aboutsummaryrefslogtreecommitdiff
path: root/lib/pleroma
diff options
context:
space:
mode:
Diffstat (limited to 'lib/pleroma')
-rw-r--r--lib/pleroma/activity/queries.ex5
-rw-r--r--lib/pleroma/notification.ex17
-rw-r--r--lib/pleroma/plugs/http_security_plug.ex82
-rw-r--r--lib/pleroma/user.ex8
-rw-r--r--lib/pleroma/user/query.ex24
-rw-r--r--lib/pleroma/web/activity_pub/activity_pub.ex2
-rw-r--r--lib/pleroma/web/activity_pub/activity_pub_controller.ex49
-rw-r--r--lib/pleroma/web/activity_pub/views/user_view.ex34
-rw-r--r--lib/pleroma/web/controller_helper.ex63
-rw-r--r--lib/pleroma/web/mastodon_api/controllers/timeline_controller.ex4
-rw-r--r--lib/pleroma/web/router.ex15
-rw-r--r--lib/pleroma/web/streamer/worker.ex2
12 files changed, 169 insertions, 136 deletions
diff --git a/lib/pleroma/activity/queries.ex b/lib/pleroma/activity/queries.ex
index 04593b9fb..633eca0b3 100644
--- a/lib/pleroma/activity/queries.ex
+++ b/lib/pleroma/activity/queries.ex
@@ -24,10 +24,7 @@ defmodule Pleroma.Activity.Queries do
@spec by_actor(query, String.t()) :: query
def by_actor(query \\ Activity, actor) do
- from(
- activity in query,
- where: fragment("(?)->>'actor' = ?", activity.data, ^actor)
- )
+ from(a in query, where: a.actor == ^actor)
end
@spec by_author(query, User.t()) :: query
diff --git a/lib/pleroma/notification.ex b/lib/pleroma/notification.ex
index 556075fba..8c6887a6b 100644
--- a/lib/pleroma/notification.ex
+++ b/lib/pleroma/notification.ex
@@ -70,8 +70,9 @@ defmodule Pleroma.Notification do
|> join(:left, [n, a], object in Object,
on:
fragment(
- "(?->>'id') = COALESCE((? -> 'object'::text) ->> 'id'::text)",
+ "(?->>'id') = COALESCE(?->'object'->>'id', ?->>'object')",
object.data,
+ a.data,
a.data
)
)
@@ -195,7 +196,7 @@ defmodule Pleroma.Notification do
|> Repo.all()
end
- def set_read_up_to(%{id: user_id} = _user, id) do
+ def set_read_up_to(%{id: user_id} = user, id) do
query =
from(
n in Notification,
@@ -215,18 +216,8 @@ defmodule Pleroma.Notification do
{_, notification_ids} = Repo.update_all(query, [])
- Notification
+ for_user_query(user)
|> where([n], n.id in ^notification_ids)
- |> join(:inner, [n], activity in assoc(n, :activity))
- |> join(:left, [n, a], object in Object,
- on:
- fragment(
- "(?->>'id') = COALESCE((? -> 'object'::text) ->> 'id'::text)",
- object.data,
- a.data
- )
- )
- |> preload([n, a, o], activity: {a, object: o})
|> Repo.all()
end
diff --git a/lib/pleroma/plugs/http_security_plug.ex b/lib/pleroma/plugs/http_security_plug.ex
index 6462797b6..2208d1d6c 100644
--- a/lib/pleroma/plugs/http_security_plug.ex
+++ b/lib/pleroma/plugs/http_security_plug.ex
@@ -31,7 +31,7 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
{"x-content-type-options", "nosniff"},
{"referrer-policy", referrer_policy},
{"x-download-options", "noopen"},
- {"content-security-policy", csp_string() <> ";"}
+ {"content-security-policy", csp_string()}
]
if report_uri do
@@ -43,23 +43,46 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
]
}
- headers ++ [{"reply-to", Jason.encode!(report_group)}]
+ [{"reply-to", Jason.encode!(report_group)} | headers]
else
headers
end
end
+ static_csp_rules = [
+ "default-src 'none'",
+ "base-uri 'self'",
+ "frame-ancestors 'none'",
+ "style-src 'self' 'unsafe-inline'",
+ "font-src 'self'",
+ "manifest-src 'self'"
+ ]
+
+ @csp_start [Enum.join(static_csp_rules, ";") <> ";"]
+
defp csp_string do
scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme]
static_url = Pleroma.Web.Endpoint.static_url()
websocket_url = Pleroma.Web.Endpoint.websocket_url()
report_uri = Config.get([:http_security, :report_uri])
- connect_src = "connect-src 'self' #{static_url} #{websocket_url}"
+ img_src = "img-src 'self' data: blob:"
+ media_src = "media-src 'self'"
+
+ {img_src, media_src} =
+ if Config.get([:media_proxy, :enabled]) &&
+ !Config.get([:media_proxy, :proxy_opts, :redirect_on_failure]) do
+ sources = get_proxy_and_attachment_sources()
+ {[img_src, sources], [media_src, sources]}
+ else
+ {img_src, media_src}
+ end
+
+ connect_src = ["connect-src 'self' ", static_url, ?\s, websocket_url]
connect_src =
if Pleroma.Config.get(:env) == :dev do
- connect_src <> " http://localhost:3035/"
+ [connect_src, " http://localhost:3035/"]
else
connect_src
end
@@ -71,27 +94,46 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
"script-src 'self'"
end
- main_part = [
- "default-src 'none'",
- "base-uri 'self'",
- "frame-ancestors 'none'",
- "img-src 'self' data: blob: https:",
- "media-src 'self' https:",
- "style-src 'self' 'unsafe-inline'",
- "font-src 'self'",
- "manifest-src 'self'",
- connect_src,
- script_src
- ]
+ report = if report_uri, do: ["report-uri ", report_uri, ";report-to csp-endpoint"]
+ insecure = if scheme == "https", do: "upgrade-insecure-requests"
+
+ @csp_start
+ |> add_csp_param(img_src)
+ |> add_csp_param(media_src)
+ |> add_csp_param(connect_src)
+ |> add_csp_param(script_src)
+ |> add_csp_param(insecure)
+ |> add_csp_param(report)
+ |> :erlang.iolist_to_binary()
+ end
+
+ defp get_proxy_and_attachment_sources do
+ media_proxy_whitelist =
+ Enum.reduce(Config.get([:media_proxy, :whitelist]), [], fn host, acc ->
+ add_source(acc, host)
+ end)
- report = if report_uri, do: ["report-uri #{report_uri}; report-to csp-endpoint"], else: []
+ upload_base_url =
+ if Config.get([Pleroma.Upload, :base_url]),
+ do: URI.parse(Config.get([Pleroma.Upload, :base_url])).host
- insecure = if scheme == "https", do: ["upgrade-insecure-requests"], else: []
+ s3_endpoint =
+ if Config.get([Pleroma.Upload, :uploader]) == Pleroma.Uploaders.S3,
+ do: URI.parse(Config.get([Pleroma.Uploaders.S3, :public_endpoint])).host
- (main_part ++ report ++ insecure)
- |> Enum.join("; ")
+ []
+ |> add_source(upload_base_url)
+ |> add_source(s3_endpoint)
+ |> add_source(media_proxy_whitelist)
end
+ defp add_source(iodata, nil), do: iodata
+ defp add_source(iodata, source), do: [[?\s, source] | iodata]
+
+ defp add_csp_param(csp_iodata, nil), do: csp_iodata
+
+ defp add_csp_param(csp_iodata, param), do: [[param, ?;] | csp_iodata]
+
def warn_if_disabled do
unless Config.get([:http_security, :enabled]) do
Logger.warn("
diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index 3e8f19e30..fbfdc68e8 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -1199,8 +1199,12 @@ defmodule Pleroma.User do
end
@spec get_recipients_from_activity(Activity.t()) :: [User.t()]
- def get_recipients_from_activity(%Activity{recipients: to}) do
- User.Query.build(%{recipients_from_activity: to, local: true, deactivated: false})
+ def get_recipients_from_activity(%Activity{recipients: to, actor: actor}) do
+ to = [actor | to]
+
+ query = User.Query.build(%{recipients_from_activity: to, local: true, deactivated: false})
+
+ query
|> Repo.all()
end
diff --git a/lib/pleroma/user/query.ex b/lib/pleroma/user/query.ex
index ec88088cf..a387f9b77 100644
--- a/lib/pleroma/user/query.ex
+++ b/lib/pleroma/user/query.ex
@@ -162,20 +162,18 @@ defmodule Pleroma.User.Query do
end
defp compose_query({:recipients_from_activity, to}, query) do
- query
- |> join(:left, [u], r in FollowingRelationship,
- as: :relationships,
- on: r.follower_id == u.id
- )
- |> join(:left, [relationships: r], f in User,
- as: :following,
- on: f.id == r.following_id
- )
- |> where(
- [u, following: f, relationships: r],
- u.ap_id in ^to or (f.follower_address in ^to and r.state == ^:follow_accept)
+ following_query =
+ from(u in User,
+ join: f in FollowingRelationship,
+ on: u.id == f.following_id,
+ where: f.state == ^:follow_accept,
+ where: u.follower_address in ^to,
+ select: f.follower_id
+ )
+
+ from(u in query,
+ where: u.ap_id in ^to or u.id in subquery(following_query)
)
- |> distinct(true)
end
defp compose_query({:order_by, key}, query) do
diff --git a/lib/pleroma/web/activity_pub/activity_pub.ex b/lib/pleroma/web/activity_pub/activity_pub.ex
index c4f83f9e1..5ce91a8d3 100644
--- a/lib/pleroma/web/activity_pub/activity_pub.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub.ex
@@ -1318,7 +1318,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
|> Activity.with_joined_object()
|> Object.with_joined_activity()
|> select([_like, object, activity], %{activity | object: object})
- |> order_by([like, _, _], desc: like.id)
+ |> order_by([like, _, _], desc_nulls_last: like.id)
|> Pagination.fetch_paginated(
Map.merge(params, %{"skip_order" => true}),
pagination,
diff --git a/lib/pleroma/web/activity_pub/activity_pub_controller.ex b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
index 2bb5bd15b..a64199cd6 100644
--- a/lib/pleroma/web/activity_pub/activity_pub_controller.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
@@ -18,6 +18,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
alias Pleroma.Web.ActivityPub.UserView
alias Pleroma.Web.ActivityPub.Utils
alias Pleroma.Web.ActivityPub.Visibility
+ alias Pleroma.Web.ControllerHelper
alias Pleroma.Web.Federator
require Logger
@@ -200,31 +201,29 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
end
end
- def outbox(conn, %{"nickname" => nickname, "page" => page?} = params)
+ def outbox(
+ %{assigns: %{user: for_user}} = conn,
+ %{"nickname" => nickname, "page" => page?} = params
+ )
when page? in [true, "true"] do
with %User{} = user <- User.get_cached_by_nickname(nickname),
{:ok, user} <- User.ensure_keys_present(user) do
- activities =
- if params["max_id"] do
- ActivityPub.fetch_user_activities(user, nil, %{
- "max_id" => params["max_id"],
- # This is a hack because postgres generates inefficient queries when filtering by
- # 'Answer', poll votes will be hidden by the visibility filter in this case anyway
- "include_poll_votes" => true,
- "limit" => 10
- })
- else
- ActivityPub.fetch_user_activities(user, nil, %{
- "limit" => 10,
- "include_poll_votes" => true
- })
- end
+ # "include_poll_votes" is a hack because postgres generates inefficient
+ # queries when filtering by 'Answer', poll votes will be hidden by the
+ # visibility filter in this case anyway
+ params =
+ params
+ |> Map.drop(["nickname", "page"])
+ |> Map.put("include_poll_votes", true)
+
+ activities = ActivityPub.fetch_user_activities(user, for_user, params)
conn
|> put_resp_content_type("application/activity+json")
|> put_view(UserView)
|> render("activity_collection_page.json", %{
activities: activities,
+ pagination: ControllerHelper.get_pagination_fields(conn, activities),
iri: "#{user.ap_id}/outbox"
})
end
@@ -318,21 +317,23 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
%{"nickname" => nickname, "page" => page?} = params
)
when page? in [true, "true"] do
+ params =
+ params
+ |> Map.drop(["nickname", "page"])
+ |> Map.put("blocking_user", user)
+ |> Map.put("user", user)
+
activities =
- if params["max_id"] do
- ActivityPub.fetch_activities([user.ap_id | User.following(user)], %{
- "max_id" => params["max_id"],
- "limit" => 10
- })
- else
- ActivityPub.fetch_activities([user.ap_id | User.following(user)], %{"limit" => 10})
- end
+ [user.ap_id | User.following(user)]
+ |> ActivityPub.fetch_activities(params)
+ |> Enum.reverse()
conn
|> put_resp_content_type("application/activity+json")
|> put_view(UserView)
|> render("activity_collection_page.json", %{
activities: activities,
+ pagination: ControllerHelper.get_pagination_fields(conn, activities),
iri: "#{user.ap_id}/inbox"
})
end
diff --git a/lib/pleroma/web/activity_pub/views/user_view.ex b/lib/pleroma/web/activity_pub/views/user_view.ex
index bc21ac6c7..3396777d7 100644
--- a/lib/pleroma/web/activity_pub/views/user_view.ex
+++ b/lib/pleroma/web/activity_pub/views/user_view.ex
@@ -216,34 +216,24 @@ defmodule Pleroma.Web.ActivityPub.UserView do
|> Map.merge(Utils.make_json_ld_header())
end
- def render("activity_collection_page.json", %{activities: activities, iri: iri}) do
- # this is sorted chronologically, so first activity is the newest (max)
- {max_id, min_id, collection} =
- if length(activities) > 0 do
- {
- Enum.at(activities, 0).id,
- Enum.at(Enum.reverse(activities), 0).id,
- Enum.map(activities, fn act ->
- {:ok, data} = Transmogrifier.prepare_outgoing(act.data)
- data
- end)
- }
- else
- {
- 0,
- 0,
- []
- }
- end
+ def render("activity_collection_page.json", %{
+ activities: activities,
+ iri: iri,
+ pagination: pagination
+ }) do
+ collection =
+ Enum.map(activities, fn activity ->
+ {:ok, data} = Transmogrifier.prepare_outgoing(activity.data)
+ data
+ end)
%{
- "id" => "#{iri}?max_id=#{max_id}&page=true",
"type" => "OrderedCollectionPage",
"partOf" => iri,
- "orderedItems" => collection,
- "next" => "#{iri}?max_id=#{min_id}&page=true"
+ "orderedItems" => collection
}
|> Map.merge(Utils.make_json_ld_header())
+ |> Map.merge(pagination)
end
defp maybe_put_total_items(map, false, _total), do: map
diff --git a/lib/pleroma/web/controller_helper.ex b/lib/pleroma/web/controller_helper.ex
index c9a3a2585..1e0491a96 100644
--- a/lib/pleroma/web/controller_helper.ex
+++ b/lib/pleroma/web/controller_helper.ex
@@ -5,7 +5,9 @@
defmodule Pleroma.Web.ControllerHelper do
use Pleroma.Web, :controller
- # As in MastoAPI, per https://api.rubyonrails.org/classes/ActiveModel/Type/Boolean.html
+ alias Pleroma.Pagination
+
+ # As in Mastodon API, per https://api.rubyonrails.org/classes/ActiveModel/Type/Boolean.html
@falsy_param_values [false, 0, "0", "f", "F", "false", "False", "FALSE", "off", "OFF"]
def truthy_param?(blank_value) when blank_value in [nil, ""], do: nil
def truthy_param?(value), do: value not in @falsy_param_values
@@ -34,38 +36,53 @@ defmodule Pleroma.Web.ControllerHelper do
defp param_to_integer(_, default), do: default
- def add_link_headers(conn, activities, extra_params \\ %{}) do
+ def add_link_headers(conn, activities, extra_params \\ %{})
+
+ def add_link_headers(%{assigns: %{skip_link_headers: true}} = conn, _activities, _extra_params),
+ do: conn
+
+ def add_link_headers(conn, activities, extra_params) do
+ case get_pagination_fields(conn, activities, extra_params) do
+ %{"next" => next_url, "prev" => prev_url} ->
+ put_resp_header(conn, "link", "<#{next_url}>; rel=\"next\", <#{prev_url}>; rel=\"prev\"")
+
+ _ ->
+ conn
+ end
+ end
+
+ def get_pagination_fields(conn, activities, extra_params \\ %{}) do
case List.last(activities) do
%{id: max_id} ->
params =
conn.params
|> Map.drop(Map.keys(conn.path_params))
- |> Map.drop(["since_id", "max_id", "min_id"])
|> Map.merge(extra_params)
-
- limit =
- params
- |> Map.get("limit", "20")
- |> String.to_integer()
+ |> Map.drop(Pagination.page_keys() -- ["limit", "order"])
min_id =
- if length(activities) <= limit do
- activities
- |> List.first()
- |> Map.get(:id)
- else
- activities
- |> Enum.at(limit * -1)
- |> Map.get(:id)
- end
-
- next_url = current_url(conn, Map.merge(params, %{max_id: max_id}))
- prev_url = current_url(conn, Map.merge(params, %{min_id: min_id}))
-
- put_resp_header(conn, "link", "<#{next_url}>; rel=\"next\", <#{prev_url}>; rel=\"prev\"")
+ activities
+ |> List.first()
+ |> Map.get(:id)
+
+ fields = %{
+ "next" => current_url(conn, Map.put(params, :max_id, max_id)),
+ "prev" => current_url(conn, Map.put(params, :min_id, min_id))
+ }
+
+ # Generating an `id` without already present pagination keys would
+ # need a query-restriction with an `q.id >= ^id` or `q.id <= ^id`
+ # instead of the `q.id > ^min_id` and `q.id < ^max_id`.
+ # This is because we only have ids present inside of the page, while
+ # `min_id`, `since_id` and `max_id` requires to know one outside of it.
+ if Map.take(conn.params, Pagination.page_keys() -- ["limit", "order"]) != [] do
+ Map.put(fields, "id", current_url(conn, conn.params))
+ else
+ fields
+ end
_ ->
- conn
+ %{}
end
end
diff --git a/lib/pleroma/web/mastodon_api/controllers/timeline_controller.ex b/lib/pleroma/web/mastodon_api/controllers/timeline_controller.ex
index 09e08271b..c3cebd71e 100644
--- a/lib/pleroma/web/mastodon_api/controllers/timeline_controller.ex
+++ b/lib/pleroma/web/mastodon_api/controllers/timeline_controller.ex
@@ -40,10 +40,8 @@ defmodule Pleroma.Web.MastodonAPI.TimelineController do
|> Map.put("muting_user", user)
|> Map.put("user", user)
- recipients = [user.ap_id | User.following(user)]
-
activities =
- recipients
+ [user.ap_id | User.following(user)]
|> ActivityPub.fetch_activities(params)
|> Enum.reverse()
diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
index 1da9478db..cb4cc619a 100644
--- a/lib/pleroma/web/router.ex
+++ b/lib/pleroma/web/router.ex
@@ -545,19 +545,13 @@ defmodule Pleroma.Web.Router do
get("/mailer/unsubscribe/:token", Mailer.SubscriptionController, :unsubscribe)
end
+ # Server to Server (S2S) AP interactions
pipeline :activitypub do
- plug(:accepts, ["activity+json", "json"])
- plug(Pleroma.Web.Plugs.HTTPSignaturePlug)
- plug(Pleroma.Web.Plugs.MappedSignatureToIdentityPlug)
- end
-
- scope "/", Pleroma.Web.ActivityPub do
- # XXX: not really ostatus
- pipe_through(:ostatus)
-
- get("/users/:nickname/outbox", ActivityPubController, :outbox)
+ plug(:ap_service_actor)
+ plug(:http_signature)
end
+ # Client to Server (C2S) AP interactions
pipeline :activitypub_client do
plug(:accepts, ["activity+json", "json"])
plug(:fetch_session)
@@ -578,6 +572,7 @@ defmodule Pleroma.Web.Router do
get("/api/ap/whoami", ActivityPubController, :whoami)
get("/users/:nickname/inbox", ActivityPubController, :read_inbox)
+ get("/users/:nickname/outbox", ActivityPubController, :outbox)
post("/users/:nickname/outbox", ActivityPubController, :update_outbox)
post("/api/ap/upload_media", ActivityPubController, :upload_media)
diff --git a/lib/pleroma/web/streamer/worker.ex b/lib/pleroma/web/streamer/worker.ex
index abfed21c8..c669e917d 100644
--- a/lib/pleroma/web/streamer/worker.ex
+++ b/lib/pleroma/web/streamer/worker.ex
@@ -147,7 +147,7 @@ defmodule Pleroma.Web.Streamer.Worker do
false <- Pleroma.Web.ActivityPub.MRF.subdomain_match?(domain_blocks, item_host),
false <- Pleroma.Web.ActivityPub.MRF.subdomain_match?(domain_blocks, parent_host),
true <- thread_containment(item, user),
- false <- CommonAPI.thread_muted?(user, item) do
+ false <- CommonAPI.thread_muted?(user, parent) do
true
else
_ -> false
generated by cgit v1.2.3 (git 2.26.2) at 2025-04-22 02:52:30 +0000