4 files changed, 107 insertions, 32 deletions
diff --git a/lib/pleroma/web/plugs/cache.ex b/lib/pleroma/web/plugs/cache.ex
index e2cf5759d..667477857 100644
--- a/lib/pleroma/web/plugs/cache.ex
+++ b/lib/pleroma/web/plugs/cache.ex
@@ -97,13 +97,21 @@ defmodule Pleroma.Web.Plugs.Cache do
         key = cache_key(conn, opts)
         content_type = content_type(conn)
 
+        should_cache = not Map.get(conn.assigns, :skip_cache, false)
+
         conn =
           unless opts[:tracking_fun] do
-            @cachex.put(:web_resp_cache, key, {content_type, body}, ttl: ttl)
+            if should_cache do
+              @cachex.put(:web_resp_cache, key, {content_type, body}, ttl: ttl)
+            end
+
             conn
           else
             tracking_fun_data = Map.get(conn.assigns, :tracking_fun_data, nil)
-            @cachex.put(:web_resp_cache, key, {content_type, body, tracking_fun_data}, ttl: ttl)
+
+            if should_cache do
+              @cachex.put(:web_resp_cache, key, {content_type, body, tracking_fun_data}, ttl: ttl)
+            end
 
             opts.tracking_fun.(conn, tracking_fun_data)
           end
diff --git a/lib/pleroma/web/plugs/http_signature_plug.ex b/lib/pleroma/web/plugs/http_signature_plug.ex
index d023754a6..4bf325218 100644
--- a/lib/pleroma/web/plugs/http_signature_plug.ex
+++ b/lib/pleroma/web/plugs/http_signature_plug.ex
@@ -25,21 +25,58 @@ defmodule Pleroma.Web.Plugs.HTTPSignaturePlug do
     end
   end
 
+  defp validate_signature(conn, request_target) do
+    # Newer drafts for HTTP signatures now use @request-target instead of the
+    # old (request-target). We'll now support both for incoming signatures.
+    conn =
+      conn
+      |> put_req_header("(request-target)", request_target)
+      |> put_req_header("@request-target", request_target)
+
+    HTTPSignatures.validate_conn(conn)
+  end
+
+  defp validate_signature(conn) do
+    # This (request-target) is non-standard, but many implementations do it
+    # this way due to a misinterpretation of
+    # https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures-06
+    # "path" was interpreted as not having the query, though later examples
+    # show that it must be the absolute path + query. This behavior is kept to
+    # make sure most software (Pleroma itself, Mastodon, and probably others)
+    # do not break.
+    request_target = String.downcase("#{conn.method}") <> " #{conn.request_path}"
+
+    # This is the proper way to build the @request-target, as expected by
+    # many HTTP signature libraries, clarified in the following draft:
+    # https://www.ietf.org/archive/id/draft-ietf-httpbis-message-signatures-11.html#section-2.2.6
+    # It is the same as before, but containing the query part as well.
+    proper_target = request_target <> "?#{conn.query_string}"
+
+    cond do
+      # Normal, non-standard behavior but expected by Pleroma and more.
+      validate_signature(conn, request_target) ->
+        true
+
+      # Has query string and the previous one failed: let's try the standard.
+      conn.query_string != "" ->
+        validate_signature(conn, proper_target)
+
+      # If there's no query string and signature fails, it's rotten.
+      true ->
+        false
+    end
+  end
+
   defp maybe_assign_valid_signature(conn) do
     if has_signature_header?(conn) do
-      # set (request-target) header to the appropriate value
-      # we also replace the digest header with the one we computed
-      request_target = String.downcase("#{conn.method}") <> " #{conn.request_path}"
-
+      # we replace the digest header with the one we computed in DigestPlug
       conn =
-        conn
-        |> put_req_header("(request-target)", request_target)
-        |> case do
+        case conn do
           %{assigns: %{digest: digest}} = conn -> put_req_header(conn, "digest", digest)
           conn -> conn
         end
 
-      assign(conn, :valid_signature, HTTPSignatures.validate_conn(conn))
+      assign(conn, :valid_signature, validate_signature(conn))
     else
       Logger.debug("No signature header!")
       conn
diff --git a/lib/pleroma/web/plugs/o_auth_plug.ex b/lib/pleroma/web/plugs/o_auth_plug.ex
index 0f74d626b..ba04ddb72 100644
--- a/lib/pleroma/web/plugs/o_auth_plug.ex
+++ b/lib/pleroma/web/plugs/o_auth_plug.ex
@@ -47,15 +47,17 @@ defmodule Pleroma.Web.Plugs.OAuthPlug do
   #
   @spec fetch_user_and_token(String.t()) :: {:ok, User.t(), Token.t()} | nil
   defp fetch_user_and_token(token) do
-    query =
+    token_query =
       from(t in Token,
-        where: t.token == ^token,
-        join: user in assoc(t, :user),
-        preload: [user: user]
+        where: t.token == ^token
       )
 
-    with %Token{user: user} = token_record <- Repo.one(query) do
+    with %Token{user_id: user_id} = token_record <- Repo.one(token_query),
+         false <- is_nil(user_id),
+         %User{} = user <- User.get_cached_by_id(user_id) do
       {:ok, user, token_record}
+    else
+      _ -> nil
     end
   end
 
diff --git a/lib/pleroma/web/plugs/set_locale_plug.ex b/lib/pleroma/web/plugs/set_locale_plug.ex
index 850a9b3bc..271912ace 100644
--- a/lib/pleroma/web/plugs/set_locale_plug.ex
+++ b/lib/pleroma/web/plugs/set_locale_plug.ex
@@ -6,18 +6,56 @@
 defmodule Pleroma.Web.Plugs.SetLocalePlug do
   import Plug.Conn, only: [get_req_header: 2, assign: 3]
 
+  def frontend_language_cookie_name, do: "userLanguage"
+
   def init(_), do: nil
 
   def call(conn, _) do
-    locale = get_locale_from_header(conn) || Gettext.get_locale()
-    Gettext.put_locale(locale)
-    assign(conn, :locale, locale)
+    locales = get_locales_from_header(conn)
+    first_locale = Enum.at(locales, 0, Gettext.get_locale())
+
+    Pleroma.Web.Gettext.put_locales(locales)
+
+    conn
+    |> assign(:locale, first_locale)
+    |> assign(:locales, locales)
   end
 
-  defp get_locale_from_header(conn) do
+  defp get_locales_from_header(conn) do
     conn
-    |> extract_accept_language()
-    |> Enum.find(&supported_locale?/1)
+    |> extract_preferred_language()
+    |> normalize_language_codes()
+    |> all_supported()
+    |> Enum.uniq()
+  end
+
+  defp all_supported(locales) do
+    locales
+    |> Pleroma.Web.Gettext.ensure_fallbacks()
+    |> Enum.filter(&supported_locale?/1)
+  end
+
+  defp normalize_language_codes(codes) do
+    codes
+    |> Enum.map(fn code -> Pleroma.Web.Gettext.normalize_locale(code) end)
+  end
+
+  defp extract_preferred_language(conn) do
+    extract_frontend_language(conn) ++ extract_accept_language(conn)
+  end
+
+  defp extract_frontend_language(conn) do
+    %{req_cookies: cookies} =
+      conn
+      |> Plug.Conn.fetch_cookies()
+
+    case cookies[frontend_language_cookie_name()] do
+      nil ->
+        []
+
+      fe_lang ->
+        String.split(fe_lang, ",")
+    end
   end
 
   defp extract_accept_language(conn) do
@@ -29,7 +67,6 @@ defmodule Pleroma.Web.Plugs.SetLocalePlug do
         |> Enum.sort(&(&1.quality > &2.quality))
         |> Enum.map(& &1.tag)
         |> Enum.reject(&is_nil/1)
-        |> ensure_language_fallbacks()
 
       _ ->
         []
@@ -37,9 +74,7 @@ defmodule Pleroma.Web.Plugs.SetLocalePlug do
   end
 
   defp supported_locale?(locale) do
-    Pleroma.Web.Gettext
-    |> Gettext.known_locales()
-    |> Enum.member?(locale)
+    Pleroma.Web.Gettext.supports_locale?(locale)
   end
 
   defp parse_language_option(string) do
@@ -53,11 +88,4 @@ defmodule Pleroma.Web.Plugs.SetLocalePlug do
 
     %{tag: captures["tag"], quality: quality}
   end
-
-  defp ensure_language_fallbacks(tags) do
-    Enum.flat_map(tags, fn tag ->
-      [language | _] = String.split(tag, "-")
-      if Enum.member?(tags, language), do: [tag], else: [tag, language]
-    end)
-  end
 end