Commit graph

72 commits

Author SHA1 Message Date
Oneric
b645643cfb Merge pull request 'Allow fine-grained announce visibilities' (#941) from Oneric/akkoma:announce-visibility into develop
Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/941
Reviewed-by: floatingghost <hannah@coffee-and-dreams.uk>
Signed-off-by: nicole mikołajczyk <git@mkljczk.pl>
2026-03-03 12:48:12 +00:00
nicole mikołajczyk
80ede85f75 Allow assigning users to reports
Signed-off-by: nicole mikołajczyk <git@mkljczk.pl>
2026-01-28 10:35:19 +01:00
Phantasm
3466b626d6
lint 2025-12-14 14:06:38 +01:00
Phantasm
49a5630c75
CommonAPI: Standardize visibility error, use helper function if possible 2025-12-12 18:05:58 +01:00
Phantasm
fe7108cbc2
MastoAPI: Unify pin/bookmark/mute/fav not visible responses to 404
Also adds more tests for these interactions.
2025-12-12 00:04:27 +01:00
Phantasm
73a3f06f71
PleromaAPI: Change EmojiReact to invisible post response from 400 to 404 2025-12-12 00:03:59 +01:00
Phantasm
293628fb24
MastoAPI/CommonAPI: Return 404 when post not visible to user
Akkoma patches returned 403 and some of my previous commits returned 422.
This unifies the errors returned to 404 "Record not found", gaslighting
user just like we do for other endpoints and how Mastodon does it.
2025-12-11 23:32:21 +01:00
Phantasm
426535bc38
CommonAPI: Forbid disallowed status (un)muting and unpinning
When a user tried to unpin a status not belonging to them, a full
MastoAPI response was sent back even if status was not visible to them.

Ditto with (un)mutting except ownership.
2025-12-11 23:30:04 +01:00
Phantasm
2b76243ec8
CommonAPI: Fail when user sends report with posts not visible to them 2025-12-11 23:30:03 +01:00
Oneric
59fcb5c96e
api: ensure only visible posts are interactable
Port of Akkoma PR 1014 with a few changes:
- comments regarding akkomafe changed to Pleroma-FE when applicable
- different error message for replying to/interacting with invisible post
  in Pleroma.Web.CommonAPI.ActivityDraft.in_reply_to/1
- split "doesn't do funny things to other users favs" test into three:
  - can't unfavourite post that isn't favourited
  - can't unfavourite other user's favs
  - can't unfavourite other user's favs using their activity
- switched order of args for some CommonAPI function since Akkoma hasn't
  backported our old change for that

Pleroma.Web.CommonAPI.ActivityDraft.in_reply_to/1 now refactored to use
`with` statement as in Akkoma. Some defp in_reply_to/1 were therefore removed

Original PR author: Oneric
Original commit message:
It doesn't make sense to like, react, reply, etc to something you cannot
see and is unexpected for the author of the interacted with post and
might make them believe the reacting user actually _can_ see the post.

Wrt to fav, reblog, reaction indexes the missing visibility check was
also leaking some (presumably/hopefully) low-severity data.

Add full-API test for all modes of interactions with private posts.
2025-12-11 23:30:02 +01:00
Ekaterina Vaartis
51a0cee405 Add expiring blocks
- `/api/v1/accounts/:id/block` now has a "duration" parameter
- `/api/v1/blocks` returns "block_expires_at" to indicate when the block
will expire
- MuteExpireWorker also processes block expiration
- Remove unused OpenAPI parameters from mute endpoint
- Add pleroma:block_expiration to nodeinfo features
2025-04-15 12:55:09 +03:00
Mark Felder
bc16f09d7b Dialyzer: the pattern can never match the type
The original error was for the chat controller:

lib/pleroma/web/pleroma_api/controllers/chat_controller.ex:104:pattern_match The pattern can never match the type {:error, :content_too_long | :forbidden | :no_content | :not_found} | {:user, nil}.

Improve typespecs for the Pipeline and apply them where it could be encountered
2024-09-06 11:12:15 -04:00
Mark Felder
06e8ece4cc Fix CommonAPI.follow/2 which returned users in the reverse order they were provided to the function 2024-08-07 12:39:58 -04:00
Mark Felder
52e9bec156 Remove WorkerHelper 2024-07-30 11:34:48 -04:00
Mark Felder
8893ad9899 Fix cancelling jobs 2024-07-29 09:59:35 -04:00
Mark Felder
12f498bc0d Fix order of args for show_reblogs/2 2024-07-22 19:19:21 -04:00
Mark Felder
3f4f567c9c Fix order of args for hide_reblogs/2 2024-07-22 19:16:00 -04:00
Mark Felder
adb93f7e5d Fix order of args for unfollow/2 2024-07-22 19:11:22 -04:00
Mark Felder
f79a16c062 Fix order of args for follow/2 2024-07-22 19:07:55 -04:00
Mark Felder
082319ff48 Fix order of args for unblock/2 2024-07-22 18:44:32 -04:00
Mark Felder
cbc5e48417 Fix order of args for block/2 2024-07-22 18:41:50 -04:00
Mark Felder
1cccc0fc21 Fix order of args for vote/3 2024-07-22 18:38:02 -04:00
Mark Felder
8127e0d8cc Fix order of args for thread_muted?/2 2024-07-22 18:25:37 -04:00
Mark Felder
4601473aaf Fix order of args for add_mute/2 2024-07-22 18:25:37 -04:00
Mark Felder
d27ad36ce4 Fix order of args for remove_mute/2 2024-07-22 18:25:37 -04:00
Mark Felder
f602813d31 Fix order of args for update/2 2024-07-22 18:25:37 -04:00
Mark Felder
7e37882cf7 Fix order of args for favorite/2 2024-07-22 18:25:37 -04:00
Mark Felder
b1d3348331 Annotate public functions with typespecs and mark some functions as private 2024-07-22 18:25:33 -04:00
Mark Felder
d44765bc13 Support cancelling jobs when Unreacting 2024-07-20 15:14:46 -04:00
Mark Felder
304b7f5093 Support cancelling jobs when Unrepeating 2024-07-20 15:06:19 -04:00
Mark Felder
86ae00f9da Support cancelling jobs when Unfavoriting 2024-07-20 14:54:31 -04:00
Mark Felder
62280a3b9f Cancel queued (undelivered) publishing jobs for an activity when deleting that activity. 2024-07-20 14:54:04 -04:00
Mark Felder
fd62969dc4 Dialyzer: pattern can never match the type 2024-07-01 11:45:25 -04:00
Mark Felder
69482004fc Dialyzer: pattern can never match the type because it is covered by previous clauses. 2024-07-01 11:38:40 -04:00
marcin mikołajczak
918c406a91 Merge remote-tracking branch 'origin/develop' into instance_rules
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2024-03-18 13:50:25 +01:00
Mark Felder
5b95abaeea Credo.Check.Readability.PredicateFunctionNames
This check was recently improved in Credo and it does make sense for readability.

The offending functions in Pleroma have been renamed and a couple missing the ? suffix have been fixed as well.
2024-01-26 16:59:58 -05:00
Mark Felder
3a8594e927 MastodonAPI.Controller.StatusController: fix dialyzer error
lib/pleroma/web/mastodon_api/controllers/status_controller.ex:333:pattern_match
The pattern can never match the type.

Pattern:
{:ok, _activity}

Type:
{:error, _}
2024-01-22 18:37:29 -05:00
marcin mikołajczak
6051715a99 Merge remote-tracking branch 'origin/develop' into instance_rules
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-12-22 14:34:30 +01:00
Mark Felder
9896b64f54 Elixir 1.15: Chase the Logger.warn deprecation 2023-12-20 20:16:26 +00:00
Mint
1afde067b1 CommonAPI: Prevent users from accessing media of other users 2023-09-03 10:41:37 +02:00
tusooa
6e4de2383f
Fix handling report from a deactivated user 2023-07-02 11:15:34 -04:00
tusooa
1fa196d8f7
Fix deleting banned users' statuses 2023-05-25 19:00:38 -04:00
lain
e853cfe7c3 Revert "Merge branch 'copyright-bump' into 'develop'"
This reverts merge request !3825
2023-01-02 20:38:50 +00:00
marcin mikołajczak
10886eeaa2 Bump copyright year
Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-01-01 12:13:06 +01:00
Sean King
c58eb873dd
Fix CommonAPI delete function to use User.privileged? instead of User.superuser? 2022-12-18 22:05:07 -07:00
Sean King
60df2d8a97
Merge branch 'develop' of git.pleroma.social:pleroma/pleroma into fine_grained_moderation_privileges 2022-12-18 22:03:48 -07:00
Haelwenn (lanodan) Monnier
16b06160ac CommonAPI: generate ModerationLog for all admin/moderator deletes
As a side-effect it also changes the ChatMessage delete ID to an
Activity.id rather than MessageReference.id

Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/2958
2022-10-14 18:51:08 +02:00
Tusooa Zhu
04ded94a50
Fix remote emoji in subject disappearing after edits 2022-07-09 18:00:42 -04:00
Ilja
37fdf148b0 Rename privilege tags
I first focussed on getting things working
Now that they do and we know what tags there are, I put some thought in providing better names

I use the form <what_it_controls>_<what_it_allows_you_to_do>

:statuses_read    => :messages_read
:status_delete    => :messages_delete

:user_read        => :users_read
:user_deletion    => :users_delete
:user_activation  => :users_manage_activation_state
:user_invite      => :users_manage_invites
:user_tag         => :users_manage_tags
:user_credentials => :users_manage_credentials

:report_handle    => :reports_manage_reports

:emoji_management => :emoji_manage_emoji
2022-07-01 10:28:09 +02:00
Tusooa Zhu
99a6f50316
Unify the logic of updating objects 2022-06-25 00:32:22 -04:00