After a redirect the 429/503 came from the final host, but the backoff
was recorded for the requested one. X-RateLimit-Reset is also accepted
as a Unix timestamp or as seconds.
Ported from Akkoma af7c3fab9; the rescue is in the Ecto type load so
admin input is still validated.
Co-authored-by: FloatingGhost <hannah@coffee-and-dreams.uk>
Gun resolves host names over IPv4 only unless :inet6 is in tcp_opts.
When the A lookup finds nothing, retry once with :inet6. Gun now runs
under its supervisor, so a failed connect no longer kills the pool
worker through the link; the worker still links after a successful open.
A Move usually follows right after the alias was added, and the cached
remote target may not have it yet. Refetch the target when the alias is
missing instead of rejecting the Move. Same issue as Akkoma f18e2ba42.
Bridgy Fed delivers Follow and Accept to the personal inbox addressed
only to Public. Any server can already address a local user directly,
so the check gave no protection. Ported from Akkoma 2b885288f.
Co-authored-by: Oneric <oneric@oneric.stub>
With 5 attempts and Oban's short retry delays, an incoming activity from
an unknown actor on a backed-off host was discarded without a request.
ReceiverWorker and SignatureRetryWorker now snooze for up to 2 hours.
Also lowercase backoff host keys and log backed-off user fetches at debug.
Object fetches and WebFinger stop sending requests to a host until
Retry-After or X-RateLimit-Reset (default 5 minutes, max 1 hour).
Ported from Akkoma's Pleroma.HTTP.Backoff.
Co-authored-by: FloatingGhost <hannah@coffee-and-dreams.uk>
Co-authored-by: Oneric <oneric@oneric.stub>
Escape the domain so `.` only matches a dot, and use an optional
group for the `*.` prefix, which matches the same hosts without
exponential backtracking. Bad entries now match nothing instead of
raising on every check.
Without them replace_params: false was ignored when strict is off, so
conn.params got atom keys and RateLimiter params: ["id"] buckets
collapsed to one per user.
the :do_not_federate checks were omitted from the undo pipeline,
which could lead to them federating.
this commit enforces :outgoing_blocks on undos as well - and
any existing value of :do_not_federate is preserved, if one exists
Akkoma issue 957.
[Pleroma: block/unblock test calls use the Pleroma (blocked, blocker) argument order.]
(cherry picked from commit eca7ed572b8a10a0235fb1a381eac4803614dee4)
Status search fetched any http(s) query from its remote server, for
anonymous users, on every result page and with resolve=false, so anyone
could make the server fetch URLs. As in Mastodon and in Pleroma's user
search, fetch only with resolve=true, on the first page, and for
anonymous users only if [:instance, :limit_to_local_content] is false.
Based on Akkoma ca9e33ed2 and 17efec060.
Co-authored-by: Oneric <oneric@oneric.stub>
The emoji reaction create and delete endpoints had no rate limiter.
Apply :statuses_actions like the other status actions, plus a per-status
:status_id_action bucket ("status_id_action:emoji_react") in the same way
favourite and reblog do.
POST /users/:nickname/outbox had no rate limiter, so a client could send
unlimited activities through the C2S API. Apply :statuses_actions to
update_outbox. RateLimiter keys buckets by limiter name and user, so the
outbox shares one counter with the Mastodon API status actions and mixing
both APIs does not double the limit.
StatusController keeps string param keys (replace_params: false, since
b8db67daf), so params: [:id] never matched and status_id_action became
one bucket per user across all statuses (3 favourites/reblogs a minute).
