From f8f17a44d4113cf2e84418f7a1189c6884c5e134 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Tue, 28 Jan 2025 12:29:17 +0000 Subject: [PATCH 01/26] [skip ci] Update CHANGELOG.md (prepend template) --- CHANGELOG.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3a4aa3932b..a39aa3c8fb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,15 @@ +## Unreleased + +### General +- + +### Client +- + +### Server +- + + ## 2025.1.0 ### Note From 77e421029cb564a97f42b6e41c9edce49f79cecd Mon Sep 17 00:00:00 2001 From: nexryai <61890205+nexryai@users.noreply.github.com> Date: Sat, 1 Feb 2025 13:33:37 +0900 Subject: [PATCH 02/26] Merge commit from fork * fix(frontend): Improve cookie attributes * fix(frontend): Delete an old authentication cookie in fetchAccount --- packages/frontend/src/account.ts | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/packages/frontend/src/account.ts b/packages/frontend/src/account.ts index 36186ecac1..2f9a887720 100644 --- a/packages/frontend/src/account.ts +++ b/packages/frontend/src/account.ts @@ -101,6 +101,9 @@ export async function removeAccount(idOrToken: Account['id']) { } function fetchAccount(token: string, id?: string, forceShowDialog?: boolean): Promise { + document.cookie = "token=; path=/; max-age=0"; + document.cookie = `token=${token}; path=/queue; max-age=86400; SameSite=Strict; Secure`; // bull dashboardの認証とかで使う + return new Promise((done, fail) => { window.fetch(`${apiUrl}/i`, { method: 'POST', @@ -213,7 +216,6 @@ export async function login(token: Account['token'], redirect?: string) { throw reason; }); miLocalStorage.setItem('account', JSON.stringify(me)); - document.cookie = `token=${token}; path=/; max-age=31536000`; // bull dashboardの認証とかで使う await addAccount(me.id, token); if (redirect) { From ba9f295ef2bf31cc90fa587e20b9a7655b7a1824 Mon Sep 17 00:00:00 2001 From: Sung Jae Lee Date: Sat, 1 Feb 2025 13:35:42 +0900 Subject: [PATCH 03/26] Merge commit from fork MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(account): clear token cookie when signout called * fix: cookie not cleared correctly when logout Co-authored-by: おさむのひと <46447427+samunohito@users.noreply.github.com> * feat: clear only token cookie when signout --------- Co-authored-by: おさむのひと <46447427+samunohito@users.noreply.github.com> --- packages/frontend/src/account.ts | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/packages/frontend/src/account.ts b/packages/frontend/src/account.ts index 2f9a887720..9006150bc8 100644 --- a/packages/frontend/src/account.ts +++ b/packages/frontend/src/account.ts @@ -41,6 +41,12 @@ export async function signout() { if (!$i) return; waiting(); + document.cookie.split(';').forEach((cookie) => { + const cookieName = cookie.split('=')[0].trim(); + if (cookieName === 'token') { + document.cookie = `${cookieName}=; max-age=0; path=/`; + } + }); miLocalStorage.removeItem('account'); await removeAccount($i.id); const accounts = await getAccounts(); From 40bfb1be0962c3e7762f3f777034c0d2da137b39 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E3=81=8B=E3=81=A3=E3=81=93=E3=81=8B=E3=82=8A?= <67428053+kakkokari-gtyih@users.noreply.github.com> Date: Sat, 1 Feb 2025 13:36:10 +0900 Subject: [PATCH 04/26] =?UTF-8?q?fix(backend):=20=E3=81=8A=E7=9F=A5?= =?UTF-8?q?=E3=82=89=E3=81=9B=E3=81=AEmeta=E3=82=BF=E3=82=B0=E5=87=BA?= =?UTF-8?q?=E5=8A=9B=E3=81=AE=E6=9D=A1=E4=BB=B6=E3=81=8C=E9=96=93=E9=81=95?= =?UTF-8?q?=E3=81=A3=E3=81=A6=E3=81=84=E3=81=9F=E3=81=AE=E3=82=92=E4=BF=AE?= =?UTF-8?q?=E6=AD=A3=20(#15377)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(backend): お知らせのmetaタグ出力の条件が間違っていたのを修正 * Update Changelog --- CHANGELOG.md | 2 +- packages/backend/src/server/web/ClientServerService.ts | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a39aa3c8fb..4b4c0e3924 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,7 +7,7 @@ - ### Server -- +- Fix: 個別お知らせページのmetaタグ出力の条件が間違っていたのを修正 ## 2025.1.0 diff --git a/packages/backend/src/server/web/ClientServerService.ts b/packages/backend/src/server/web/ClientServerService.ts index 4c884dd314..f8b3843cac 100644 --- a/packages/backend/src/server/web/ClientServerService.ts +++ b/packages/backend/src/server/web/ClientServerService.ts @@ -817,6 +817,7 @@ export class ClientServerService { fastify.get<{ Params: { announcementId: string; } }>('/announcements/:announcementId', async (request, reply) => { const announcement = await this.announcementsRepository.findOneBy({ id: request.params.announcementId, + userId: IsNull(), }); if (announcement) { From 89b461a5da42e6632a60c29796df6fb74d3cafd1 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Sat, 1 Feb 2025 04:43:33 +0000 Subject: [PATCH 05/26] Bump version to 2025.2.0-alpha.0 --- CHANGELOG.md | 2 +- package.json | 2 +- packages/misskey-js/package.json | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4b4c0e3924..08dec985af 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,4 @@ -## Unreleased +## 2025.2.0 ### General - diff --git a/package.json b/package.json index bddb4f85a2..db3c492b60 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "misskey", - "version": "2025.1.0", + "version": "2025.2.0-alpha.0", "codename": "nasubi", "repository": { "type": "git", diff --git a/packages/misskey-js/package.json b/packages/misskey-js/package.json index 9d48531c48..667af78ce0 100644 --- a/packages/misskey-js/package.json +++ b/packages/misskey-js/package.json @@ -1,7 +1,7 @@ { "type": "module", "name": "misskey-js", - "version": "2025.1.0", + "version": "2025.2.0-alpha.0", "description": "Misskey SDK for JavaScript", "license": "MIT", "main": "./built/index.js", From ae65aecc0c5cefa7d397c3860384c08b5cab149d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E3=81=8B=E3=81=A3=E3=81=93=E3=81=8B=E3=82=8A?= <67428053+kakkokari-gtyih@users.noreply.github.com> Date: Sat, 1 Feb 2025 13:47:21 +0900 Subject: [PATCH 06/26] =?UTF-8?q?refactor(frontend):=20defineProps?= =?UTF-8?q?=E3=82=92=E5=88=A5=E9=80=94=E3=82=A4=E3=83=B3=E3=83=9D=E3=83=BC?= =?UTF-8?q?=E3=83=88=E3=81=97=E3=81=A6=E3=81=84=E3=82=8B=E7=AE=87=E6=89=80?= =?UTF-8?q?=E3=82=92=E9=99=A4=E5=8E=BB=20(#15375)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../frontend/src/components/MkCustomEmojiDetailedDialog.vue | 2 +- packages/frontend/src/components/MkRoleSelectDialog.vue | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/frontend/src/components/MkCustomEmojiDetailedDialog.vue b/packages/frontend/src/components/MkCustomEmojiDetailedDialog.vue index ecbee864dc..e6ab17417d 100644 --- a/packages/frontend/src/components/MkCustomEmojiDetailedDialog.vue +++ b/packages/frontend/src/components/MkCustomEmojiDetailedDialog.vue @@ -57,7 +57,7 @@ SPDX-License-Identifier: AGPL-3.0-only diff --git a/packages/frontend/src/ui/deck/deck-store.ts b/packages/frontend/src/ui/deck/deck-store.ts index 3186982349..231bf19aa8 100644 --- a/packages/frontend/src/ui/deck/deck-store.ts +++ b/packages/frontend/src/ui/deck/deck-store.ts @@ -112,9 +112,8 @@ export const loadDeck = async () => { deckStore.set('layout', deck.layout); }; -// TODO: deckがloadされていない状態でsaveすると意図せず上書きが発生するので対策する -export const saveDeck = throttle(1000, () => { - misskeyApi('i/registry/set', { +export async function forceSaveDeck() { + await misskeyApi('i/registry/set', { scope: ['client', 'deck', 'profiles'], key: deckStore.state.profile, value: { @@ -122,6 +121,11 @@ export const saveDeck = throttle(1000, () => { layout: deckStore.reactiveState.layout.value, }, }); +} + +// TODO: deckがloadされていない状態でsaveすると意図せず上書きが発生するので対策する +export const saveDeck = throttle(1000, () => { + forceSaveDeck(); }); export async function getProfiles(): Promise { From 0f0e88e4c7bcfb30a3800e5e942c6414659e1eaa Mon Sep 17 00:00:00 2001 From: syuilo <4439005+syuilo@users.noreply.github.com> Date: Wed, 5 Feb 2025 17:14:40 +0900 Subject: [PATCH 25/26] Update CHANGELOG.md --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index c5a25c5e84..5acfb71727 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ - Fix: MFMの `sparkle` エフェクトが正しく表示されない問題を修正 - Fix: ページのURLにスラッシュが含まれている場合にページが正しく表示されない問題を修正 - Fix: デッキのプロファイルが新規作成できない問題を修正 +- Fix: セキュリティに関する修正 - ローカライゼーションの更新 - Playが実装されたため、ページ機能の「ソースを見る」は削除されました From b7c3630da991bd0ab75f86c6b95092b161cc8085 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Wed, 5 Feb 2025 08:58:41 +0000 Subject: [PATCH 26/26] Release: 2025.2.0 --- package.json | 2 +- packages/misskey-js/package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index 972191a88f..52c139342f 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "misskey", - "version": "2025.2.0-beta.1", + "version": "2025.2.0", "codename": "nasubi", "repository": { "type": "git", diff --git a/packages/misskey-js/package.json b/packages/misskey-js/package.json index b9dd5b6817..601c261a05 100644 --- a/packages/misskey-js/package.json +++ b/packages/misskey-js/package.json @@ -1,7 +1,7 @@ { "type": "module", "name": "misskey-js", - "version": "2025.2.0-beta.1", + "version": "2025.2.0", "description": "Misskey SDK for JavaScript", "license": "MIT", "main": "./built/index.js",