Commit Graph

2117 Commits

Author SHA1 Message Date
おさむのひと
0082e84a46
Merge 26e0b77d83 into 3c81926f71 2024-12-22 13:58:42 +09:00
かっこかり
f123be38b9
enhance(frontend): 照会の際にエラーを表示するように (#15147)
Some checks failed
Check copyright year / check_copyright_year (push) Has been cancelled
Check SPDX-License-Identifier / check-spdx-license-id (push) Has been cancelled
Publish Docker image (develop) / Build (linux/amd64) (push) Has been cancelled
Publish Docker image (develop) / Build (linux/arm64) (push) Has been cancelled
Dockle / dockle (push) Has been cancelled
Lint / pnpm_install (push) Has been cancelled
Lint / locale_verify (push) Has been cancelled
Release Manager: sync changelog with PR / edit (push) Has been cancelled
Storybook / build (push) Has been cancelled
Test (backend) / unit (22.11.0) (push) Has been cancelled
Test (backend) / e2e (22.11.0) (push) Has been cancelled
Test (federation) / test (22.11.0) (push) Has been cancelled
Test (frontend) / vitest (22.11.0) (push) Has been cancelled
Test (frontend) / e2e (chrome, 22.11.0) (push) Has been cancelled
Test (production install and build) / production (22.11.0) (push) Has been cancelled
Test (backend) / validate-api-json (22.11.0) (push) Has been cancelled
Lint / typecheck (misskey-js) (push) Has been cancelled
Publish Docker image (develop) / merge (push) Has been cancelled
Lint / lint (backend) (push) Has been cancelled
Lint / lint (frontend) (push) Has been cancelled
Lint / lint (frontend-embed) (push) Has been cancelled
Lint / lint (frontend-shared) (push) Has been cancelled
Lint / lint (misskey-bubble-game) (push) Has been cancelled
Lint / lint (misskey-js) (push) Has been cancelled
Lint / lint (misskey-reversi) (push) Has been cancelled
Lint / lint (sw) (push) Has been cancelled
Lint / typecheck (backend) (push) Has been cancelled
Lint / typecheck (sw) (push) Has been cancelled
* enhance: 照会の失敗理由を表示するように

* Update Changelog

* fix

* fix test

* lookupErrors-> remoteLookupErrors
2024-12-19 16:05:33 +09:00
かっこかり
074b7b0bee
fix(frontend): 公開範囲がホームのノートの埋め込みウィジェットが読み込まれない問題を修正 (#15102)
* Resolve frontend/backend contradiction for home visibility embeds

This now uses the same check from `packages/frontend/src/scripts/get-note-menu.ts`

* Update Changelog

---------

Co-authored-by: CenTdemeern1 <timo.herngreen@gmail.com>
2024-12-10 10:36:03 +09:00
おさむのひと
26e0b77d83
Merge branch 'develop' into fix/15018-check-local-only 2024-11-25 08:49:57 +09:00
anatawa12
dd56623cde
fix: unable to upload to local object storage (#15040) 2024-11-24 20:44:59 +09:00
かっこかり
a0e91b5882
fix(backend): 起動前の疎通チェックが機能しなくなっていた問題を修正 (#15043)
* check harder for connectibility

`allSettled` does not throw if a promise is rejected, so
`check_connect` never actually failed

* Update Changelog

---------

Co-authored-by: dakkar <dakkar@thenautilus.net>
2024-11-24 20:43:47 +09:00
かっこかり
d176db517f
fix(backend/misskey-js): タイポ修正 (#15046) 2024-11-24 15:23:07 +09:00
おさむのひと
a77ad7a16b
fix(backend): アドレス入力で直接ユーザのプロフィールページを表示した際、前提データが足りず描画に失敗する (#15033)
* fix(backend): アドレス入力で直接ユーザのプロフィールページを表示した際、前提データが足りず描画に失敗する

* fix CHANGELOG.md
2024-11-23 16:45:05 +09:00
syuilo
04b221409c fix(backend): use atomic command to improve security 2024-11-23 04:44:33 +09:00
おさむのひと
06e65e378c
Merge branch 'develop' into fix/15018-check-local-only 2024-11-22 21:23:49 +09:00
かっこかり
f25fc5215b
fix(backend): Inboxのエラーをthrowせずreturnしている問題を修正 (#15022)
* fix exception handling for Like activities

(cherry picked from commit 8f42e8434eaebe3aba5d1980c57f49dd8ad0de91)

* fix exception handling for Announce activities

(cherry picked from commit cfc3ab4b045af0674122fa49176431860176358b)

* fix exception handling for Undo activities

* Update Changelog

---------

Co-authored-by: Hazelnoot <acomputerdog@gmail.com>
2024-11-22 12:14:41 +09:00
おさむのひと
b45aca2725
Merge branch 'develop' into fix/15018-check-local-only 2024-11-21 21:54:00 +09:00
おさむのひと
62104def2c fix(backend): localOnlyなノートの時は配送処理そのものを起動しない 2024-11-21 20:44:46 +09:00
かっこかり
c1f19fad1e
fix(backend): fix apResolver (#15010)
* fix(backend): fix apResolver

* fix

* add comments

* tweak comment
2024-11-21 14:36:24 +09:00
かっこかり
3a6c2aa835
fix(backend): fix type error(s) in security fixes (#15009)
* Fix type error in security fixes

(cherry picked from commit fa3cf6c2996741e642955c5e2fca8ad785e83205)

* Fix error in test function calls

(cherry picked from commit 1758f29364eca3cbd13dbb5c84909c93712b3b3b)

* Fix style error

(cherry picked from commit 23c4aa25714af145098baa7edd74c1d217e51c1a)

* Fix another style error

(cherry picked from commit 36af07abe28bec670aaebf9f5af5694bb582c29a)

* Fix `.punyHost` misuse

(cherry picked from commit 6027b516e1c82324d55d6e54d0e17cbd816feb42)

* attempt to fix test: make yaml valid

---------

Co-authored-by: Julia Johannesen <julia@insertdomain.name>
2024-11-21 12:10:02 +09:00
かっこかり
53e827b18c
fix(backend): fix security patches (#15008) 2024-11-21 10:30:30 +09:00
syuilo
0f59adc436 fix ap/show 2024-11-21 09:25:18 +09:00
syuilo
9fdabe3666 fix(backend): use atomic command to improve security
Co-Authored-By: Acid Chicken <root@acid-chicken.com>
2024-11-21 09:22:15 +09:00
rectcoordsystem
090e9392cd
Merge commit from fork
* fix(backend): check target IP before sending HTTP request

* fix(backend): allow accessing private IP when testing

* Apply suggestions from code review

Co-authored-by: anatawa12 <anatawa12@icloud.com>

* fix(backend): lint and typecheck

* fix(backend): add isLocalAddressAllowed option to getAgentByUrl and send (HttpRequestService)

* fix(backend): allow fetchSummaryFromProxy, trueMail to access local addresses

---------

Co-authored-by: anatawa12 <anatawa12@icloud.com>
Co-authored-by: syuilo <4439005+syuilo@users.noreply.github.com>
2024-11-21 08:27:09 +09:00
Julia
b9cb949eb1
Merge commit from fork
* Fix poll update spoofing

* fix: Disallow negative poll counts

---------

Co-authored-by: syuilo <4439005+syuilo@users.noreply.github.com>
2024-11-21 08:24:50 +09:00
Julia
5f675201f2
Merge commit from fork
* enhance: Add a few validation fixes from Sharkey

See the original MR on the GitLab instance:
https://activitypub.software/TransFem-org/Sharkey/-/merge_requests/484

Co-Authored-By: Dakkar <dakkar@thenautilus.net>

* fix: primitive 2: acceptance of cross-origin alternate

Co-Authored-By: Laura Hausmann <laura@hausmann.dev>

* fix: primitive 3: validation of non-final url

* fix: primitive 4: missing same-origin identifier validation of collection-wrapped activities

* fix: primitives 5 & 8: reject activities with non
string identifiers

Co-Authored-By: Laura Hausmann <laura@hausmann.dev>

* fix: primitive 6: reject anonymous objects that were fetched by their id

* fix: primitives 9, 10 & 11: http signature validation
doesn't enforce required headers or specify auth header name

Co-Authored-By: Laura Hausmann <laura@hausmann.dev>

* fix: primitive 14: improper validation of outbox, followers, following & shared inbox collections

* fix: code style for primitive 14

* fix: primitive 15: improper same-origin validation for
note uri and url

Co-Authored-By: Laura Hausmann <laura@hausmann.dev>

* fix: primitive 16: improper same-origin validation for user uri and url

* fix: primitive 17: note same-origin identifier validation can be bypassed by wrapping the id in an array

* fix: code style for primitive 17

* fix: check attribution against actor in notes

While this isn't strictly required to fix the exploits at hand, this
mirrors the fix in `ApQuestionService` for GHSA-5h8r-gq97-xv69, as a
preemptive countermeasure.

* fix: primitive 18: `ap/get` bypasses access checks

One might argue that we could make this one actually preform access
checks against the returned activity object, but I feel like that's a
lot more work than just restricting it to administrators, since, to me
at least, it seems more like a debugging tool than anything else.

* fix: primitive 19 & 20: respect blocks and hide more

Ideally, the user property should also be hidden (as leaving it in leaks
information slightly), but given the schema of the note endpoint, I
don't think that would be possible without introducing some kind of
"ghost" user, who is attributed for posts by users who have you blocked.

* fix: primitives 21, 22, and 23: reuse resolver

This also increases the default `recursionLimit` for `Resolver`, as it
theoretically will go higher that it previously would and could possibly
fail on non-malicious collection activities.

* fix: primitives 25-33: proper local instance checks

* revert: fix: primitive 19 & 20

This reverts commit 465a9fe6591de90f78bd3d084e3c01e65dc3cf3c.

---------

Co-authored-by: Dakkar <dakkar@thenautilus.net>
Co-authored-by: Laura Hausmann <laura@hausmann.dev>
Co-authored-by: syuilo <4439005+syuilo@users.noreply.github.com>
2024-11-21 08:20:09 +09:00
Sayamame-beans
aa48a0e207
Fix: リノートミュートが新規投稿通知に対して作用していなかった問題を修正 (#15006)
* fix(backend): renoteMute doesn't work for note notification

* docs(changelog): update changelog
2024-11-21 08:00:50 +09:00
syuilo
f0c3a4cc0b
perf(frontend): reduce api requests for non-logged-in enviroment (#15001)
* wip

* Update CHANGELOG.md

* wip
2024-11-21 07:58:34 +09:00
zawa-ch.
763c708253
Fix(backend): アカウント削除のモデレーションログが動作していないのを修正 (#14996) (#14997)
* アカウント削除のモデレーションログが動作していないのを修正

* update CHANGELOG
2024-11-19 21:12:40 +09:00
おさむのひと
7b9c884a5d
refactor(backend): SystemWebhookで送信されるペイロードの型を追加 (#14980) 2024-11-19 10:41:39 +09:00
饺子w (Yumechi)
e800c0f85a
fix(backend): お知らせ作成時に画像URL入力欄を空欄に変更できないのを修正 (#14990)
* fix(backend): アナウンスメントを作成ときに画像URLを後悔できないのを修正

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

* Update CHANGELOG.md

Co-authored-by: おさむのひと <46447427+samunohito@users.noreply.github.com>

---------

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>
Co-authored-by: おさむのひと <46447427+samunohito@users.noreply.github.com>
2024-11-19 10:29:42 +09:00
CDN
b3c2de2b26
fix(backend): fallback sharedInbox to null in ApPersonService (#14970) 2024-11-16 18:53:28 +09:00
syuilo
eef0c895bc use execa 8.0.1
#14966
2024-11-15 19:48:31 +09:00
syuilo
d9d92bcfbf Revert "use nodemon 3.0.2"
This reverts commit ce1f84e5a3.
2024-11-15 19:40:12 +09:00
syuilo
ce1f84e5a3 use nodemon 3.0.2
#14966
2024-11-15 19:33:50 +09:00
かっこかり
c0d1682604
feat: 送信したフォローリクエストを確認できるように (#14856)
* FEAT: Allow users to view pending follow requests they sent

This commit implements the `following/requests/sent` interface firstly
implemented on Firefish, and provides a UI interface to view the pending
follow requests users sent.

* ux: should not show follow requests tab when have no pending sent follow req

* fix default followreq tab

* fix default followreq tab

* restore missing hasPendingReceivedFollowRequest in navbar

* refactor

* use tabler icons

* tweak design

* Revert "ux: should not show follow requests tab when have no pending sent follow req"

This reverts commit e580b92c37.

* Update Changelog

* Update Changelog

* change tab titles

---------

Co-authored-by: Lhc_fl <lhcfl@outlook.com>
Co-authored-by: Hazelnoot <acomputerdog@gmail.com>
2024-11-15 17:30:54 +09:00
syuilo
e26e24b610
update deps (#14950)
* update deps

* wip

* Revert "wip"

This reverts commit 393de249fe.

* wip

* wip

* wip

* wip
2024-11-15 17:22:00 +09:00
饺子w (Yumechi)
a11b77a415
fix(backend): Webhook Test一致性 (#14863)
* fix(backend): Webhook Test一致性

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

* UserWebhookPayload<'followed'> 修正

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

---------

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>
2024-11-12 09:51:18 +09:00
かっこかり
4a62051ce7
fix(backend): ローカルユーザーへのメンションを含むノートが連合される際に正しいURLに変換されないことがある問題を修正 (#14879)
* fix: make sure mentions of local users get rendered correctly during AP delivery (resolves #645)

* Update Changelog

* indent

---------

Co-authored-by: Laura Hausmann <laura@hausmann.dev>
Co-authored-by: syuilo <4439005+syuilo@users.noreply.github.com>
2024-11-09 10:58:09 +09:00
momoirodouhu
a4c5ce1413
enhance(backend) : リモートユーザーの照会をオリジナルにリダイレクトするように (#12892) (#14897)
* enhance(backend) : リモートユーザーの照会をオリジナルにリダイレクトするように (#12892)

* オリジンリダイレクトのテストをtodoとして追加。

e2eテストにリモートユーザー考慮のテストがなさそうなので。

次のコマンドで動くことは確認済みです。
curl "http://localhost:3000/@foo@bar" -H "accept: application/activity+json" -L

* Acctのパースを既存のパーサーでするように修正

* lint
2024-11-09 10:54:44 +09:00
かっこかり
e75b62f3f5
enhance(frontend): 個別お知らせページではmetaタグを出力するように (#14902)
* enhance(frontend): 個別お知らせページではmetaタグを出力するように

* Update Changelog
2024-11-09 10:53:09 +09:00
かっこかり
98b4717c45
fix(backend): SQLのサニタイズを強化 (#14920)
* Fix code scanning alert no. 28: Incomplete string escaping or encoding (MisskeyIO#800)

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
(cherry picked from commit 443335c662b14f609d6a81a8f3807e95709aebc1)

* ✌️

---------

Co-authored-by: あわわわとーにゅ <17376330+u1-liquid@users.noreply.github.com>
2024-11-09 10:51:28 +09:00
4ster1sk
794cb9ffe2
fix(backend): followedMessageではなくdescriptionになっていたのを修正 (#14908) 2024-11-07 17:16:51 +09:00
4ster1sk
bca690f256
fix(backend): フォロワーへのメッセージの絵文字をemojisに含めるように (#14904) 2024-11-07 15:10:10 +09:00
かっこかり
b1c82213a3
fix(backend): FTT無効時にユーザーリストタイムラインが使用できない問題を修正 (#14878)
* fix: return getfromdb when FanoutTimeline is not enabled

* Update Changelog

* fix

---------

Co-authored-by: Lhc_fl <lhcfl@outlook.com>
2024-11-06 22:01:21 +09:00
かっこかり
6718a54f6f
fix(backend): ノートを連合する際にリモートユーザーのacctの大小文字を区別して処理している問題を修正 (#14880)
* fix: make sure outgoing remote mentions get resolved correctly if referenced with non-canonical casing (resolves #646)

* Update Changelog

* Update Changelog

* indent

---------

Co-authored-by: Laura Hausmann <laura@hausmann.dev>
2024-11-03 08:26:51 +09:00
かっこかり
f30d19051f
enhance(backend): check_connect.js で全RedisとDBへの接続を確認するように (#14853)
* fix race conditions in check_connect.js

(cherry picked from commit 524ddb96770690455b82522104a543c5b0b1f3b3)

* fix

* Update Changelog

---------

Co-authored-by: Hazelnoot <acomputerdog@gmail.com>
2024-10-28 21:06:54 +09:00
Tamme Schichler
8eb7749e44
fix(backend): Accept arrays in ActivityPub icon and image properties (#14825)
This is allowed according to the Activity vocabulary: https://www.w3.org/TR/activitystreams-vocabulary/#dfn-icon
The issue is noticeable in combination with Bridgy Fed: https://github.com/snarfed/bridgy-fed/issues/1408
2024-10-28 21:06:16 +09:00
syuilo
74847bce30 enhance: アイコンデコレーション管理画面の改善 2024-10-28 20:42:14 +09:00
かっこかり
ec4358d1e8
fix(misskey-js): WebSocketの型定義をReconnectingWebsocketに依存するように (#14850)
* fix(misskey-js): WebSocketの型定義をReconnectingWebsocketに依存するように

* Update Changelog

* run api extractor

* fix

* fix
2024-10-28 11:43:05 +09:00
かっこかり
eeea4ec00b
fix(backend): 招待コード発行可能残り数算出に使用すべきロールポリシーの値が違うのを修正 (#14834)
* fix: should use invite limit cycle to calculate invite/limit

* Update Changelog

* Update changelog

---------

Co-authored-by: Lhc_fl <lhcfl@outlook.com>
2024-10-25 15:09:37 +09:00
饺子w (Yumechi)
48d1539f3b
Merge commit from fork
[ghsa-gq5q-c77c-v236](https://github.com/misskey-dev/misskey/security/advisories/ghsa-gq5q-c77c-v236)

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>
2024-10-22 18:17:56 +09:00
syuilo
952fec5665
feat: 過去のノートを非公開化/フォロワーのみ表示可能にできる機能 (#14814)
* wip

* Update CHANGELOG.md

* wip

* wip

* wip

* Update privacy.vue

* wip
2024-10-22 17:08:53 +09:00
syuilo
5c79d8db20
feat: ノートの閲覧にログイン必須にする設定 (#14799)
* wip

* wip

* wip

* Update packages/frontend/src/pages/note.vue

Co-authored-by: かっこかり <67428053+kakkokari-gtyih@users.noreply.github.com>

* wip

* Update WebhookTestService.ts

* Update privacy.vue

* wip

* rename

* Update locales/ja-JP.yml

Co-authored-by: Sayamame-beans <61457993+Sayamame-beans@users.noreply.github.com>

* 🎨

* wip

---------

Co-authored-by: かっこかり <67428053+kakkokari-gtyih@users.noreply.github.com>
Co-authored-by: Sayamame-beans <61457993+Sayamame-beans@users.noreply.github.com>
2024-10-21 12:49:29 +09:00
かっこかり
a3a99467f0
enhance(frontend): Bull Dashboard に relationship queue を追加 (#14777)
* spec(frontend): Bull Dashboard に relationship queue を追加 (MisskeyIO#751)

(cherry picked from commit a8bbccbefa67ca0f2c1ec0880da88dfc7517b6a0)

* Update Changelog

* Update Changelog

---------

Co-authored-by: riku6460 <17585784+riku6460@users.noreply.github.com>
2024-10-19 17:25:11 +09:00