Merge remote-tracking branch 'remotes/origin/develop' into ostatus-controller-no-auth-check-on-non-federating-instances

4 files changed, 121 insertions, 43 deletions

diff --git a/test/emails/admin_email_test.exs b/test/emails/admin_email_test.exs
index e24231e27..155057f3e 100644
--- a/test/emails/admin_email_test.exs
+++ b/test/emails/admin_email_test.exs
@@ -63,7 +63,7 @@ defmodule Pleroma.Emails.AdminEmailTest do
     assert res.html_body == """
            <p>New account for review: <a href="#{account_url}">@#{account.nickname}</a></p>
            <blockquote>Plz let me in</blockquote>
-           <a href="http://localhost:4001/pleroma/admin">Visit AdminFE</a>
+           <a href="http://localhost:4001/pleroma/admin/#/users/#{account.id}/">Visit AdminFE</a>
            """
   end
 end
diff --git a/test/plugs/remote_ip_test.exs b/test/plugs/remote_ip_test.exs
index 752ab32e7..6d01c812d 100644
--- a/test/plugs/remote_ip_test.exs
+++ b/test/plugs/remote_ip_test.exs
@@ -3,13 +3,27 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 
 defmodule Pleroma.Plugs.RemoteIpTest do
-  use ExUnit.Case, async: true
+  use ExUnit.Case
   use Plug.Test
 
   alias Pleroma.Plugs.RemoteIp
 
-  import Pleroma.Tests.Helpers, only: [clear_config: 1, clear_config: 2]
-  setup do: clear_config(RemoteIp)
+  import Pleroma.Tests.Helpers, only: [clear_config: 2]
+
+  setup do:
+          clear_config(RemoteIp,
+            enabled: true,
+            headers: ["x-forwarded-for"],
+            proxies: [],
+            reserved: [
+              "127.0.0.0/8",
+              "::1/128",
+              "fc00::/7",
+              "10.0.0.0/8",
+              "172.16.0.0/12",
+              "192.168.0.0/16"
+            ]
+          )
 
   test "disabled" do
     Pleroma.Config.put(RemoteIp, enabled: false)
@@ -25,8 +39,6 @@ defmodule Pleroma.Plugs.RemoteIpTest do
   end
 
   test "enabled" do
-    Pleroma.Config.put(RemoteIp, enabled: true)
-
     conn =
       conn(:get, "/")
       |> put_req_header("x-forwarded-for", "1.1.1.1")
@@ -54,8 +66,6 @@ defmodule Pleroma.Plugs.RemoteIpTest do
   end
 
   test "custom proxies" do
-    Pleroma.Config.put(RemoteIp, enabled: true)
-
     conn =
       conn(:get, "/")
       |> put_req_header("x-forwarded-for", "173.245.48.1, 1.1.1.1, 173.245.48.2")
@@ -72,4 +82,27 @@ defmodule Pleroma.Plugs.RemoteIpTest do
 
     assert conn.remote_ip == {1, 1, 1, 1}
   end
+
+  test "proxies set without CIDR format" do
+    Pleroma.Config.put([RemoteIp, :proxies], ["173.245.48.1"])
+
+    conn =
+      conn(:get, "/")
+      |> put_req_header("x-forwarded-for", "173.245.48.1, 1.1.1.1")
+      |> RemoteIp.call(nil)
+
+    assert conn.remote_ip == {1, 1, 1, 1}
+  end
+
+  test "proxies set `nonsensical` CIDR" do
+    Pleroma.Config.put([RemoteIp, :reserved], ["127.0.0.0/8"])
+    Pleroma.Config.put([RemoteIp, :proxies], ["10.0.0.3/24"])
+
+    conn =
+      conn(:get, "/")
+      |> put_req_header("x-forwarded-for", "10.0.0.3, 1.1.1.1")
+      |> RemoteIp.call(nil)
+
+    assert conn.remote_ip == {1, 1, 1, 1}
+  end
 end
diff --git a/test/web/activity_pub/activity_pub_test.exs b/test/web/activity_pub/activity_pub_test.exs
index 7bdad3810..804305a13 100644
--- a/test/web/activity_pub/activity_pub_test.exs
+++ b/test/web/activity_pub/activity_pub_test.exs
@@ -2177,4 +2177,84 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubTest do
       assert user.nickname == orig_user.nickname
     end
   end
+
+  describe "reply filtering" do
+    test "`following` still contains announcements by friends" do
+      user = insert(:user)
+      followed = insert(:user)
+      not_followed = insert(:user)
+
+      User.follow(user, followed)
+
+      {:ok, followed_post} = CommonAPI.post(followed, %{status: "Hello"})
+
+      {:ok, not_followed_to_followed} =
+        CommonAPI.post(not_followed, %{
+          status: "Also hello",
+          in_reply_to_status_id: followed_post.id
+        })
+
+      {:ok, retoot} = CommonAPI.repeat(not_followed_to_followed.id, followed)
+
+      params =
+        %{}
+        |> Map.put(:type, ["Create", "Announce"])
+        |> Map.put(:blocking_user, user)
+        |> Map.put(:muting_user, user)
+        |> Map.put(:reply_filtering_user, user)
+        |> Map.put(:reply_visibility, "following")
+        |> Map.put(:announce_filtering_user, user)
+        |> Map.put(:user, user)
+
+      activities =
+        [user.ap_id | User.following(user)]
+        |> ActivityPub.fetch_activities(params)
+
+      followed_post_id = followed_post.id
+      retoot_id = retoot.id
+
+      assert [%{id: ^followed_post_id}, %{id: ^retoot_id}] = activities
+
+      assert length(activities) == 2
+    end
+
+    # This test is skipped because, while this is the desired behavior,
+    # there seems to be no good way to achieve it with the method that
+    # we currently use for detecting to who a reply is directed.
+    # This is a TODO and should be fixed by a later rewrite of the code
+    # in question.
+    @tag skip: true
+    test "`following` still contains self-replies by friends" do
+      user = insert(:user)
+      followed = insert(:user)
+      not_followed = insert(:user)
+
+      User.follow(user, followed)
+
+      {:ok, followed_post} = CommonAPI.post(followed, %{status: "Hello"})
+      {:ok, not_followed_post} = CommonAPI.post(not_followed, %{status: "Also hello"})
+
+      {:ok, _followed_to_not_followed} =
+        CommonAPI.post(followed, %{status: "sup", in_reply_to_status_id: not_followed_post.id})
+
+      {:ok, _followed_self_reply} =
+        CommonAPI.post(followed, %{status: "Also cofe", in_reply_to_status_id: followed_post.id})
+
+      params =
+        %{}
+        |> Map.put(:type, ["Create", "Announce"])
+        |> Map.put(:blocking_user, user)
+        |> Map.put(:muting_user, user)
+        |> Map.put(:reply_filtering_user, user)
+        |> Map.put(:reply_visibility, "following")
+        |> Map.put(:announce_filtering_user, user)
+        |> Map.put(:user, user)
+
+      activities =
+        [user.ap_id | User.following(user)]
+        |> ActivityPub.fetch_activities(params)
+
+      assert length(activities) == 2
+    end
+  end
 end
diff --git a/test/web/rich_media/helpers_test.exs b/test/web/rich_media/helpers_test.exs
index 8264a9c41..4b97bd66b 100644
--- a/test/web/rich_media/helpers_test.exs
+++ b/test/web/rich_media/helpers_test.exs
@@ -64,41 +64,6 @@ defmodule Pleroma.Web.RichMedia.HelpersTest do
              Pleroma.Web.RichMedia.Helpers.fetch_data_for_activity(activity)
   end
 
-  test "refuses to crawl URLs from posts marked sensitive" do
-    user = insert(:user)
-
-    {:ok, activity} =
-      CommonAPI.post(user, %{
-        status: "http://example.com/ogp",
-        sensitive: true
-      })
-
-    %Object{} = object = Object.normalize(activity)
-
-    assert object.data["sensitive"]
-
-    Config.put([:rich_media, :enabled], true)
-
-    assert %{} = Pleroma.Web.RichMedia.Helpers.fetch_data_for_activity(activity)
-  end
-
-  test "refuses to crawl URLs from posts tagged NSFW" do
-    user = insert(:user)
-
-    {:ok, activity} =
-      CommonAPI.post(user, %{
-        status: "http://example.com/ogp #nsfw"
-      })
-
-    %Object{} = object = Object.normalize(activity)
-
-    assert object.data["sensitive"]
-
-    Config.put([:rich_media, :enabled], true)
-
-    assert %{} = Pleroma.Web.RichMedia.Helpers.fetch_data_for_activity(activity)
-  end
-
   test "refuses to crawl URLs of private network from posts" do
     user = insert(:user)