", @@ -1471,6 +1535,20 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do end end + def reports(%{assigns: %{user: user}} = conn, params) do + case CommonAPI.report(user, params) do + {:ok, activity} -> + conn + |> put_view(ReportView) + |> try_render("report.json", %{activity: activity}) + + {:error, err} -> + conn + |> put_status(:bad_request) + |> json(%{error: err}) + end + end + def try_render(conn, target, params) when is_binary(target) do res = render(conn, target, params) diff --git a/lib/pleroma/web/mastodon_api/views/account_view.ex b/lib/pleroma/web/mastodon_api/views/account_view.ex index 9df9f14b2..c32f27be2 100644 --- a/lib/pleroma/web/mastodon_api/views/account_view.ex +++ b/lib/pleroma/web/mastodon_api/views/account_view.ex @@ -32,7 +32,11 @@ defmodule Pleroma.Web.MastodonAPI.AccountView do } end - def render("relationship.json", %{user: user, target: target}) do + def render("relationship.json", %{user: nil, target: _target}) do + %{} + end + + def render("relationship.json", %{user: %User{} = user, target: %User{} = target}) do follow_activity = Pleroma.Web.ActivityPub.Utils.fetch_latest_follow(user, target) requested = @@ -47,7 +51,7 @@ defmodule Pleroma.Web.MastodonAPI.AccountView do following: User.following?(user, target), followed_by: User.following?(target, user), blocking: User.blocks?(user, target), - muting: false, + muting: User.mutes?(user, target), muting_notifications: false, requested: requested, domain_blocking: false, @@ -85,6 +89,8 @@ defmodule Pleroma.Web.MastodonAPI.AccountView do bio = HTML.filter_tags(user.bio, User.html_filter_policy(opts[:for])) + relationship = render("relationship.json", %{user: opts[:for], target: user}) + %{ id: to_string(user.id), username: username_from_nickname(user.nickname), @@ -115,7 +121,8 @@ defmodule Pleroma.Web.MastodonAPI.AccountView do confirmation_pending: user_info.confirmation_pending, tags: user.tags, is_moderator: user.info.is_moderator, - is_admin: user.info.is_admin + is_admin: user.info.is_admin, + relationship: relationship } } end diff --git a/lib/pleroma/web/mastodon_api/views/admin/account_view.ex b/lib/pleroma/web/mastodon_api/views/admin/account_view.ex new file mode 100644 index 000000000..74ca13564 --- /dev/null +++ b/lib/pleroma/web/mastodon_api/views/admin/account_view.ex @@ -0,0 +1,25 @@ +# Pleroma: A lightweight social networking server +# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/> +# SPDX-License-Identifier: AGPL-3.0-only + +defmodule Pleroma.Web.MastodonAPI.Admin.AccountView do + use Pleroma.Web, :view + + alias Pleroma.Web.MastodonAPI.Admin.AccountView + + def render("index.json", %{users: users, count: count, page_size: page_size}) do + %{ + users: render_many(users, AccountView, "show.json", as: :user), + count: count, + page_size: page_size + } + end + + def render("show.json", %{user: user}) do + %{ + "id" => user.id, + "nickname" => user.nickname, + "deactivated" => user.info.deactivated + } + end +end diff --git a/lib/pleroma/web/mastodon_api/views/report_view.ex b/lib/pleroma/web/mastodon_api/views/report_view.ex new file mode 100644 index 000000000..a16e7ff10 --- /dev/null +++ b/lib/pleroma/web/mastodon_api/views/report_view.ex @@ -0,0 +1,14 @@ +# Pleroma: A lightweight social networking server +# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/> +# SPDX-License-Identifier: AGPL-3.0-only + +defmodule Pleroma.Web.MastodonAPI.ReportView do + use Pleroma.Web, :view + + def render("report.json", %{activity: activity}) do + %{ + id: to_string(activity.id), + action_taken: false + } + end +end diff --git a/lib/pleroma/web/mastodon_api/views/status_view.ex b/lib/pleroma/web/mastodon_api/views/status_view.ex index a49b381c9..3468c0e1c 100644 --- a/lib/pleroma/web/mastodon_api/views/status_view.ex +++ b/lib/pleroma/web/mastodon_api/views/status_view.ex @@ -144,10 +144,17 @@ defmodule Pleroma.Web.MastodonAPI.StatusView do card = render("card.json", Pleroma.Web.RichMedia.Helpers.fetch_data_for_activity(activity)) + url = + if user.local do + Pleroma.Web.Router.Helpers.o_status_url(Pleroma.Web.Endpoint, :notice, activity) + else + object["external_url"] || object["id"] + end + %{ id: to_string(activity.id), uri: object["id"], - url: object["external_url"] || object["id"], + url: url, account: AccountView.render("account.json", %{user: user}), in_reply_to_id: reply_to && to_string(reply_to.id), in_reply_to_account_id: reply_to_user && to_string(reply_to_user.id), @@ -161,7 +168,7 @@ defmodule Pleroma.Web.MastodonAPI.StatusView do reblogged: present?(repeated), favourited: present?(favorited), bookmarked: present?(bookmarked), - muted: CommonAPI.thread_muted?(user, activity), + muted: CommonAPI.thread_muted?(user, activity) || User.mutes?(opts[:for], user), pinned: pinned?(activity, user), sensitive: sensitive, spoiler_text: object["summary"] || "", diff --git a/lib/pleroma/web/mastodon_api/websocket_handler.ex b/lib/pleroma/web/mastodon_api/websocket_handler.ex index ea75070c4..8efe2efd5 100644 --- a/lib/pleroma/web/mastodon_api/websocket_handler.ex +++ b/lib/pleroma/web/mastodon_api/websocket_handler.ex @@ -9,7 +9,7 @@ defmodule Pleroma.Web.MastodonAPI.WebsocketHandler do alias Pleroma.Repo alias Pleroma.User - @behaviour :cowboy_websocket_handler + @behaviour :cowboy_websocket @streams [ "public", @@ -26,37 +26,37 @@ defmodule Pleroma.Web.MastodonAPI.WebsocketHandler do # Handled by periodic keepalive in Pleroma.Web.Streamer. @timeout :infinity - def init(_type, _req, _opts) do - {:upgrade, :protocol, :cowboy_websocket} - end - - def websocket_init(_type, req, _opts) do - with {qs, req} <- :cowboy_req.qs(req), - params <- :cow_qs.parse_qs(qs), + def init(%{qs: qs} = req, state) do + with params <- :cow_qs.parse_qs(qs), access_token <- List.keyfind(params, "access_token", 0), {_, stream} <- List.keyfind(params, "stream", 0), {:ok, user} <- allow_request(stream, access_token), topic when is_binary(topic) <- expand_topic(stream, params) do - send(self(), :subscribe) - {:ok, req, %{user: user, topic: topic}, @timeout} + {:cowboy_websocket, req, %{user: user, topic: topic}, %{idle_timeout: @timeout}} else {:error, code} -> Logger.debug("#{__MODULE__} denied connection: #{inspect(code)} - #{inspect(req)}") {:ok, req} = :cowboy_req.reply(code, req) - {:shutdown, req} + {:ok, req, state} error -> Logger.debug("#{__MODULE__} denied connection: #{inspect(error)} - #{inspect(req)}") - {:shutdown, req} + {:ok, req} = :cowboy_req.reply(400, req) + {:ok, req, state} end end + def websocket_init(state) do + send(self(), :subscribe) + {:ok, state} + end + # We never receive messages. - def websocket_handle(_frame, req, state) do - {:ok, req, state} + def websocket_handle(_frame, state) do + {:ok, state} end - def websocket_info(:subscribe, req, state) do + def websocket_info(:subscribe, state) do Logger.debug( "#{__MODULE__} accepted websocket connection for user #{ (state.user || %{id: "anonymous"}).id @@ -64,14 +64,14 @@ defmodule Pleroma.Web.MastodonAPI.WebsocketHandler do ) Pleroma.Web.Streamer.add_socket(state.topic, streamer_socket(state)) - {:ok, req, state} + {:ok, state} end - def websocket_info({:text, message}, req, state) do - {:reply, {:text, message}, req, state} + def websocket_info({:text, message}, state) do + {:reply, {:text, message}, state} end - def websocket_terminate(reason, _req, state) do + def terminate(reason, _req, state) do Logger.debug( "#{__MODULE__} terminating websocket connection for user #{ (state.user || %{id: "anonymous"}).id diff --git a/lib/pleroma/web/metadata/opengraph.ex b/lib/pleroma/web/metadata/opengraph.ex index 190377767..cafb8134b 100644 --- a/lib/pleroma/web/metadata/opengraph.ex +++ b/lib/pleroma/web/metadata/opengraph.ex @@ -3,12 +3,10 @@ # SPDX-License-Identifier: AGPL-3.0-only defmodule Pleroma.Web.Metadata.Providers.OpenGraph do - alias Pleroma.HTML - alias Pleroma.Formatter alias Pleroma.User alias Pleroma.Web.Metadata - alias Pleroma.Web.MediaProxy alias Pleroma.Web.Metadata.Providers.Provider + alias Pleroma.Web.Metadata.Utils @behaviour Provider @@ -19,7 +17,7 @@ defmodule Pleroma.Web.Metadata.Providers.OpenGraph do user: user }) do attachments = build_attachments(object) - scrubbed_content = scrub_html_and_truncate(object) + scrubbed_content = Utils.scrub_html_and_truncate(object) # Zero width space content = if scrubbed_content != "" and scrubbed_content != "\u200B" do @@ -44,13 +42,14 @@ defmodule Pleroma.Web.Metadata.Providers.OpenGraph do {:meta, [ property: "og:description", - content: "#{user_name_string(user)}" <> content + content: "#{Utils.user_name_string(user)}" <> content ], []}, {:meta, [property: "og:type", content: "website"], []} ] ++ if attachments == [] or Metadata.activity_nsfw?(object) do [ - {:meta, [property: "og:image", content: attachment_url(User.avatar_url(user))], []}, + {:meta, [property: "og:image", content: Utils.attachment_url(User.avatar_url(user))], + []}, {:meta, [property: "og:image:width", content: 150], []}, {:meta, [property: "og:image:height", content: 150], []} ] @@ -61,17 +60,17 @@ defmodule Pleroma.Web.Metadata.Providers.OpenGraph do @impl Provider def build_tags(%{user: user}) do - with truncated_bio = scrub_html_and_truncate(user.bio || "") do + with truncated_bio = Utils.scrub_html_and_truncate(user.bio || "") do [ {:meta, [ property: "og:title", - content: user_name_string(user) + content: Utils.user_name_string(user) ], []}, {:meta, [property: "og:url", content: User.profile_url(user)], []}, {:meta, [property: "og:description", content: truncated_bio], []}, {:meta, [property: "og:type", content: "website"], []}, - {:meta, [property: "og:image", content: attachment_url(User.avatar_url(user))], []}, + {:meta, [property: "og:image", content: Utils.attachment_url(User.avatar_url(user))], []}, {:meta, [property: "og:image:width", content: 150], []}, {:meta, [property: "og:image:height", content: 150], []} ] @@ -93,14 +92,15 @@ defmodule Pleroma.Web.Metadata.Providers.OpenGraph do case media_type do "audio" -> [ - {:meta, [property: "og:" <> media_type, content: attachment_url(url["href"])], []} + {:meta, + [property: "og:" <> media_type, content: Utils.attachment_url(url["href"])], []} | acc ] "image" -> [ - {:meta, [property: "og:" <> media_type, content: attachment_url(url["href"])], - []}, + {:meta, + [property: "og:" <> media_type, content: Utils.attachment_url(url["href"])], []}, {:meta, [property: "og:image:width", content: 150], []}, {:meta, [property: "og:image:height", content: 150], []} | acc @@ -108,7 +108,8 @@ defmodule Pleroma.Web.Metadata.Providers.OpenGraph do "video" -> [ - {:meta, [property: "og:" <> media_type, content: attachment_url(url["href"])], []} + {:meta, + [property: "og:" <> media_type, content: Utils.attachment_url(url["href"])], []} | acc ] @@ -120,37 +121,4 @@ defmodule Pleroma.Web.Metadata.Providers.OpenGraph do acc ++ rendered_tags end) end - - defp scrub_html_and_truncate(%{data: %{"content" => content}} = object) do - content - # html content comes from DB already encoded, decode first and scrub after - |> HtmlEntities.decode() - |> String.replace(~r/<br\s?\/?>/, " ") - |> HTML.get_cached_stripped_html_for_object(object, __MODULE__) - |> Formatter.demojify() - |> Formatter.truncate() - end - - defp scrub_html_and_truncate(content) when is_binary(content) do - content - # html content comes from DB already encoded, decode first and scrub after - |> HtmlEntities.decode() - |> String.replace(~r/<br\s?\/?>/, " ") - |> HTML.strip_tags() - |> Formatter.demojify() - |> Formatter.truncate() - end - - defp attachment_url(url) do - MediaProxy.url(url) - end - - defp user_name_string(user) do - "#{user.name} " <> - if user.local do - "(@#{user.nickname}@#{Pleroma.Web.Endpoint.host()})" - else - "(@#{user.nickname})" - end - end end diff --git a/lib/pleroma/web/metadata/player_view.ex b/lib/pleroma/web/metadata/player_view.ex new file mode 100644 index 000000000..e9a8cfc8d --- /dev/null +++ b/lib/pleroma/web/metadata/player_view.ex @@ -0,0 +1,21 @@ +defmodule Pleroma.Web.Metadata.PlayerView do + use Pleroma.Web, :view + import Phoenix.HTML.Tag, only: [content_tag: 3, tag: 2] + + def render("player.html", %{"mediaType" => type, "href" => href}) do + {tag_type, tag_attrs} = + case type do + "audio" <> _ -> {:audio, []} + "video" <> _ -> {:video, [loop: true]} + end + + content_tag( + tag_type, + [ + tag(:source, src: href, type: type), + "Your browser does not support #{type} playback." + ], + [controls: true] ++ tag_attrs + ) + end +end diff --git a/lib/pleroma/web/metadata/twitter_card.ex b/lib/pleroma/web/metadata/twitter_card.ex index 32b979357..a0be383e5 100644 --- a/lib/pleroma/web/metadata/twitter_card.ex +++ b/lib/pleroma/web/metadata/twitter_card.ex @@ -3,44 +3,120 @@ # SPDX-License-Identifier: AGPL-3.0-only defmodule Pleroma.Web.Metadata.Providers.TwitterCard do - alias Pleroma.Web.Metadata.Providers.Provider + alias Pleroma.User alias Pleroma.Web.Metadata + alias Pleroma.Web.Metadata.Providers.Provider + alias Pleroma.Web.Metadata.Utils @behaviour Provider @impl Provider - def build_tags(%{object: object}) do - if Metadata.activity_nsfw?(object) or object.data["attachment"] == [] do - build_tags(nil) - else - case find_first_acceptable_media_type(object) do - "image" -> - [{:meta, [property: "twitter:card", content: "summary_large_image"], []}] - - "audio" -> - [{:meta, [property: "twitter:card", content: "player"], []}] - - "video" -> - [{:meta, [property: "twitter:card", content: "player"], []}] - - _ -> - build_tags(nil) + def build_tags(%{ + activity_id: id, + object: object, + user: user + }) do + attachments = build_attachments(id, object) + scrubbed_content = Utils.scrub_html_and_truncate(object) + # Zero width space + content = + if scrubbed_content != "" and scrubbed_content != "\u200B" do + "“" <> scrubbed_content <> "”" + else + "" + end + + [ + {:meta, + [ + property: "twitter:title", + content: Utils.user_name_string(user) + ], []}, + {:meta, + [ + property: "twitter:description", + content: content + ], []} + ] ++ + if attachments == [] or Metadata.activity_nsfw?(object) do + [ + {:meta, + [property: "twitter:image", content: Utils.attachment_url(User.avatar_url(user))], []}, + {:meta, [property: "twitter:card", content: "summary_large_image"], []} + ] + else + attachments end - end end @impl Provider - def build_tags(_) do - [{:meta, [property: "twitter:card", content: "summary"], []}] + def build_tags(%{user: user}) do + with truncated_bio = Utils.scrub_html_and_truncate(user.bio || "") do + [ + {:meta, + [ + property: "twitter:title", + content: Utils.user_name_string(user) + ], []}, + {:meta, [property: "twitter:description", content: truncated_bio], []}, + {:meta, [property: "twitter:image", content: Utils.attachment_url(User.avatar_url(user))], + []}, + {:meta, [property: "twitter:card", content: "summary"], []} + ] + end end - def find_first_acceptable_media_type(%{data: %{"attachment" => attachment}}) do - Enum.find_value(attachment, fn attachment -> - Enum.find_value(attachment["url"], fn url -> - Enum.find(["image", "audio", "video"], fn media_type -> - String.starts_with?(url["mediaType"], media_type) + defp build_attachments(id, %{data: %{"attachment" => attachments}}) do + Enum.reduce(attachments, [], fn attachment, acc -> + rendered_tags = + Enum.reduce(attachment["url"], [], fn url, acc -> + media_type = + Enum.find(["image", "audio", "video"], fn media_type -> + String.starts_with?(url["mediaType"], media_type) + end) + + # TODO: Add additional properties to objects when we have the data available. + case media_type do + "audio" -> + [ + {:meta, [property: "twitter:card", content: "player"], []}, + {:meta, [property: "twitter:player:width", content: "480"], []}, + {:meta, [property: "twitter:player:height", content: "80"], []}, + {:meta, [property: "twitter:player", content: player_url(id)], []} + | acc + ] + + "image" -> + [ + {:meta, [property: "twitter:card", content: "summary_large_image"], []}, + {:meta, + [ + property: "twitter:player", + content: Utils.attachment_url(url["href"]) + ], []} + | acc + ] + + # TODO: Need the true width and height values here or Twitter renders an iFrame with a bad aspect ratio + "video" -> + [ + {:meta, [property: "twitter:card", content: "player"], []}, + {:meta, [property: "twitter:player", content: player_url(id)], []}, + {:meta, [property: "twitter:player:width", content: "480"], []}, + {:meta, [property: "twitter:player:height", content: "480"], []} + | acc + ] + + _ -> + acc + end end) - end) + + acc ++ rendered_tags end) end + + defp player_url(id) do + Pleroma.Web.Router.Helpers.o_status_url(Pleroma.Web.Endpoint, :notice_player, id) + end end diff --git a/lib/pleroma/web/metadata/utils.ex b/lib/pleroma/web/metadata/utils.ex new file mode 100644 index 000000000..a166800d4 --- /dev/null +++ b/lib/pleroma/web/metadata/utils.ex @@ -0,0 +1,42 @@ +# Pleroma: A lightweight social networking server +# Copyright \xc2\xa9 2017-2019 Pleroma Authors <https://pleroma.social/> +# SPDX-License-Identifier: AGPL-3.0-only + +defmodule Pleroma.Web.Metadata.Utils do + alias Pleroma.HTML + alias Pleroma.Formatter + alias Pleroma.Web.MediaProxy + + def scrub_html_and_truncate(%{data: %{"content" => content}} = object) do + content + # html content comes from DB already encoded, decode first and scrub after + |> HtmlEntities.decode() + |> String.replace(~r/<br\s?\/?>/, " ") + |> HTML.get_cached_stripped_html_for_object(object, __MODULE__) + |> Formatter.demojify() + |> Formatter.truncate() + end + + def scrub_html_and_truncate(content) when is_binary(content) do + content + # html content comes from DB already encoded, decode first and scrub after + |> HtmlEntities.decode() + |> String.replace(~r/<br\s?\/?>/, " ") + |> HTML.strip_tags() + |> Formatter.demojify() + |> Formatter.truncate() + end + + def attachment_url(url) do + MediaProxy.url(url) + end + + def user_name_string(user) do + "#{user.name} " <> + if user.local do + "(@#{user.nickname}@#{Pleroma.Web.Endpoint.host()})" + else + "(@#{user.nickname})" + end + end +end diff --git a/lib/pleroma/web/oauth.ex b/lib/pleroma/web/oauth.ex new file mode 100644 index 000000000..d2835a0ba --- /dev/null +++ b/lib/pleroma/web/oauth.ex @@ -0,0 +1,20 @@ +# Pleroma: A lightweight social networking server +# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/> +# SPDX-License-Identifier: AGPL-3.0-only + +defmodule Pleroma.Web.OAuth do + def parse_scopes(scopes, _default) when is_list(scopes) do + Enum.filter(scopes, &(&1 not in [nil, ""])) + end + + def parse_scopes(scopes, default) when is_binary(scopes) do + scopes + |> String.trim() + |> String.split(~r/[\s,]+/) + |> parse_scopes(default) + end + + def parse_scopes(_, default) do + default + end +end diff --git a/lib/pleroma/web/oauth/app.ex b/lib/pleroma/web/oauth/app.ex index 8b61bf3a4..3476da484 100644 --- a/lib/pleroma/web/oauth/app.ex +++ b/lib/pleroma/web/oauth/app.ex @@ -9,7 +9,7 @@ defmodule Pleroma.Web.OAuth.App do schema "apps" do field(:client_name, :string) field(:redirect_uris, :string) - field(:scopes, :string) + field(:scopes, {:array, :string}, default: []) field(:website, :string) field(:client_id, :string) field(:client_secret, :string) diff --git a/lib/pleroma/web/oauth/authorization.ex b/lib/pleroma/web/oauth/authorization.ex index 9039b8b45..d37c2cb83 100644 --- a/lib/pleroma/web/oauth/authorization.ex +++ b/lib/pleroma/web/oauth/authorization.ex @@ -15,6 +15,7 @@ defmodule Pleroma.Web.OAuth.Authorization do schema "oauth_authorizations" do field(:token, :string) + field(:scopes, {:array, :string}, default: []) field(:valid_until, :naive_datetime) field(:used, :boolean, default: false) belongs_to(:user, Pleroma.User, type: Pleroma.FlakeId) @@ -23,7 +24,8 @@ defmodule Pleroma.Web.OAuth.Authorization do timestamps() end - def create_authorization(%App{} = app, %User{} = user) do + def create_authorization(%App{} = app, %User{} = user, scopes \\ nil) do + scopes = scopes || app.scopes token = :crypto.strong_rand_bytes(32) |> Base.url_encode64(padding: false) authorization = %Authorization{ @@ -31,6 +33,7 @@ defmodule Pleroma.Web.OAuth.Authorization do used: false, user_id: user.id, app_id: app.id, + scopes: scopes, valid_until: NaiveDateTime.add(NaiveDateTime.utc_now(), 60 * 10) } diff --git a/lib/pleroma/web/oauth/oauth_controller.ex b/lib/pleroma/web/oauth/oauth_controller.ex index dddfcf299..36318d69b 100644 --- a/lib/pleroma/web/oauth/oauth_controller.ex +++ b/lib/pleroma/web/oauth/oauth_controller.ex @@ -5,6 +5,7 @@ defmodule Pleroma.Web.OAuth.OAuthController do use Pleroma.Web, :controller + alias Pleroma.Web.Auth.Authenticator alias Pleroma.Web.OAuth.Authorization alias Pleroma.Web.OAuth.Token alias Pleroma.Web.OAuth.App @@ -12,39 +13,48 @@ defmodule Pleroma.Web.OAuth.OAuthController do alias Pleroma.User alias Comeonin.Pbkdf2 + import Pleroma.Web.ControllerHelper, only: [oauth_scopes: 2] + plug(:fetch_session) plug(:fetch_flash) action_fallback(Pleroma.Web.OAuth.FallbackController) def authorize(conn, params) do - render(conn, "show.html", %{ + app = Repo.get_by(App, client_id: params["client_id"]) + available_scopes = (app && app.scopes) || [] + scopes = oauth_scopes(params, nil) || available_scopes + + render(conn, Authenticator.auth_template(), %{ response_type: params["response_type"], client_id: params["client_id"], - scope: params["scope"], + available_scopes: available_scopes, + scopes: scopes, redirect_uri: params["redirect_uri"], - state: params["state"] + state: params["state"], + params: params }) end def create_authorization(conn, %{ "authorization" => %{ - "name" => name, - "password" => password, "client_id" => client_id, "redirect_uri" => redirect_uri - } = params + } = auth_params }) do - with %User{} = user <- User.get_by_nickname_or_email(name), - true <- Pbkdf2.checkpw(password, user.password_hash), - {:auth_active, true} <- {:auth_active, User.auth_active?(user)}, + with {_, {:ok, %User{} = user}} <- {:get_user, Authenticator.get_user(conn)}, %App{} = app <- Repo.get_by(App, client_id: client_id), true <- redirect_uri in String.split(app.redirect_uris), - {:ok, auth} <- Authorization.create_authorization(app, user) do - # Special case: Local MastodonFE. + scopes <- oauth_scopes(auth_params, []), + {:unsupported_scopes, []} <- {:unsupported_scopes, scopes -- app.scopes}, + # Note: `scope` param is intentionally not optional in this context + {:missing_scopes, false} <- {:missing_scopes, scopes == []}, + {:auth_active, true} <- {:auth_active, User.auth_active?(user)}, + {:ok, auth} <- Authorization.create_authorization(app, user, scopes) do redirect_uri = if redirect_uri == "." do + # Special case: Local MastodonFE mastodon_api_url(conn, :login) else redirect_uri @@ -62,8 +72,8 @@ defmodule Pleroma.Web.OAuth.OAuthController do url_params = %{:code => auth.token} url_params = - if params["state"] do - Map.put(url_params, :state, params["state"]) + if auth_params["state"] do + Map.put(url_params, :state, auth_params["state"]) else url_params end @@ -73,19 +83,23 @@ defmodule Pleroma.Web.OAuth.OAuthController do redirect(conn, external: url) end else + {scopes_issue, _} when scopes_issue in [:unsupported_scopes, :missing_scopes] -> + conn + |> put_flash(:error, "Permissions not specified.") + |> put_status(:unauthorized) + |> authorize(auth_params) + {:auth_active, false} -> conn - |> put_flash(:error, "Account confirmation pending") + |> put_flash(:error, "Account confirmation pending.") |> put_status(:forbidden) - |> authorize(params) + |> authorize(auth_params) error -> - error + Authenticator.handle_error(conn, error) end end - # TODO - # - proper scope handling def token_exchange(conn, %{"grant_type" => "authorization_code"} = params) do with %App{} = app <- get_app_from_request(conn, params), fixed_token = fix_padding(params["code"]), @@ -99,7 +113,7 @@ defmodule Pleroma.Web.OAuth.OAuthController do refresh_token: token.refresh_token, created_at: DateTime.to_unix(inserted_at), expires_in: 60 * 10, - scope: "read write follow" + scope: Enum.join(token.scopes, " ") } json(conn, response) @@ -110,8 +124,6 @@ defmodule Pleroma.Web.OAuth.OAuthController do end end - # TODO - # - investigate a way to verify the user wants to grant read/write/follow once scope handling is done def token_exchange( conn, %{"grant_type" => "password", "username" => name, "password" => password} = params @@ -120,14 +132,17 @@ defmodule Pleroma.Web.OAuth.OAuthController do %User{} = user <- User.get_by_nickname_or_email(name), true <- Pbkdf2.checkpw(password, user.password_hash), {:auth_active, true} <- {:auth_active, User.auth_active?(user)}, - {:ok, auth} <- Authorization.create_authorization(app, user), + scopes <- oauth_scopes(params, app.scopes), + [] <- scopes -- app.scopes, + true <- Enum.any?(scopes), + {:ok, auth} <- Authorization.create_authorization(app, user, scopes), {:ok, token} <- Token.exchange_token(app, auth) do response = %{ token_type: "Bearer", access_token: token.token, refresh_token: token.refresh_token, expires_in: 60 * 10, - scope: "read write follow" + scope: Enum.join(token.scopes, " ") } json(conn, response) diff --git a/lib/pleroma/web/oauth/token.ex b/lib/pleroma/web/oauth/token.ex index 71fd1b874..ca67632ba 100644 --- a/lib/pleroma/web/oauth/token.ex +++ b/lib/pleroma/web/oauth/token.ex @@ -16,6 +16,7 @@ defmodule Pleroma.Web.OAuth.Token do schema "oauth_tokens" do field(:token, :string) field(:refresh_token, :string) + field(:scopes, {:array, :string}, default: []) field(:valid_until, :naive_datetime) belongs_to(:user, Pleroma.User, type: Pleroma.FlakeId) belongs_to(:app, App) @@ -26,17 +27,19 @@ defmodule Pleroma.Web.OAuth.Token do def exchange_token(app, auth) do with {:ok, auth} <- Authorization.use_token(auth), true <- auth.app_id == app.id do - create_token(app, Repo.get(User, auth.user_id)) + create_token(app, Repo.get(User, auth.user_id), auth.scopes) end end - def create_token(%App{} = app, %User{} = user) do + def create_token(%App{} = app, %User{} = user, scopes \\ nil) do + scopes = scopes || app.scopes token = :crypto.strong_rand_bytes(32) |> Base.url_encode64(padding: false) refresh_token = :crypto.strong_rand_bytes(32) |> Base.url_encode64(padding: false) token = %Token{ token: token, refresh_token: refresh_token, + scopes: scopes, user_id: user.id, app_id: app.id, valid_until: NaiveDateTime.add(NaiveDateTime.utc_now(), 60 * 10) diff --git a/lib/pleroma/web/ostatus/ostatus_controller.ex b/lib/pleroma/web/ostatus/ostatus_controller.ex index bab3da2b0..4e963774a 100644 --- a/lib/pleroma/web/ostatus/ostatus_controller.ex +++ b/lib/pleroma/web/ostatus/ostatus_controller.ex @@ -9,6 +9,7 @@ defmodule Pleroma.Web.OStatus.OStatusController do alias Pleroma.Object alias Pleroma.User alias Pleroma.Web.ActivityPub.ActivityPub + alias Pleroma.Web.ActivityPub.Visibility alias Pleroma.Web.ActivityPub.ActivityPubController alias Pleroma.Web.ActivityPub.ObjectView alias Pleroma.Web.OStatus.ActivityRepresenter @@ -33,6 +34,9 @@ defmodule Pleroma.Web.OStatus.OStatusController do "activity+json" -> ActivityPubController.call(conn, :user) + "json" -> + ActivityPubController.call(conn, :user) + _ -> with %User{} = user <- User.get_cached_by_nickname(nickname) do redirect(conn, external: OStatus.feed_path(user)) @@ -94,12 +98,12 @@ defmodule Pleroma.Web.OStatus.OStatusController do end def object(conn, %{"uuid" => uuid}) do - if get_format(conn) == "activity+json" do + if get_format(conn) in ["activity+json", "json"] do ActivityPubController.call(conn, :object) else with id <- o_status_url(conn, :object, uuid), {_, %Activity{} = activity} <- {:activity, Activity.get_create_by_object_ap_id(id)}, - {_, true} <- {:public?, ActivityPub.is_public?(activity)}, + {_, true} <- {:public?, Visibility.is_public?(activity)}, %User{} = user <- User.get_cached_by_ap_id(activity.data["actor"]) do case get_format(conn) do "html" -> redirect(conn, to: "/notice/#{activity.id}") @@ -119,12 +123,12 @@ defmodule Pleroma.Web.OStatus.OStatusController do end def activity(conn, %{"uuid" => uuid}) do - if get_format(conn) == "activity+json" do + if get_format(conn) in ["activity+json", "json"] do ActivityPubController.call(conn, :activity) else with id <- o_status_url(conn, :activity, uuid), {_, %Activity{} = activity} <- {:activity, Activity.normalize(id)}, - {_, true} <- {:public?, ActivityPub.is_public?(activity)}, + {_, true} <- {:public?, Visibility.is_public?(activity)}, %User{} = user <- User.get_cached_by_ap_id(activity.data["actor"]) do case format = get_format(conn) do "html" -> redirect(conn, to: "/notice/#{activity.id}") @@ -145,7 +149,7 @@ defmodule Pleroma.Web.OStatus.OStatusController do def notice(conn, %{"id" => id}) do with {_, %Activity{} = activity} <- {:activity, Activity.get_by_id(id)}, - {_, true} <- {:public?, ActivityPub.is_public?(activity)}, + {_, true} <- {:public?, Visibility.is_public?(activity)}, %User{} = user <- User.get_cached_by_ap_id(activity.data["actor"]) do case format = get_format(conn) do "html" -> @@ -153,6 +157,7 @@ defmodule Pleroma.Web.OStatus.OStatusController do %Object{} = object = Object.normalize(activity.data["object"]) Fallback.RedirectController.redirector_with_meta(conn, %{ + activity_id: activity.id, object: object, url: Pleroma.Web.Router.Helpers.o_status_url( @@ -184,6 +189,30 @@ defmodule Pleroma.Web.OStatus.OStatusController do end end + # Returns an HTML embedded <audio> or <video> player suitable for embed iframes. + def notice_player(conn, %{"id" => id}) do + with %Activity{data: %{"type" => "Create"}} = activity <- Activity.get_by_id(id), + true <- Visibility.is_public?(activity), + %Object{} = object <- Object.normalize(activity.data["object"]), + %{data: %{"attachment" => [%{"url" => [url | _]} | _]}} <- object, + true <- String.starts_with?(url["mediaType"], ["audio", "video"]) do + conn + |> put_layout(:metadata_player) + |> put_resp_header("x-frame-options", "ALLOW") + |> put_resp_header( + "content-security-policy", + "default-src 'none';style-src 'self' 'unsafe-inline';img-src 'self' data: https:; media-src 'self' https:;" + ) + |> put_view(Pleroma.Web.Metadata.PlayerView) + |> render("player.html", url) + else + _error -> + conn + |> put_status(404) + |> Fallback.RedirectController.redirector(nil, 404) + end + end + defp represent_activity( conn, "activity+json", diff --git a/lib/pleroma/web/rel_me.ex b/lib/pleroma/web/rel_me.ex new file mode 100644 index 000000000..a07db966f --- /dev/null +++ b/lib/pleroma/web/rel_me.ex @@ -0,0 +1,51 @@ +# Pleroma: A lightweight social networking server +# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/> +# SPDX-License-Identifier: AGPL-3.0-only + +defmodule Pleroma.Web.RelMe do + @hackney_options [ + pool: :media, + timeout: 2_000, + recv_timeout: 2_000, + max_body: 2_000_000 + ] + + if Mix.env() == :test do + def parse(url) when is_binary(url), do: parse_url(url) + else + def parse(url) when is_binary(url) do + Cachex.fetch!(:rel_me_cache, url, fn _ -> + {:commit, parse_url(url)} + end) + rescue + e -> {:error, "Cachex error: #{inspect(e)}"} + end + end + + def parse(_), do: {:error, "No URL provided"} + + defp parse_url(url) do + {:ok, %Tesla.Env{body: html}} = Pleroma.HTTP.get(url, [], adapter: @hackney_options) + + data = + Floki.attribute(html, "link[rel=me]", "href") ++ Floki.attribute(html, "a[rel=me]", "href") + + {:ok, data} + rescue + e -> {:error, "Parsing error: #{inspect(e)}"} + end + + def maybe_put_rel_me("http" <> _ = target_page, profile_urls) when is_list(profile_urls) do + {:ok, rel_me_hrefs} = parse(target_page) + + true = Enum.any?(rel_me_hrefs, fn x -> x in profile_urls end) + + "me" + rescue + _ -> nil + end + + def maybe_put_rel_me(_, _) do + nil + end +end diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex index a4a382110..6fcb46878 100644 --- a/lib/pleroma/web/router.ex +++ b/lib/pleroma/web/router.ex @@ -74,6 +74,29 @@ defmodule Pleroma.Web.Router do plug(Pleroma.Plugs.EnsureUserKeyPlug) end + pipeline :oauth_read_or_unauthenticated do + plug(Pleroma.Plugs.OAuthScopesPlug, %{ + scopes: ["read"], + fallback: :proceed_unauthenticated + }) + end + + pipeline :oauth_read do + plug(Pleroma.Plugs.OAuthScopesPlug, %{scopes: ["read"]}) + end + + pipeline :oauth_write do + plug(Pleroma.Plugs.OAuthScopesPlug, %{scopes: ["write"]}) + end + + pipeline :oauth_follow do + plug(Pleroma.Plugs.OAuthScopesPlug, %{scopes: ["follow"]}) + end + + pipeline :oauth_push do + plug(Pleroma.Plugs.OAuthScopesPlug, %{scopes: ["push"]}) + end + pipeline :well_known do plug(:accepts, ["json", "jrd+json", "xml", "xrd+xml"]) end @@ -101,6 +124,7 @@ defmodule Pleroma.Web.Router do scope "/api/pleroma", Pleroma.Web.TwitterAPI do pipe_through(:pleroma_api) + get("/password_reset/:token", UtilController, :show_password_reset) post("/password_reset", UtilController, :password_reset) get("/emoji", UtilController, :emoji) @@ -113,8 +137,12 @@ defmodule Pleroma.Web.Router do end scope "/api/pleroma/admin", Pleroma.Web.AdminAPI do - pipe_through(:admin_api) + pipe_through([:admin_api, :oauth_write]) + + get("/users", AdminAPIController, :list_users) + get("/users/search", AdminAPIController, :search_users) delete("/user", AdminAPIController, :user_delete) + patch("/users/:nickname/toggle_activation", AdminAPIController, :user_toggle_activation) post("/user", AdminAPIController, :user_create) put("/users/tag", AdminAPIController, :tag_users) delete("/users/tag", AdminAPIController, :untag_users) @@ -137,17 +165,32 @@ defmodule Pleroma.Web.Router do scope "/", Pleroma.Web.TwitterAPI do pipe_through(:pleroma_html) - get("/ostatus_subscribe", UtilController, :remote_follow) - post("/ostatus_subscribe", UtilController, :do_remote_follow) + post("/main/ostatus", UtilController, :remote_subscribe) + get("/ostatus_subscribe", UtilController, :remote_follow) + + scope [] do + pipe_through(:oauth_follow) + post("/ostatus_subscribe", UtilController, :do_remote_follow) + end end scope "/api/pleroma", Pleroma.Web.TwitterAPI do pipe_through(:authenticated_api) - post("/blocks_import", UtilController, :blocks_import) - post("/follow_import", UtilController, :follow_import) - post("/change_password", UtilController, :change_password) - post("/delete_account", UtilController, :delete_account) + + scope [] do + pipe_through(:oauth_write) + + post("/change_password", UtilController, :change_password) + post("/delete_account", UtilController, :delete_account) + end + + scope [] do + pipe_through(:oauth_follow) + + post("/blocks_import", UtilController, :blocks_import) + post("/follow_import", UtilController, :follow_import) + end end scope "/oauth", Pleroma.Web.OAuth do @@ -160,124 +203,156 @@ defmodule Pleroma.Web.Router do scope "/api/v1", Pleroma.Web.MastodonAPI do pipe_through(:authenticated_api) - patch("/accounts/update_credentials", MastodonAPIController, :update_credentials) - get("/accounts/verify_credentials", MastodonAPIController, :verify_credentials) - get("/accounts/relationships", MastodonAPIController, :relationships) - get("/accounts/search", MastodonAPIController, :account_search) - post("/accounts/:id/follow", MastodonAPIController, :follow) - post("/accounts/:id/unfollow", MastodonAPIController, :unfollow) - post("/accounts/:id/block", MastodonAPIController, :block) - post("/accounts/:id/unblock", MastodonAPIController, :unblock) - post("/accounts/:id/mute", MastodonAPIController, :relationship_noop) - post("/accounts/:id/unmute", MastodonAPIController, :relationship_noop) - get("/accounts/:id/lists", MastodonAPIController, :account_lists) + scope [] do + pipe_through(:oauth_read) + + get("/accounts/verify_credentials", MastodonAPIController, :verify_credentials) + + get("/accounts/relationships", MastodonAPIController, :relationships) + get("/accounts/search", MastodonAPIController, :account_search) + + get("/accounts/:id/lists", MastodonAPIController, :account_lists) + + get("/follow_requests", MastodonAPIController, :follow_requests) + get("/blocks", MastodonAPIController, :blocks) + get("/mutes", MastodonAPIController, :mutes) + + get("/timelines/home", MastodonAPIController, :home_timeline) + get("/timelines/direct", MastodonAPIController, :dm_timeline) + + get("/favourites", MastodonAPIController, :favourites) + get("/bookmarks", MastodonAPIController, :bookmarks) - get("/follow_requests", MastodonAPIController, :follow_requests) - post("/follow_requests/:id/authorize", MastodonAPIController, :authorize_follow_request) - post("/follow_requests/:id/reject", MastodonAPIController, :reject_follow_request) + post("/notifications/clear", MastodonAPIController, :clear_notifications) + post("/notifications/dismiss", MastodonAPIController, :dismiss_notification) + get("/notifications", MastodonAPIController, :notifications) + get("/notifications/:id", MastodonAPIController, :get_notification) - post("/follows", MastodonAPIController, :follow) + get("/lists", MastodonAPIController, :get_lists) + get("/lists/:id", MastodonAPIController, :get_list) + get("/lists/:id/accounts", MastodonAPIController, :list_accounts) - get("/blocks", MastodonAPIController, :blocks) + get("/domain_blocks", MastodonAPIController, :domain_blocks) - get("/mutes", MastodonAPIController, :empty_array) + get("/filters", MastodonAPIController, :get_filters) - get("/timelines/home", MastodonAPIController, :home_timeline) + get("/suggestions", MastodonAPIController, :suggestions) - get("/timelines/direct", MastodonAPIController, :dm_timeline) + get("/endorsements", MastodonAPIController, :empty_array) - get("/favourites", MastodonAPIController, :favourites) - get("/bookmarks", MastodonAPIController, :bookmarks) + get("/pleroma/flavour", MastodonAPIController, :get_flavour) + end + + scope [] do + pipe_through(:oauth_write) + + patch("/accounts/update_credentials", MastodonAPIController, :update_credentials) + + post("/statuses", MastodonAPIController, :post_status) + delete("/statuses/:id", MastodonAPIController, :delete_status) + + post("/statuses/:id/reblog", MastodonAPIController, :reblog_status) + post("/statuses/:id/unreblog", MastodonAPIController, :unreblog_status) + post("/statuses/:id/favourite", MastodonAPIController, :fav_status) + post("/statuses/:id/unfavourite", MastodonAPIController, :unfav_status) + post("/statuses/:id/pin", MastodonAPIController, :pin_status) + post("/statuses/:id/unpin", MastodonAPIController, :unpin_status) + post("/statuses/:id/bookmark", MastodonAPIController, :bookmark_status) + post("/statuses/:id/unbookmark", MastodonAPIController, :unbookmark_status) + post("/statuses/:id/mute", MastodonAPIController, :mute_conversation) + post("/statuses/:id/unmute", MastodonAPIController, :unmute_conversation) - post("/statuses", MastodonAPIController, :post_status) - delete("/statuses/:id", MastodonAPIController, :delete_status) + post("/media", MastodonAPIController, :upload) + put("/media/:id", MastodonAPIController, :update_media) - post("/statuses/:id/reblog", MastodonAPIController, :reblog_status) - post("/statuses/:id/unreblog", MastodonAPIController, :unreblog_status) - post("/statuses/:id/favourite", MastodonAPIController, :fav_status) - post("/statuses/:id/unfavourite", MastodonAPIController, :unfav_status) - post("/statuses/:id/pin", MastodonAPIController, :pin_status) - post("/statuses/:id/unpin", MastodonAPIController, :unpin_status) - post("/statuses/:id/bookmark", MastodonAPIController, :bookmark_status) - post("/statuses/:id/unbookmark", MastodonAPIController, :unbookmark_status) - post("/statuses/:id/mute", MastodonAPIController, :mute_conversation) - post("/statuses/:id/unmute", MastodonAPIController, :unmute_conversation) + delete("/lists/:id", MastodonAPIController, :delete_list) + post("/lists", MastodonAPIController, :create_list) + put("/lists/:id", MastodonAPIController, :rename_list) - post("/notifications/clear", MastodonAPIController, :clear_notifications) - post("/notifications/dismiss", MastodonAPIController, :dismiss_notification) - get("/notifications", MastodonAPIController, :notifications) - get("/notifications/:id", MastodonAPIController, :get_notification) + post("/lists/:id/accounts", MastodonAPIController, :add_to_list) + delete("/lists/:id/accounts", MastodonAPIController, :remove_from_list) - post("/media", MastodonAPIController, :upload) - put("/media/:id", MastodonAPIController, :update_media) + post("/filters", MastodonAPIController, :create_filter) + get("/filters/:id", MastodonAPIController, :get_filter) + put("/filters/:id", MastodonAPIController, :update_filter) + delete("/filters/:id", MastodonAPIController, :delete_filter) - get("/lists", MastodonAPIController, :get_lists) - get("/lists/:id", MastodonAPIController, :get_list) - delete("/lists/:id", MastodonAPIController, :delete_list) - post("/lists", MastodonAPIController, :create_list) - put("/lists/:id", MastodonAPIController, :rename_list) - get("/lists/:id/accounts", MastodonAPIController, :list_accounts) - post("/lists/:id/accounts", MastodonAPIController, :add_to_list) - delete("/lists/:id/accounts", MastodonAPIController, :remove_from_list) + post("/pleroma/flavour/:flavour", MastodonAPIController, :set_flavour) - get("/domain_blocks", MastodonAPIController, :domain_blocks) - post("/domain_blocks", MastodonAPIController, :block_domain) - delete("/domain_blocks", MastodonAPIController, :unblock_domain) + post("/reports", MastodonAPIController, :reports) + end + + scope [] do + pipe_through(:oauth_follow) - get("/filters", MastodonAPIController, :get_filters) - post("/filters", MastodonAPIController, :create_filter) - get("/filters/:id", MastodonAPIController, :get_filter) - put("/filters/:id", MastodonAPIController, :update_filter) - delete("/filters/:id", MastodonAPIController, :delete_filter) + post("/follows", MastodonAPIController, :follow) + post("/accounts/:id/follow", MastodonAPIController, :follow) - post("/push/subscription", MastodonAPIController, :create_push_subscription) - get("/push/subscription", MastodonAPIController, :get_push_subscription) - put("/push/subscription", MastodonAPIController, :update_push_subscription) - delete("/push/subscription", MastodonAPIController, :delete_push_subscription) + post("/accounts/:id/unfollow", MastodonAPIController, :unfollow) + post("/accounts/:id/block", MastodonAPIController, :block) + post("/accounts/:id/unblock", MastodonAPIController, :unblock) + post("/accounts/:id/mute", MastodonAPIController, :mute) + post("/accounts/:id/unmute", MastodonAPIController, :unmute) - get("/suggestions", MastodonAPIController, :suggestions) + post("/follow_requests/:id/authorize", MastodonAPIController, :authorize_follow_request) + post("/follow_requests/:id/reject", MastodonAPIController, :reject_follow_request) - get("/endorsements", MastodonAPIController, :empty_array) + post("/domain_blocks", MastodonAPIController, :block_domain) + delete("/domain_blocks", MastodonAPIController, :unblock_domain) + end - post("/pleroma/flavour/:flavour", MastodonAPIController, :set_flavour) - get("/pleroma/flavour", MastodonAPIController, :get_flavour) + scope [] do + pipe_through(:oauth_push) + + post("/push/subscription", MastodonAPIController, :create_push_subscription) + get("/push/subscription", MastodonAPIController, :get_push_subscription) + put("/push/subscription", MastodonAPIController, :update_push_subscription) + delete("/push/subscription", MastodonAPIController, :delete_push_subscription) + end end scope "/api/web", Pleroma.Web.MastodonAPI do - pipe_through(:authenticated_api) + pipe_through([:authenticated_api, :oauth_write]) put("/settings", MastodonAPIController, :put_settings) end scope "/api/v1", Pleroma.Web.MastodonAPI do pipe_through(:api) + get("/instance", MastodonAPIController, :masto_instance) get("/instance/peers", MastodonAPIController, :peers) post("/apps", MastodonAPIController, :create_app) get("/custom_emojis", MastodonAPIController, :custom_emojis) - get("/timelines/public", MastodonAPIController, :public_timeline) - get("/timelines/tag/:tag", MastodonAPIController, :hashtag_timeline) - get("/timelines/list/:list_id", MastodonAPIController, :list_timeline) - - get("/statuses/:id", MastodonAPIController, :get_status) - get("/statuses/:id/context", MastodonAPIController, :get_context) get("/statuses/:id/card", MastodonAPIController, :status_card) + get("/statuses/:id/favourited_by", MastodonAPIController, :favourited_by) get("/statuses/:id/reblogged_by", MastodonAPIController, :reblogged_by) - get("/accounts/:id/statuses", MastodonAPIController, :user_statuses) - get("/accounts/:id/followers", MastodonAPIController, :followers) - get("/accounts/:id/following", MastodonAPIController, :following) - get("/accounts/:id", MastodonAPIController, :user) - get("/trends", MastodonAPIController, :empty_array) - get("/search", MastodonAPIController, :search) + scope [] do + pipe_through(:oauth_read_or_unauthenticated) + + get("/timelines/public", MastodonAPIController, :public_timeline) + get("/timelines/tag/:tag", MastodonAPIController, :hashtag_timeline) + get("/timelines/list/:list_id", MastodonAPIController, :list_timeline) + + get("/statuses/:id", MastodonAPIController, :get_status) + get("/statuses/:id/context", MastodonAPIController, :get_context) + + get("/accounts/:id/statuses", MastodonAPIController, :user_statuses) + get("/accounts/:id/followers", MastodonAPIController, :followers) + get("/accounts/:id/following", MastodonAPIController, :following) + get("/accounts/:id", MastodonAPIController, :user) + + get("/search", MastodonAPIController, :search) + end end scope "/api/v2", Pleroma.Web.MastodonAPI do - pipe_through(:api) + pipe_through([:api, :oauth_read_or_unauthenticated]) get("/search", MastodonAPIController, :search2) end @@ -294,19 +369,11 @@ defmodule Pleroma.Web.Router do scope "/api", Pleroma.Web do pipe_through(:api) - get("/statuses/user_timeline", TwitterAPI.Controller, :user_timeline) - get("/qvitter/statuses/user_timeline", TwitterAPI.Controller, :user_timeline) - get("/users/show", TwitterAPI.Controller, :show_user) - - get("/statuses/followers", TwitterAPI.Controller, :followers) - get("/statuses/friends", TwitterAPI.Controller, :friends) - get("/statuses/blocks", TwitterAPI.Controller, :blocks) - get("/statuses/show/:id", TwitterAPI.Controller, :fetch_status) - get("/statusnet/conversation/:id", TwitterAPI.Controller, :fetch_conversation) - post("/account/register", TwitterAPI.Controller, :register) post("/account/password_reset", TwitterAPI.Controller, :password_reset) + post("/account/resend_confirmation_email", TwitterAPI.Controller, :resend_confirmation_email) + get( "/account/confirm_email/:user_id/:token", TwitterAPI.Controller, @@ -314,14 +381,26 @@ defmodule Pleroma.Web.Router do as: :confirm_email ) - post("/account/resend_confirmation_email", TwitterAPI.Controller, :resend_confirmation_email) + scope [] do + pipe_through(:oauth_read_or_unauthenticated) + + get("/statuses/user_timeline", TwitterAPI.Controller, :user_timeline) + get("/qvitter/statuses/user_timeline", TwitterAPI.Controller, :user_timeline) + get("/users/show", TwitterAPI.Controller, :show_user) + + get("/statuses/followers", TwitterAPI.Controller, :followers) + get("/statuses/friends", TwitterAPI.Controller, :friends) + get("/statuses/blocks", TwitterAPI.Controller, :blocks) + get("/statuses/show/:id", TwitterAPI.Controller, :fetch_status) + get("/statusnet/conversation/:id", TwitterAPI.Controller, :fetch_conversation) - get("/search", TwitterAPI.Controller, :search) - get("/statusnet/tags/timeline/:tag", TwitterAPI.Controller, :public_and_external_timeline) + get("/search", TwitterAPI.Controller, :search) + get("/statusnet/tags/timeline/:tag", TwitterAPI.Controller, :public_and_external_timeline) + end end scope "/api", Pleroma.Web do - pipe_through(:api) + pipe_through([:api, :oauth_read_or_unauthenticated]) get("/statuses/public_timeline", TwitterAPI.Controller, :public_timeline) @@ -335,76 +414,88 @@ defmodule Pleroma.Web.Router do end scope "/api", Pleroma.Web, as: :twitter_api_search do - pipe_through(:api) + pipe_through([:api, :oauth_read_or_unauthenticated]) get("/pleroma/search_user", TwitterAPI.Controller, :search_user) end scope "/api", Pleroma.Web, as: :authenticated_twitter_api do pipe_through(:authenticated_api) - get("/account/verify_credentials", TwitterAPI.Controller, :verify_credentials) - post("/account/verify_credentials", TwitterAPI.Controller, :verify_credentials) + get("/oauth_tokens", TwitterAPI.Controller, :oauth_tokens) + delete("/oauth_tokens/:id", TwitterAPI.Controller, :revoke_token) - post("/account/update_profile", TwitterAPI.Controller, :update_profile) - post("/account/update_profile_banner", TwitterAPI.Controller, :update_banner) - post("/qvitter/update_background_image", TwitterAPI.Controller, :update_background) + scope [] do + pipe_through(:oauth_read) - get("/statuses/home_timeline", TwitterAPI.Controller, :friends_timeline) - get("/statuses/friends_timeline", TwitterAPI.Controller, :friends_timeline) - get("/statuses/mentions", TwitterAPI.Controller, :mentions_timeline) - get("/statuses/mentions_timeline", TwitterAPI.Controller, :mentions_timeline) - get("/statuses/dm_timeline", TwitterAPI.Controller, :dm_timeline) - get("/qvitter/statuses/notifications", TwitterAPI.Controller, :notifications) + get("/account/verify_credentials", TwitterAPI.Controller, :verify_credentials) + post("/account/verify_credentials", TwitterAPI.Controller, :verify_credentials) - # XXX: this is really a pleroma API, but we want to keep the pleroma namespace clean - # for now. - post("/qvitter/statuses/notifications/read", TwitterAPI.Controller, :notifications_read) + get("/statuses/home_timeline", TwitterAPI.Controller, :friends_timeline) + get("/statuses/friends_timeline", TwitterAPI.Controller, :friends_timeline) + get("/statuses/mentions", TwitterAPI.Controller, :mentions_timeline) + get("/statuses/mentions_timeline", TwitterAPI.Controller, :mentions_timeline) + get("/statuses/dm_timeline", TwitterAPI.Controller, :dm_timeline) + get("/qvitter/statuses/notifications", TwitterAPI.Controller, :notifications) - post("/statuses/update", TwitterAPI.Controller, :status_update) - post("/statuses/retweet/:id", TwitterAPI.Controller, :retweet) - post("/statuses/unretweet/:id", TwitterAPI.Controller, :unretweet) - post("/statuses/destroy/:id", TwitterAPI.Controller, :delete_post) + get("/pleroma/friend_requests", TwitterAPI.Controller, :friend_requests) - post("/statuses/pin/:id", TwitterAPI.Controller, :pin) - post("/statuses/unpin/:id", TwitterAPI.Controller, :unpin) + get("/friends/ids", TwitterAPI.Controller, :friends_ids) + get("/friendships/no_retweets/ids", TwitterAPI.Controller, :empty_array) - get("/pleroma/friend_requests", TwitterAPI.Controller, :friend_requests) - post("/pleroma/friendships/approve", TwitterAPI.Controller, :approve_friend_request) - post("/pleroma/friendships/deny", TwitterAPI.Controller, :deny_friend_request) + get("/mutes/users/ids", TwitterAPI.Controller, :empty_array) + get("/qvitter/mutes", TwitterAPI.Controller, :raw_empty_array) - post("/friendships/create", TwitterAPI.Controller, :follow) - post("/friendships/destroy", TwitterAPI.Controller, :unfollow) - post("/blocks/create", TwitterAPI.Controller, :block) - post("/blocks/destroy", TwitterAPI.Controller, :unblock) + get("/externalprofile/show", TwitterAPI.Controller, :external_profile) - post("/statusnet/media/upload", TwitterAPI.Controller, :upload) - post("/media/upload", TwitterAPI.Controller, :upload_json) - post("/media/metadata/create", TwitterAPI.Controller, :update_media) + post("/qvitter/statuses/notifications/read", TwitterAPI.Controller, :notifications_read) + end - post("/favorites/create/:id", TwitterAPI.Controller, :favorite) - post("/favorites/create", TwitterAPI.Controller, :favorite) - post("/favorites/destroy/:id", TwitterAPI.Controller, :unfavorite) + scope [] do + pipe_through(:oauth_write) - post("/qvitter/update_avatar", TwitterAPI.Controller, :update_avatar) + post("/account/update_profile", TwitterAPI.Controller, :update_profile) + post("/account/update_profile_banner", TwitterAPI.Controller, :update_banner) + post("/qvitter/update_background_image", TwitterAPI.Controller, :update_background) - get("/friends/ids", TwitterAPI.Controller, :friends_ids) - get("/friendships/no_retweets/ids", TwitterAPI.Controller, :empty_array) + post("/statuses/update", TwitterAPI.Controller, :status_update) + post("/statuses/retweet/:id", TwitterAPI.Controller, :retweet) + post("/statuses/unretweet/:id", TwitterAPI.Controller, :unretweet) + post("/statuses/destroy/:id", TwitterAPI.Controller, :delete_post) - get("/mutes/users/ids", TwitterAPI.Controller, :empty_array) - get("/qvitter/mutes", TwitterAPI.Controller, :raw_empty_array) + post("/statuses/pin/:id", TwitterAPI.Controller, :pin) + post("/statuses/unpin/:id", TwitterAPI.Controller, :unpin) - get("/externalprofile/show", TwitterAPI.Controller, :external_profile) + post("/statusnet/media/upload", TwitterAPI.Controller, :upload) + post("/media/upload", TwitterAPI.Controller, :upload_json) + post("/media/metadata/create", TwitterAPI.Controller, :update_media) - get("/oauth_tokens", TwitterAPI.Controller, :oauth_tokens) - delete("/oauth_tokens/:id", TwitterAPI.Controller, :revoke_token) + post("/favorites/create/:id", TwitterAPI.Controller, :favorite) + post("/favorites/create", TwitterAPI.Controller, :favorite) + post("/favorites/destroy/:id", TwitterAPI.Controller, :unfavorite) + + post("/qvitter/update_avatar", TwitterAPI.Controller, :update_avatar) + end + + scope [] do + pipe_through(:oauth_follow) + + post("/pleroma/friendships/approve", TwitterAPI.Controller, :approve_friend_request) + post("/pleroma/friendships/deny", TwitterAPI.Controller, :deny_friend_request) + + post("/friendships/create", TwitterAPI.Controller, :follow) + post("/friendships/destroy", TwitterAPI.Controller, :unfollow) + + post("/blocks/create", TwitterAPI.Controller, :block) + post("/blocks/destroy", TwitterAPI.Controller, :unblock) + end end pipeline :ap_relay do - plug(:accepts, ["activity+json"]) + plug(:accepts, ["activity+json", "json"]) end pipeline :ostatus do - plug(:accepts, ["html", "xml", "atom", "activity+json"]) + plug(:accepts, ["html", "xml", "atom", "activity+json", "json"]) end pipeline :oembed do @@ -417,6 +508,7 @@ defmodule Pleroma.Web.Router do get("/objects/:uuid", OStatus.OStatusController, :object) get("/activities/:uuid", OStatus.OStatusController, :activity) get("/notice/:id", OStatus.OStatusController, :notice) + get("/notice/:id/embed_player", OStatus.OStatusController, :notice_player) get("/users/:nickname/feed", OStatus.OStatusController, :feed) get("/users/:nickname", OStatus.OStatusController, :feed_redirect) @@ -433,7 +525,7 @@ defmodule Pleroma.Web.Router do end pipeline :activitypub do - plug(:accepts, ["activity+json"]) + plug(:accepts, ["activity+json", "json"]) plug(Pleroma.Web.Plugs.HTTPSignaturePlug) end @@ -448,7 +540,7 @@ defmodule Pleroma.Web.Router do end pipeline :activitypub_client do - plug(:accepts, ["activity+json"]) + plug(:accepts, ["activity+json", "json"]) plug(:fetch_session) plug(Pleroma.Plugs.OAuthPlug) plug(Pleroma.Plugs.BasicAuthDecoderPlug) @@ -464,9 +556,16 @@ defmodule Pleroma.Web.Router do scope "/", Pleroma.Web.ActivityPub do pipe_through([:activitypub_client]) - get("/api/ap/whoami", ActivityPubController, :whoami) - get("/users/:nickname/inbox", ActivityPubController, :read_inbox) - post("/users/:nickname/outbox", ActivityPubController, :update_outbox) + scope [] do + pipe_through(:oauth_read) + get("/api/ap/whoami", ActivityPubController, :whoami) + get("/users/:nickname/inbox", ActivityPubController, :read_inbox) + end + + scope [] do + pipe_through(:oauth_write) + post("/users/:nickname/outbox", ActivityPubController, :update_outbox) + end end scope "/relay", Pleroma.Web.ActivityPub do @@ -496,9 +595,12 @@ defmodule Pleroma.Web.Router do pipe_through(:mastodon_html) get("/web/login", MastodonAPIController, :login) - post("/web/login", MastodonAPIController, :login_post) - get("/web/*path", MastodonAPIController, :index) delete("/auth/sign_out", MastodonAPIController, :logout) + + scope [] do + pipe_through(:oauth_read_or_unauthenticated) + get("/web/*path", MastodonAPIController, :index) + end end pipeline :remote_media do @@ -506,6 +608,7 @@ defmodule Pleroma.Web.Router do scope "/proxy/", Pleroma.Web.MediaProxy do pipe_through(:remote_media) + get("/:sig/:url", MediaProxyController, :remote) get("/:sig/:url/:filename", MediaProxyController, :remote) end diff --git a/lib/pleroma/web/streamer.ex b/lib/pleroma/web/streamer.ex index 4de7608e4..27e8020f4 100644 --- a/lib/pleroma/web/streamer.ex +++ b/lib/pleroma/web/streamer.ex @@ -10,7 +10,7 @@ defmodule Pleroma.Web.Streamer do alias Pleroma.Activity alias Pleroma.Object alias Pleroma.Repo - alias Pleroma.Web.ActivityPub.ActivityPub + alias Pleroma.Web.ActivityPub.Visibility @keepalive_interval :timer.seconds(30) @@ -73,7 +73,7 @@ defmodule Pleroma.Web.Streamer do def handle_cast(%{action: :stream, topic: "list", item: item}, topics) do # filter the recipient list if the activity is not public, see #270. recipient_lists = - case ActivityPub.is_public?(item) do + case Visibility.is_public?(item) do true -> Pleroma.List.get_lists_from_activity(item) @@ -82,7 +82,7 @@ defmodule Pleroma.Web.Streamer do |> Enum.filter(fn list -> owner = Repo.get(User, list.user_id) - ActivityPub.visible_for_user?(item, owner) + Visibility.visible_for_user?(item, owner) end) end @@ -197,10 +197,12 @@ defmodule Pleroma.Web.Streamer do if socket.assigns[:user] do user = User.get_cached_by_ap_id(socket.assigns[:user].ap_id) blocks = user.info.blocks || [] + mutes = user.info.mutes || [] parent = Object.normalize(item.data["object"]) - unless is_nil(parent) or item.actor in blocks or parent.data["actor"] in blocks do + unless is_nil(parent) or item.actor in blocks or item.actor in mutes or + parent.data["actor"] in blocks or parent.data["actor"] in mutes do send(socket.transport_pid, {:text, represent_update(item, user)}) end else @@ -224,8 +226,9 @@ defmodule Pleroma.Web.Streamer do if socket.assigns[:user] do user = User.get_cached_by_ap_id(socket.assigns[:user].ap_id) blocks = user.info.blocks || [] + mutes = user.info.mutes || [] - unless item.actor in blocks do + unless item.actor in blocks or item.actor in mutes do send(socket.transport_pid, {:text, represent_update(item, user)}) end else diff --git a/lib/pleroma/web/templates/layout/app.html.eex b/lib/pleroma/web/templates/layout/app.html.eex index 520e4b3d5..db97ccac2 100644 --- a/lib/pleroma/web/templates/layout/app.html.eex +++ b/lib/pleroma/web/templates/layout/app.html.eex @@ -54,6 +54,10 @@ border-bottom: 2px solid #4b8ed8; } + input[type="checkbox"] { + width: auto; + } + button { box-sizing: border-box; width: 100%; diff --git a/lib/pleroma/web/templates/layout/metadata_player.html.eex b/lib/pleroma/web/templates/layout/metadata_player.html.eex new file mode 100644 index 000000000..460f28094 --- /dev/null +++ b/lib/pleroma/web/templates/layout/metadata_player.html.eex @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<html> +<body> + +<style type="text/css"> +video, audio { + width:100%; + max-width:600px; + height: auto; +} +</style> + +<%= render @view_module, @view_template, assigns %> + +</body> +</html> diff --git a/lib/pleroma/web/templates/o_auth/o_auth/show.html.eex b/lib/pleroma/web/templates/o_auth/o_auth/show.html.eex index 32c458f0c..f50599bdb 100644 --- a/lib/pleroma/web/templates/o_auth/o_auth/show.html.eex +++ b/lib/pleroma/web/templates/o_auth/o_auth/show.html.eex @@ -9,13 +9,24 @@ <%= label f, :name, "Name or email" %> <%= text_input f, :name %> <br> +<br> <%= label f, :password, "Password" %> <%= password_input f, :password %> <br> +<br> + +<%= label f, :scope, "Permissions" %> +<br> +<%= for scope <- @available_scopes do %> + <%# Note: using hidden input with `unchecked_value` in order to distinguish user's empty selection from `scope` param being omitted %> + <%= checkbox f, :"scope_#{scope}", value: scope in @scopes && scope, checked_value: scope, unchecked_value: "", name: "authorization[scope][]" %> + <%= label f, :"scope_#{scope}", String.capitalize(scope) %> + <br> +<% end %> + <%= hidden_input f, :client_id, value: @client_id %> <%= hidden_input f, :response_type, value: @response_type %> <%= hidden_input f, :redirect_uri, value: @redirect_uri %> -<%= hidden_input f, :scope, value: @scope %> <%= hidden_input f, :state, value: @state%> <%= submit "Authorize" %> <% end %> diff --git a/lib/pleroma/web/twitter_api/representers/activity_representer.ex b/lib/pleroma/web/twitter_api/representers/activity_representer.ex index 192ab7334..55c612ddd 100644 --- a/lib/pleroma/web/twitter_api/representers/activity_representer.ex +++ b/lib/pleroma/web/twitter_api/representers/activity_representer.ex @@ -6,247 +6,10 @@ # THIS MODULE IS DEPRECATED! DON'T USE IT! # USE THE Pleroma.Web.TwitterAPI.Views.ActivityView MODULE! defmodule Pleroma.Web.TwitterAPI.Representers.ActivityRepresenter do - use Pleroma.Web.TwitterAPI.Representers.BaseRepresenter - alias Pleroma.Web.TwitterAPI.Representers.ObjectRepresenter - alias Pleroma.Activity - alias Pleroma.Formatter - alias Pleroma.HTML - alias Pleroma.User - alias Pleroma.Web.TwitterAPI.ActivityView - alias Pleroma.Web.TwitterAPI.TwitterAPI - alias Pleroma.Web.TwitterAPI.UserView - alias Pleroma.Web.CommonAPI.Utils - alias Pleroma.Web.MastodonAPI.StatusView - - defp user_by_ap_id(user_list, ap_id) do - Enum.find(user_list, fn %{ap_id: user_id} -> ap_id == user_id end) - end - - def to_map( - %Activity{data: %{"type" => "Announce", "actor" => actor, "published" => created_at}} = - activity, - %{users: users, announced_activity: announced_activity} = opts - ) do - user = user_by_ap_id(users, actor) - created_at = created_at |> Utils.date_to_asctime() - - text = "#{user.nickname} retweeted a status." - - announced_user = user_by_ap_id(users, announced_activity.data["actor"]) - retweeted_status = to_map(announced_activity, Map.merge(%{user: announced_user}, opts)) - - %{ - "id" => activity.id, - "user" => UserView.render("show.json", %{user: user, for: opts[:for]}), - "statusnet_html" => text, - "text" => text, - "is_local" => activity.local, - "is_post_verb" => false, - "uri" => "tag:#{activity.data["id"]}:objectType=note", - "created_at" => created_at, - "retweeted_status" => retweeted_status, - "statusnet_conversation_id" => conversation_id(announced_activity), - "external_url" => activity.data["id"], - "activity_type" => "repeat" - } - end - - def to_map( - %Activity{data: %{"type" => "Like", "published" => created_at}} = activity, - %{user: user, liked_activity: liked_activity} = opts - ) do - created_at = created_at |> Utils.date_to_asctime() - - text = "#{user.nickname} favorited a status." - - %{ - "id" => activity.id, - "user" => UserView.render("show.json", %{user: user, for: opts[:for]}), - "statusnet_html" => text, - "text" => text, - "is_local" => activity.local, - "is_post_verb" => false, - "uri" => "tag:#{activity.data["id"]}:objectType=Favourite", - "created_at" => created_at, - "in_reply_to_status_id" => liked_activity.id, - "external_url" => activity.data["id"], - "activity_type" => "like" - } - end - - def to_map( - %Activity{data: %{"type" => "Follow", "object" => followed_id}} = activity, - %{user: user} = opts - ) do - created_at = activity.data["published"] || DateTime.to_iso8601(activity.inserted_at) - created_at = created_at |> Utils.date_to_asctime() - - followed = User.get_cached_by_ap_id(followed_id) - text = "#{user.nickname} started following #{followed.nickname}" - - %{ - "id" => activity.id, - "user" => UserView.render("show.json", %{user: user, for: opts[:for]}), - "attentions" => [], - "statusnet_html" => text, - "text" => text, - "is_local" => activity.local, - "is_post_verb" => false, - "created_at" => created_at, - "in_reply_to_status_id" => nil, - "external_url" => activity.data["id"], - "activity_type" => "follow" - } - end - - # TODO: - # Make this more proper. Just a placeholder to not break the frontend. - def to_map( - %Activity{ - data: %{"type" => "Undo", "published" => created_at, "object" => undid_activity} - } = activity, - %{user: user} = opts - ) do - created_at = created_at |> Utils.date_to_asctime() - - text = "#{user.nickname} undid the action at #{undid_activity["id"]}" - - %{ - "id" => activity.id, - "user" => UserView.render("show.json", %{user: user, for: opts[:for]}), - "attentions" => [], - "statusnet_html" => text, - "text" => text, - "is_local" => activity.local, - "is_post_verb" => false, - "created_at" => created_at, - "in_reply_to_status_id" => nil, - "external_url" => activity.data["id"], - "activity_type" => "undo" - } - end - - def to_map( - %Activity{data: %{"type" => "Delete", "published" => created_at, "object" => _}} = - activity, - %{user: user} = opts - ) do - created_at = created_at |> Utils.date_to_asctime() - - %{ - "id" => activity.id, - "uri" => activity.data["object"], - "user" => UserView.render("show.json", %{user: user, for: opts[:for]}), - "attentions" => [], - "statusnet_html" => "deleted notice {{tag", - "text" => "deleted notice {{tag", - "is_local" => activity.local, - "is_post_verb" => false, - "created_at" => created_at, - "in_reply_to_status_id" => nil, - "external_url" => activity.data["id"], - "activity_type" => "delete" - } - end - - def to_map( - %Activity{data: %{"object" => %{"content" => _content} = object}} = activity, - %{user: user} = opts - ) do - created_at = object["published"] |> Utils.date_to_asctime() - like_count = object["like_count"] || 0 - announcement_count = object["announcement_count"] || 0 - favorited = opts[:for] && opts[:for].ap_id in (object["likes"] || []) - repeated = opts[:for] && opts[:for].ap_id in (object["announcements"] || []) - pinned = activity.id in user.info.pinned_activities - - mentions = opts[:mentioned] || [] - - attentions = - [] - |> Utils.maybe_notify_to_recipients(activity) - |> Utils.maybe_notify_mentioned_recipients(activity) - |> Enum.map(fn ap_id -> Enum.find(mentions, fn user -> ap_id == user.ap_id end) end) - |> Enum.filter(& &1) - |> Enum.map(fn user -> UserView.render("show.json", %{user: user, for: opts[:for]}) end) - - conversation_id = conversation_id(activity) - - tags = activity.data["object"]["tag"] || [] - possibly_sensitive = activity.data["object"]["sensitive"] || Enum.member?(tags, "nsfw") - - tags = if possibly_sensitive, do: Enum.uniq(["nsfw" | tags]), else: tags - - {_summary, content} = ActivityView.render_content(object) - - html = - HTML.filter_tags(content, User.html_filter_policy(opts[:for])) - |> Formatter.emojify(object["emoji"]) - - attachments = object["attachment"] || [] - - reply_parent = Activity.get_in_reply_to_activity(activity) - - reply_user = reply_parent && User.get_cached_by_ap_id(reply_parent.actor) - - summary = HTML.strip_tags(object["summary"]) - - card = - StatusView.render( - "card.json", - Pleroma.Web.RichMedia.Helpers.fetch_data_for_activity(activity) - ) - - %{ - "id" => activity.id, - "uri" => activity.data["object"]["id"], - "user" => UserView.render("show.json", %{user: user, for: opts[:for]}), - "statusnet_html" => html, - "text" => HTML.strip_tags(content), - "is_local" => activity.local, - "is_post_verb" => true, - "created_at" => created_at, - "in_reply_to_status_id" => object["inReplyToStatusId"], - "in_reply_to_screen_name" => reply_user && reply_user.nickname, - "in_reply_to_profileurl" => User.profile_url(reply_user), - "in_reply_to_ostatus_uri" => reply_user && reply_user.ap_id, - "in_reply_to_user_id" => reply_user && reply_user.id, - "statusnet_conversation_id" => conversation_id, - "attachments" => attachments |> ObjectRepresenter.enum_to_list(opts), - "attentions" => attentions, - "fave_num" => like_count, - "repeat_num" => announcement_count, - "favorited" => to_boolean(favorited), - "repeated" => to_boolean(repeated), - "pinned" => pinned, - "external_url" => object["external_url"] || object["id"], - "tags" => tags, - "activity_type" => "post", - "possibly_sensitive" => possibly_sensitive, - "visibility" => Pleroma.Web.MastodonAPI.StatusView.get_visibility(object), - "summary" => summary, - "summary_html" => summary |> Formatter.emojify(object["emoji"]), - "card" => card - } - end - - def conversation_id(activity) do - with context when not is_nil(context) <- activity.data["context"] do - TwitterAPI.context_to_conversation_id(context) - else - _e -> nil - end - end - - defp to_boolean(false) do - false - end - - defp to_boolean(nil) do - false - end - - defp to_boolean(_) do - true + def to_map(activity, opts) do + Pleroma.Web.TwitterAPI.ActivityView.render( + "activity.json", + Map.put(opts, :activity, activity) + ) end end diff --git a/lib/pleroma/web/twitter_api/twitter_api.ex b/lib/pleroma/web/twitter_api/twitter_api.ex index db521a3ad..ab6470d78 100644 --- a/lib/pleroma/web/twitter_api/twitter_api.ex +++ b/lib/pleroma/web/twitter_api/twitter_api.ex @@ -216,7 +216,7 @@ defmodule Pleroma.Web.TwitterAPI.TwitterAPI do {:ok, token_record} <- Pleroma.PasswordResetToken.create_token(user) do user |> UserEmail.password_reset_email(token_record.token) - |> Mailer.deliver() + |> Mailer.deliver_async() else false -> {:error, "bad user identifier"} @@ -229,18 +229,10 @@ defmodule Pleroma.Web.TwitterAPI.TwitterAPI do end end - def get_by_id_or_nickname(id_or_nickname) do - if !is_integer(id_or_nickname) && :error == Integer.parse(id_or_nickname) do - Repo.get_by(User, nickname: id_or_nickname) - else - Repo.get(User, id_or_nickname) - end - end - def get_user(user \\ nil, params) do case params do %{"user_id" => user_id} -> - case target = get_by_id_or_nickname(user_id) do + case target = User.get_cached_by_nickname_or_id(user_id) do nil -> {:error, "No user with such user_id"} diff --git a/lib/pleroma/web/twitter_api/twitter_api_controller.ex b/lib/pleroma/web/twitter_api/twitter_api_controller.ex index b815379fd..de7b9f24c 100644 --- a/lib/pleroma/web/twitter_api/twitter_api_controller.ex +++ b/lib/pleroma/web/twitter_api/twitter_api_controller.ex @@ -13,6 +13,7 @@ defmodule Pleroma.Web.TwitterAPI.Controller do alias Pleroma.{Repo, Activity, Object, User, Notification} alias Pleroma.Web.OAuth.Token alias Pleroma.Web.ActivityPub.ActivityPub + alias Pleroma.Web.ActivityPub.Visibility alias Pleroma.Web.ActivityPub.Utils alias Pleroma.Web.CommonAPI alias Pleroma.Web.TwitterAPI.ActivityView @@ -166,6 +167,7 @@ defmodule Pleroma.Web.TwitterAPI.Controller do params |> Map.put("type", ["Create", "Announce", "Follow", "Like"]) |> Map.put("blocking_user", user) + |> Map.put(:visibility, ~w[unlisted public private]) activities = ActivityPub.fetch_activities([user.ap_id], params) @@ -268,7 +270,7 @@ defmodule Pleroma.Web.TwitterAPI.Controller do def fetch_status(%{assigns: %{user: user}} = conn, %{"id" => id}) do with %Activity{} = activity <- Repo.get(Activity, id), - true <- ActivityPub.visible_for_user?(activity, user) do + true <- Visibility.visible_for_user?(activity, user) do conn |> put_view(ActivityView) |> render("activity.json", %{activity: activity, for: user}) @@ -701,7 +703,7 @@ defmodule Pleroma.Web.TwitterAPI.Controller do end def search_user(%{assigns: %{user: user}} = conn, %{"query" => query}) do - users = User.search(query, true, user) + users = User.search(query, resolve: true, for_user: user) conn |> put_view(UserView) diff --git a/lib/pleroma/web/twitter_api/views/activity_view.ex b/lib/pleroma/web/twitter_api/views/activity_view.ex index 661022afa..02ca4ee42 100644 --- a/lib/pleroma/web/twitter_api/views/activity_view.ex +++ b/lib/pleroma/web/twitter_api/views/activity_view.ex @@ -10,6 +10,7 @@ defmodule Pleroma.Web.TwitterAPI.ActivityView do alias Pleroma.Object alias Pleroma.Repo alias Pleroma.User + alias Pleroma.Web.CommonAPI alias Pleroma.Web.CommonAPI.Utils alias Pleroma.Web.MastodonAPI.StatusView alias Pleroma.Web.TwitterAPI.ActivityView @@ -309,7 +310,8 @@ defmodule Pleroma.Web.TwitterAPI.ActivityView do "visibility" => StatusView.get_visibility(object), "summary" => summary, "summary_html" => summary |> Formatter.emojify(object["emoji"]), - "card" => card + "card" => card, + "muted" => CommonAPI.thread_muted?(user, activity) || User.mutes?(opts[:for], user) } end diff --git a/lib/pleroma/web/twitter_api/views/user_view.ex b/lib/pleroma/web/twitter_api/views/user_view.ex index df7384476..0791ed760 100644 --- a/lib/pleroma/web/twitter_api/views/user_view.ex +++ b/lib/pleroma/web/twitter_api/views/user_view.ex @@ -118,7 +118,7 @@ defmodule Pleroma.Web.TwitterAPI.UserView do "confirmation_pending" => user_info.confirmation_pending, "tags" => user.tags } - |> maybe_with_follow_request_count(user, for_user) + |> maybe_with_activation_status(user, for_user) } data = @@ -134,13 +134,11 @@ defmodule Pleroma.Web.TwitterAPI.UserView do end end - defp maybe_with_follow_request_count(data, %User{id: id, info: %{locked: true}} = user, %User{ - id: id - }) do - Map.put(data, "follow_request_count", user.info.follow_request_count) + defp maybe_with_activation_status(data, user, %User{info: %{is_admin: true}}) do + Map.put(data, "deactivated", user.info.deactivated) end - defp maybe_with_follow_request_count(data, _, _), do: data + defp maybe_with_activation_status(data, _, _), do: data defp maybe_with_role(data, %User{id: id} = user, %User{id: id}) do Map.merge(data, %{"role" => role(user), "show_role" => user.info.show_role}) diff --git a/lib/pleroma/web/views/error_view.ex b/lib/pleroma/web/views/error_view.ex index 86a1744b7..f4c04131c 100644 --- a/lib/pleroma/web/views/error_view.ex +++ b/lib/pleroma/web/views/error_view.ex @@ -4,13 +4,20 @@ defmodule Pleroma.Web.ErrorView do use Pleroma.Web, :view + require Logger def render("404.json", _assigns) do %{errors: %{detail: "Page not found"}} end - def render("500.json", _assigns) do - %{errors: %{detail: "Internal server error"}} + def render("500.json", assigns) do + Logger.error("Internal server error: #{inspect(assigns[:reason])}") + + if Mix.env() != :prod do + %{errors: %{detail: "Internal server error", reason: inspect(assigns[:reason])}} + else + %{errors: %{detail: "Internal server error"}} + end end # In case no render clause matches or no diff --git a/lib/pleroma/web/web.ex b/lib/pleroma/web/web.ex index 853aa2a87..66813e4dd 100644 --- a/lib/pleroma/web/web.ex +++ b/lib/pleroma/web/web.ex @@ -26,6 +26,12 @@ defmodule Pleroma.Web do import Plug.Conn import Pleroma.Web.Gettext import Pleroma.Web.Router.Helpers + + plug(:set_put_layout) + + defp set_put_layout(conn, _) do + put_layout(conn, Pleroma.Config.get(:app_layout, "app.html")) + end end end |