aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--.gitlab-ci.yml2
-rw-r--r--installation/pleroma.nginx1
-rw-r--r--lib/pleroma/plugs/federating_plug.ex18
-rw-r--r--lib/pleroma/web/activity_pub/activity_pub_controller.ex1
-rw-r--r--lib/pleroma/web/mastodon_api/mastodon_api_controller.ex46
-rw-r--r--lib/pleroma/web/nodeinfo/nodeinfo_controller.ex2
-rw-r--r--lib/pleroma/web/oauth/oauth_controller.ex48
-rw-r--r--lib/pleroma/web/ostatus/ostatus_controller.ex1
-rw-r--r--lib/pleroma/web/router.ex57
-rw-r--r--lib/pleroma/web/templates/mastodon_api/mastodon/login.html.eex11
-rw-r--r--lib/pleroma/web/twitter_api/twitter_api_controller.ex13
-rw-r--r--lib/pleroma/web/web_finger/web_finger_controller.ex2
-rw-r--r--lib/pleroma/web/websub/websub_controller.ex9
-rw-r--r--test/web/node_info_test.exs32
-rw-r--r--test/web/plugs/federating_plug_test.exs33
-rw-r--r--test/web/twitter_api/twitter_api_controller_test.exs50
16 files changed, 241 insertions, 85 deletions
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 46fa1c74c..c28468cd4 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,4 +1,4 @@
-image: elixir:1.6.4
+image: elixir:1.7.2
services:
- postgres:9.6.2
diff --git a/installation/pleroma.nginx b/installation/pleroma.nginx
index 6dc2c9760..65a3cdb4c 100644
--- a/installation/pleroma.nginx
+++ b/installation/pleroma.nginx
@@ -62,7 +62,6 @@ server {
location / {
# if you do not want remote frontends to be able to access your Pleroma backend
# server, remove these lines.
- add_header 'Access-Control-Allow-Origin' '*' always;
add_header 'Access-Control-Allow-Methods' 'POST, PUT, DELETE, GET, PATCH, OPTIONS' always;
add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, Idempotency-Key' always;
add_header 'Access-Control-Expose-Headers' 'Link, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining, X-Request-Id' always;
diff --git a/lib/pleroma/plugs/federating_plug.ex b/lib/pleroma/plugs/federating_plug.ex
new file mode 100644
index 000000000..4108d90af
--- /dev/null
+++ b/lib/pleroma/plugs/federating_plug.ex
@@ -0,0 +1,18 @@
+defmodule Pleroma.Web.FederatingPlug do
+ import Plug.Conn
+
+ def init(options) do
+ options
+ end
+
+ def call(conn, opts) do
+ if Keyword.get(Application.get_env(:pleroma, :instance), :federating) do
+ conn
+ else
+ conn
+ |> put_status(404)
+ |> Phoenix.Controller.render(Pleroma.Web.ErrorView, "404.json")
+ |> halt()
+ end
+ end
+end
diff --git a/lib/pleroma/web/activity_pub/activity_pub_controller.ex b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
index 47937beef..3570a75cb 100644
--- a/lib/pleroma/web/activity_pub/activity_pub_controller.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
@@ -11,6 +11,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
action_fallback(:errors)
+ plug(Pleroma.Web.FederatingPlug when action in [:inbox, :relay])
plug(:relay_active? when action in [:relay])
def relay_active?(conn, _) do
diff --git a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
index 0e7d12c20..83728c81e 100644
--- a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
+++ b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
@@ -444,6 +444,12 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
render(conn, AccountView, "relationships.json", %{user: user, targets: targets})
end
+ # Instead of returning a 400 when no "id" params is present, Mastodon returns an empty array.
+ def relationships(%{assigns: %{user: user}} = conn, _) do
+ conn
+ |> json([])
+ end
+
def update_media(%{assigns: %{user: _}} = conn, data) do
with %Object{} = object <- Repo.get(Object, data["id"]),
true <- is_binary(data["description"]),
@@ -989,9 +995,29 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
end
end
+ def login(conn, %{"code" => code}) do
+ with {:ok, app} <- get_or_make_app(),
+ %Authorization{} = auth <- Repo.get_by(Authorization, token: code, app_id: app.id),
+ {:ok, token} <- Token.exchange_token(app, auth) do
+ conn
+ |> put_session(:oauth_token, token.token)
+ |> redirect(to: "/web/getting-started")
+ end
+ end
+
def login(conn, _) do
- conn
- |> render(MastodonView, "login.html", %{error: false})
+ with {:ok, app} <- get_or_make_app() do
+ path =
+ o_auth_path(conn, :authorize,
+ response_type: "code",
+ client_id: app.client_id,
+ redirect_uri: ".",
+ scope: app.scopes
+ )
+
+ conn
+ |> redirect(to: path)
+ end
end
defp get_or_make_app() do
@@ -1010,22 +1036,6 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
end
end
- def login_post(conn, %{"authorization" => %{"name" => name, "password" => password}}) do
- with %User{} = user <- User.get_by_nickname_or_email(name),
- true <- Pbkdf2.checkpw(password, user.password_hash),
- {:ok, app} <- get_or_make_app(),
- {:ok, auth} <- Authorization.create_authorization(app, user),
- {:ok, token} <- Token.exchange_token(app, auth) do
- conn
- |> put_session(:oauth_token, token.token)
- |> redirect(to: "/web/getting-started")
- else
- _e ->
- conn
- |> render(MastodonView, "login.html", %{error: "Wrong username or password"})
- end
- end
-
def logout(conn, _) do
conn
|> clear_session
diff --git a/lib/pleroma/web/nodeinfo/nodeinfo_controller.ex b/lib/pleroma/web/nodeinfo/nodeinfo_controller.ex
index 5446179cb..d58f08881 100644
--- a/lib/pleroma/web/nodeinfo/nodeinfo_controller.ex
+++ b/lib/pleroma/web/nodeinfo/nodeinfo_controller.ex
@@ -6,6 +6,8 @@ defmodule Pleroma.Web.Nodeinfo.NodeinfoController do
alias Pleroma.{User, Repo}
alias Pleroma.Web.ActivityPub.MRF
+ plug(Pleroma.Web.FederatingPlug)
+
def schemas(conn, _params) do
response = %{
links: [
diff --git a/lib/pleroma/web/oauth/oauth_controller.ex b/lib/pleroma/web/oauth/oauth_controller.ex
index 5441ee0a8..35c158fbb 100644
--- a/lib/pleroma/web/oauth/oauth_controller.ex
+++ b/lib/pleroma/web/oauth/oauth_controller.ex
@@ -33,25 +33,35 @@ defmodule Pleroma.Web.OAuth.OAuthController do
true <- Pbkdf2.checkpw(password, user.password_hash),
%App{} = app <- Repo.get_by(App, client_id: client_id),
{:ok, auth} <- Authorization.create_authorization(app, user) do
- if redirect_uri == "urn:ietf:wg:oauth:2.0:oob" do
- render(conn, "results.html", %{
- auth: auth
- })
- else
- connector = if String.contains?(redirect_uri, "?"), do: "&", else: "?"
- url = "#{redirect_uri}#{connector}"
- url_params = %{:code => auth.token}
-
- url_params =
- if params["state"] do
- Map.put(url_params, :state, params["state"])
- else
- url_params
- end
-
- url = "#{url}#{Plug.Conn.Query.encode(url_params)}"
-
- redirect(conn, external: url)
+ # Special case: Local MastodonFE.
+ redirect_uri =
+ if redirect_uri == "." do
+ mastodon_api_url(conn, :login)
+ else
+ redirect_uri
+ end
+
+ cond do
+ redirect_uri == "urn:ietf:wg:oauth:2.0:oob" ->
+ render(conn, "results.html", %{
+ auth: auth
+ })
+
+ true ->
+ connector = if String.contains?(redirect_uri, "?"), do: "&", else: "?"
+ url = "#{redirect_uri}#{connector}"
+ url_params = %{:code => auth.token}
+
+ url_params =
+ if params["state"] do
+ Map.put(url_params, :state, params["state"])
+ else
+ url_params
+ end
+
+ url = "#{url}#{Plug.Conn.Query.encode(url_params)}"
+
+ redirect(conn, external: url)
end
end
end
diff --git a/lib/pleroma/web/ostatus/ostatus_controller.ex b/lib/pleroma/web/ostatus/ostatus_controller.ex
index 09d1b1110..2f92935e7 100644
--- a/lib/pleroma/web/ostatus/ostatus_controller.ex
+++ b/lib/pleroma/web/ostatus/ostatus_controller.ex
@@ -10,6 +10,7 @@ defmodule Pleroma.Web.OStatus.OStatusController do
alias Pleroma.Web.ActivityPub.ActivityPubController
alias Pleroma.Web.ActivityPub.ActivityPub
+ plug(Pleroma.Web.FederatingPlug when action in [:salmon_incoming])
action_fallback(:errors)
def feed_redirect(conn, %{"nickname" => nickname}) do
diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
index 7b7affe5e..b461def82 100644
--- a/lib/pleroma/web/router.ex
+++ b/lib/pleroma/web/router.ex
@@ -3,11 +3,6 @@ defmodule Pleroma.Web.Router do
alias Pleroma.{Repo, User, Web.Router}
- @instance Application.get_env(:pleroma, :instance)
- @federating Keyword.get(@instance, :federating)
- @public Keyword.get(@instance, :public)
- @registrations_open Keyword.get(@instance, :registrations_open)
-
pipeline :api do
plug(:accepts, ["json"])
plug(:fetch_session)
@@ -242,11 +237,7 @@ defmodule Pleroma.Web.Router do
end
scope "/api", Pleroma.Web do
- if @public do
- pipe_through(:api)
- else
- pipe_through(:authenticated_api)
- end
+ pipe_through(:api)
get("/statuses/public_timeline", TwitterAPI.Controller, :public_timeline)
@@ -330,12 +321,10 @@ defmodule Pleroma.Web.Router do
get("/users/:nickname/feed", OStatus.OStatusController, :feed)
get("/users/:nickname", OStatus.OStatusController, :feed_redirect)
- if @federating do
- post("/users/:nickname/salmon", OStatus.OStatusController, :salmon_incoming)
- post("/push/hub/:nickname", Websub.WebsubController, :websub_subscription_request)
- get("/push/subscriptions/:id", Websub.WebsubController, :websub_subscription_confirmation)
- post("/push/subscriptions/:id", Websub.WebsubController, :websub_incoming)
- end
+ post("/users/:nickname/salmon", OStatus.OStatusController, :salmon_incoming)
+ post("/push/hub/:nickname", Websub.WebsubController, :websub_subscription_request)
+ get("/push/subscriptions/:id", Websub.WebsubController, :websub_subscription_confirmation)
+ post("/push/subscriptions/:id", Websub.WebsubController, :websub_incoming)
end
pipeline :activitypub do
@@ -352,29 +341,27 @@ defmodule Pleroma.Web.Router do
get("/users/:nickname/outbox", ActivityPubController, :outbox)
end
- if @federating do
- scope "/relay", Pleroma.Web.ActivityPub do
- pipe_through(:ap_relay)
- get("/", ActivityPubController, :relay)
- end
+ scope "/relay", Pleroma.Web.ActivityPub do
+ pipe_through(:ap_relay)
+ get("/", ActivityPubController, :relay)
+ end
- scope "/", Pleroma.Web.ActivityPub do
- pipe_through(:activitypub)
- post("/users/:nickname/inbox", ActivityPubController, :inbox)
- post("/inbox", ActivityPubController, :inbox)
- end
+ scope "/", Pleroma.Web.ActivityPub do
+ pipe_through(:activitypub)
+ post("/users/:nickname/inbox", ActivityPubController, :inbox)
+ post("/inbox", ActivityPubController, :inbox)
+ end
- scope "/.well-known", Pleroma.Web do
- pipe_through(:well_known)
+ scope "/.well-known", Pleroma.Web do
+ pipe_through(:well_known)
- get("/host-meta", WebFinger.WebFingerController, :host_meta)
- get("/webfinger", WebFinger.WebFingerController, :webfinger)
- get("/nodeinfo", Nodeinfo.NodeinfoController, :schemas)
- end
+ get("/host-meta", WebFinger.WebFingerController, :host_meta)
+ get("/webfinger", WebFinger.WebFingerController, :webfinger)
+ get("/nodeinfo", Nodeinfo.NodeinfoController, :schemas)
+ end
- scope "/nodeinfo", Pleroma.Web do
- get("/:version", Nodeinfo.NodeinfoController, :nodeinfo)
- end
+ scope "/nodeinfo", Pleroma.Web do
+ get("/:version", Nodeinfo.NodeinfoController, :nodeinfo)
end
scope "/", Pleroma.Web.MastodonAPI do
diff --git a/lib/pleroma/web/templates/mastodon_api/mastodon/login.html.eex b/lib/pleroma/web/templates/mastodon_api/mastodon/login.html.eex
deleted file mode 100644
index 34cd7ed89..000000000
--- a/lib/pleroma/web/templates/mastodon_api/mastodon/login.html.eex
+++ /dev/null
@@ -1,11 +0,0 @@
-<h2>Login to Mastodon Frontend</h2>
-<%= if @error do %>
- <h2><%= @error %></h2>
-<% end %>
-<%= form_for @conn, mastodon_api_path(@conn, :login), [as: "authorization"], fn f -> %>
-<%= text_input f, :name, placeholder: "Username or email" %>
-<br>
-<%= password_input f, :password, placeholder: "Password" %>
-<br>
-<%= submit "Log in" %>
-<% end %>
diff --git a/lib/pleroma/web/twitter_api/twitter_api_controller.ex b/lib/pleroma/web/twitter_api/twitter_api_controller.ex
index 7153a2bd6..83d725f13 100644
--- a/lib/pleroma/web/twitter_api/twitter_api_controller.ex
+++ b/lib/pleroma/web/twitter_api/twitter_api_controller.ex
@@ -11,6 +11,7 @@ defmodule Pleroma.Web.TwitterAPI.Controller do
require Logger
+ plug(:only_if_public_instance when action in [:public_timeline, :public_and_external_timeline])
action_fallback(:errors)
def verify_credentials(%{assigns: %{user: user}} = conn, _params) do
@@ -518,6 +519,18 @@ defmodule Pleroma.Web.TwitterAPI.Controller do
json_reply(conn, 403, json)
end
+ def only_if_public_instance(conn = %{conn: %{assigns: %{user: _user}}}, _), do: conn
+
+ def only_if_public_instance(conn, _) do
+ if Keyword.get(Application.get_env(:pleroma, :instance), :public) do
+ conn
+ else
+ conn
+ |> forbidden_json_reply("Invalid credentials.")
+ |> halt()
+ end
+ end
+
defp error_json(conn, error_message) do
%{"error" => error_message, "request" => conn.request_path} |> Jason.encode!()
end
diff --git a/lib/pleroma/web/web_finger/web_finger_controller.ex b/lib/pleroma/web/web_finger/web_finger_controller.ex
index 50d816256..002353166 100644
--- a/lib/pleroma/web/web_finger/web_finger_controller.ex
+++ b/lib/pleroma/web/web_finger/web_finger_controller.ex
@@ -3,6 +3,8 @@ defmodule Pleroma.Web.WebFinger.WebFingerController do
alias Pleroma.Web.WebFinger
+ plug(Pleroma.Web.FederatingPlug)
+
def host_meta(conn, _params) do
xml = WebFinger.host_meta()
diff --git a/lib/pleroma/web/websub/websub_controller.ex b/lib/pleroma/web/websub/websub_controller.ex
index 590dd74a1..c1934ba92 100644
--- a/lib/pleroma/web/websub/websub_controller.ex
+++ b/lib/pleroma/web/websub/websub_controller.ex
@@ -5,6 +5,15 @@ defmodule Pleroma.Web.Websub.WebsubController do
alias Pleroma.Web.Websub.WebsubClientSubscription
require Logger
+ plug(
+ Pleroma.Web.FederatingPlug
+ when action in [
+ :websub_subscription_request,
+ :websub_subscription_confirmation,
+ :websub_incoming
+ ]
+ )
+
def websub_subscription_request(conn, %{"nickname" => nickname} = params) do
user = User.get_cached_by_nickname(nickname)
diff --git a/test/web/node_info_test.exs b/test/web/node_info_test.exs
index d48f40e47..a6376453c 100644
--- a/test/web/node_info_test.exs
+++ b/test/web/node_info_test.exs
@@ -14,4 +14,36 @@ defmodule Pleroma.Web.NodeInfoTest do
assert user.ap_id in result["metadata"]["staffAccounts"]
end
+
+ test "returns 404 when federation is disabled" do
+ instance =
+ Application.get_env(:pleroma, :instance)
+ |> Keyword.put(:federating, false)
+
+ Application.put_env(:pleroma, :instance, instance)
+
+ conn
+ |> get("/.well-known/nodeinfo")
+ |> json_response(404)
+
+ conn
+ |> get("/nodeinfo/2.0.json")
+ |> json_response(404)
+
+ instance =
+ Application.get_env(:pleroma, :instance)
+ |> Keyword.put(:federating, true)
+
+ Application.put_env(:pleroma, :instance, instance)
+ end
+
+ test "returns 200 when federation is enabled" do
+ conn
+ |> get("/.well-known/nodeinfo")
+ |> json_response(200)
+
+ conn
+ |> get("/nodeinfo/2.0.json")
+ |> json_response(200)
+ end
end
diff --git a/test/web/plugs/federating_plug_test.exs b/test/web/plugs/federating_plug_test.exs
new file mode 100644
index 000000000..1455a1c46
--- /dev/null
+++ b/test/web/plugs/federating_plug_test.exs
@@ -0,0 +1,33 @@
+defmodule Pleroma.Web.FederatingPlugTest do
+ use Pleroma.Web.ConnCase
+
+ test "returns and halt the conn when federating is disabled" do
+ instance =
+ Application.get_env(:pleroma, :instance)
+ |> Keyword.put(:federating, false)
+
+ Application.put_env(:pleroma, :instance, instance)
+
+ conn =
+ build_conn()
+ |> Pleroma.Web.FederatingPlug.call(%{})
+
+ assert conn.status == 404
+ assert conn.halted
+
+ instance =
+ Application.get_env(:pleroma, :instance)
+ |> Keyword.put(:federating, true)
+
+ Application.put_env(:pleroma, :instance, instance)
+ end
+
+ test "does nothing when federating is enabled" do
+ conn =
+ build_conn()
+ |> Pleroma.Web.FederatingPlug.call(%{})
+
+ refute conn.status
+ refute conn.halted
+ end
+end
diff --git a/test/web/twitter_api/twitter_api_controller_test.exs b/test/web/twitter_api/twitter_api_controller_test.exs
index 87bcdaf71..b64f416e3 100644
--- a/test/web/twitter_api/twitter_api_controller_test.exs
+++ b/test/web/twitter_api/twitter_api_controller_test.exs
@@ -100,6 +100,56 @@ defmodule Pleroma.Web.TwitterAPI.ControllerTest do
assert length(response) == 10
end
+
+ test "returns 403 to unauthenticated request when the instance is not public" do
+ instance =
+ Application.get_env(:pleroma, :instance)
+ |> Keyword.put(:public, false)
+
+ Application.put_env(:pleroma, :instance, instance)
+
+ conn
+ |> get("/api/statuses/public_timeline.json")
+ |> json_response(403)
+
+ instance =
+ Application.get_env(:pleroma, :instance)
+ |> Keyword.put(:public, true)
+
+ Application.put_env(:pleroma, :instance, instance)
+ end
+
+ test "returns 200 to unauthenticated request when the instance is public" do
+ conn
+ |> get("/api/statuses/public_timeline.json")
+ |> json_response(200)
+ end
+ end
+
+ describe "GET /statuses/public_and_external_timeline.json" do
+ test "returns 403 to unauthenticated request when the instance is not public" do
+ instance =
+ Application.get_env(:pleroma, :instance)
+ |> Keyword.put(:public, false)
+
+ Application.put_env(:pleroma, :instance, instance)
+
+ conn
+ |> get("/api/statuses/public_and_external_timeline.json")
+ |> json_response(403)
+
+ instance =
+ Application.get_env(:pleroma, :instance)
+ |> Keyword.put(:public, true)
+
+ Application.put_env(:pleroma, :instance, instance)
+ end
+
+ test "returns 200 to unauthenticated request when the instance is public" do
+ conn
+ |> get("/api/statuses/public_and_external_timeline.json")
+ |> json_response(200)
+ end
end
describe "GET /statuses/show/:id.json" do
generated by cgit v1.2.3 (git 2.26.2) at 2025-05-01 10:55:01 +0000