merge

CHANGELOG.md

@@ -4,6 +4,8 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## [unreleased]
+### Security
+- Mastodon API: Fix display names not being sanitized
 ### Added
 - Add a generic settings store for frontends / clients to use.
 - Explicit addressing option for posting.

config/config.exs

@@ -442,6 +442,8 @@
   opts: [
     scheme: true,
     extra: true,
+    # TODO: Set to :no_scheme when it works properly
+    validate_tld: true,
     class: false,
     strip_prefix: false,
     new_window: false,

lib/mix/tasks/pleroma/ecto/ecto.ex

@@ -0,0 +1,40 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-onl
+defmodule Mix.Tasks.Pleroma.Ecto do
+  @doc """
+  Ensures the given repository's migrations path exists on the file system.
+  """
+  @spec ensure_migrations_path(Ecto.Repo.t(), Keyword.t()) :: String.t()
+  def ensure_migrations_path(repo, opts) do
+    path = opts[:migrations_path] || Path.join(source_repo_priv(repo), "migrations")
+
+    if not File.dir?(path) do
+      raise_missing_migrations(Path.relative_to_cwd(path), repo)
+    end
+
+    path
+  end
+
+  @doc """
+  Returns the private repository path relative to the source.
+  """
+  def source_repo_priv(repo) do
+    config = repo.config()
+    priv = config[:priv] || "priv/#{repo |> Module.split() |> List.last() |> Macro.underscore()}"
+    Path.join(File.cwd!(), priv)
+  end
+
+  defp raise_missing_migrations(path, repo) do
+    raise("""
+    Could not find migrations directory #{inspect(path)}
+    for repo #{inspect(repo)}.
+    This may be because you are in a new project and the
+    migration directory has not been created yet. Creating an
+    empty directory at the path above will fix this error.
+    If you expected existing migrations to be found, please
+    make sure your repository has been properly configured
+    and the configured path exists.
+    """)
+  end
+end

lib/mix/tasks/pleroma/ecto/migrate.ex

@@ -0,0 +1,61 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-onl
+
+defmodule Mix.Tasks.Pleroma.Ecto.Migrate do
+  use Mix.Task
+  require Logger
+
+  @shortdoc "Wrapper on `ecto.migrate` task."
+
+  @aliases [
+    n: :step,
+    v: :to
+  ]
+
+  @switches [
+    all: :boolean,
+    step: :integer,
+    to: :integer,
+    quiet: :boolean,
+    log_sql: :boolean,
+    strict_version_order: :boolean,
+    migrations_path: :string
+  ]
+
+  @moduledoc """
+  Changes `Logger` level to `:info` before start migration.
+  Changes level back when migration ends.
+
+  ## Start migration
+
+      mix pleroma.ecto.migrate [OPTIONS]
+
+  Options:
+    - see https://hexdocs.pm/ecto/2.0.0/Mix.Tasks.Ecto.Migrate.html
+  """
+
+  @impl true
+  def run(args \\ []) do
+    {opts, _} = OptionParser.parse!(args, strict: @switches, aliases: @aliases)
+
+    opts =
+      if opts[:to] || opts[:step] || opts[:all],
+        do: opts,
+        else: Keyword.put(opts, :all, true)
+
+    opts =
+      if opts[:quiet],
+        do: Keyword.merge(opts, log: false, log_sql: false),
+        else: opts
+
+    path = Mix.Tasks.Pleroma.Ecto.ensure_migrations_path(Pleroma.Repo, opts)
+
+    level = Logger.level()
+    Logger.configure(level: :info)
+
+    {:ok, _, _} = Ecto.Migrator.with_repo(Pleroma.Repo, &Ecto.Migrator.run(&1, path, :up, opts))
+
+    Logger.configure(level: level)
+  end
+end

lib/mix/tasks/pleroma/ecto/rollback.ex

@@ -0,0 +1,65 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-onl
+
+defmodule Mix.Tasks.Pleroma.Ecto.Rollback do
+  use Mix.Task
+  require Logger
+  @shortdoc "Wrapper on `ecto.rollback` task"
+
+  @aliases [
+    n: :step,
+    v: :to
+  ]
+
+  @switches [
+    all: :boolean,
+    step: :integer,
+    to: :integer,
+    start: :boolean,
+    quiet: :boolean,
+    log_sql: :boolean,
+    migrations_path: :string
+  ]
+
+  @moduledoc """
+  Changes `Logger` level to `:info` before start rollback.
+  Changes level back when rollback ends.
+
+  ## Start rollback
+
+      mix pleroma.ecto.rollback
+
+  Options:
+    - see https://hexdocs.pm/ecto/2.0.0/Mix.Tasks.Ecto.Rollback.html
+  """
+
+  @impl true
+  def run(args \\ []) do
+    {opts, _} = OptionParser.parse!(args, strict: @switches, aliases: @aliases)
+
+    opts =
+      if opts[:to] || opts[:step] || opts[:all],
+        do: opts,
+        else: Keyword.put(opts, :step, 1)
+
+    opts =
+      if opts[:quiet],
+        do: Keyword.merge(opts, log: false, log_sql: false),
+        else: opts
+
+    path = Mix.Tasks.Pleroma.Ecto.ensure_migrations_path(Pleroma.Repo, opts)
+
+    level = Logger.level()
+    Logger.configure(level: :info)
+
+    if Pleroma.Config.get(:env) == :test do
+      Logger.info("Rollback succesfully")
+    else
+      {:ok, _, _} =
+        Ecto.Migrator.with_repo(Pleroma.Repo, &Ecto.Migrator.run(&1, path, :down, opts))
+    end
+
+    Logger.configure(level: level)
+  end
+end

lib/pleroma/html.ex

@@ -89,7 +89,7 @@ def extract_first_external_url(object, content) do
     Cachex.fetch!(:scrubber_cache, key, fn _key ->
       result =
         content
-        |> Floki.filter_out("a.mention,a.hashtag")
+        |> Floki.filter_out("a.mention,a.hashtag,a[rel~=\"tag\"]")
         |> Floki.attribute("a", "href")
         |> Enum.at(0)
 

lib/pleroma/release_tasks.ex

@@ -6,13 +6,12 @@ defmodule Pleroma.ReleaseTasks do
   @repo Pleroma.Repo
 
   def run(args) do
-    Mix.Tasks.Pleroma.Common.start_pleroma()
     [task | args] = String.split(args)
 
     case task do
-      "migrate" -> migrate()
+      "migrate" -> migrate(args)
       "create" -> create()
-      "rollback" -> rollback(String.to_integer(Enum.at(args, 0)))
+      "rollback" -> rollback(args)
       task -> mix_task(task, args)
     end
   end
@@ -35,12 +34,12 @@ defp mix_task(task, args) do
     end
   end
 
-  def migrate do
-    {:ok, _, _} = Ecto.Migrator.with_repo(@repo, &Ecto.Migrator.run(&1, :up, all: true))
+  def migrate(args) do
+    Mix.Tasks.Pleroma.Ecto.Migrate.run(args)
   end
 
-  def rollback(version) do
-    {:ok, _, _} = Ecto.Migrator.with_repo(@repo, &Ecto.Migrator.run(&1, :down, to: version))
+  def rollback(args) do
+    Mix.Tasks.Pleroma.Ecto.Rollback.run(args)
   end
 
   def create do

lib/pleroma/web/admin_api/views/report_view.ex

@@ -5,6 +5,7 @@
 defmodule Pleroma.Web.AdminAPI.ReportView do
   use Pleroma.Web, :view
   alias Pleroma.Activity
+  alias Pleroma.HTML
   alias Pleroma.User
   alias Pleroma.Web.CommonAPI.Utils
   alias Pleroma.Web.MastodonAPI.AccountView
@@ -23,6 +24,13 @@ def render("show.json", %{report: report}) do
     [account_ap_id | status_ap_ids] = report.data["object"]
     account = User.get_cached_by_ap_id(account_ap_id)
 
+    content =
+      unless is_nil(report.data["content"]) do
+        HTML.filter_tags(report.data["content"])
+      else
+        nil
+      end
+
     statuses =
       Enum.map(status_ap_ids, fn ap_id ->
         Activity.get_by_ap_id_with_object(ap_id)
@@ -32,7 +40,7 @@ def render("show.json", %{report: report}) do
       id: report.id,
       account: AccountView.render("account.json", %{user: account}),
       actor: AccountView.render("account.json", %{user: user}),
-      content: report.data["content"],
+      content: content,
       created_at: created_at,
       statuses: StatusView.render("index.json", %{activities: statuses, as: :activity}),
       state: report.data["state"]

lib/pleroma/web/common_api/common_api.ex

@@ -212,7 +212,7 @@ def post(user, %{"status" => status} = data) do
          cw <- data["spoiler_text"] || "",
          sensitive <- data["sensitive"] || Enum.member?(tags, {"#nsfw", "nsfw"}),
          full_payload <- String.trim(status <> cw),
-         length when length in 1..limit <- String.length(full_payload),
+         :ok <- validate_character_limit(full_payload, attachments, limit),
          object <-
            make_note_data(
              user.ap_id,
@@ -247,6 +247,7 @@ def post(user, %{"status" => status} = data) do
 
       res
     else
+      {:error, _} = e -> e
       e -> {:error, e}
     end
   end

lib/pleroma/web/common_api/utils.ex

@@ -504,4 +504,18 @@ def make_answer_data(%User{ap_id: ap_id}, object, name) do
       "inReplyTo" => object.data["id"]
     }
   end
+
+  def validate_character_limit(full_payload, attachments, limit) do
+    length = String.length(full_payload)
+
+    if length < limit do
+      if length > 0 or Enum.count(attachments) > 0 do
+        :ok
+      else
+        {:error, "Cannot post an empty status without attachments"}
+      end
+    else
+      {:error, "The status is over the character limit"}
+    end
+  end
 end

lib/pleroma/web/mastodon_api/mastodon_api_controller.ex

@@ -544,15 +544,6 @@ def delete_scheduled_status(%{assigns: %{user: user}} = conn, %{"id" => schedule
     end
   end
 
-  def post_status(conn, %{"status" => "", "media_ids" => media_ids} = params)
-      when length(media_ids) > 0 do
-    params =
-      params
-      |> Map.put("status", ".")
-
-    post_status(conn, params)
-  end
-
   def post_status(%{assigns: %{user: user}} = conn, %{"status" => _} = params) do
     params =
       params

lib/pleroma/web/mastodon_api/views/account_view.ex

@@ -66,6 +66,8 @@ def render("relationships.json", %{user: user, targets: targets}) do
   end
 
   defp do_render("account.json", %{user: user} = opts) do
+    display_name = HTML.strip_tags(user.name || user.nickname)
+
     image = User.avatar_url(user) |> MediaProxy.url()
     header = User.banner_url(user) |> MediaProxy.url()
     user_info = User.get_cached_user_info(user)
@@ -96,7 +98,7 @@ defp do_render("account.json", %{user: user} = opts) do
       id: to_string(user.id),
       username: username_from_nickname(user.nickname),
       acct: user.nickname,
-      display_name: user.name || user.nickname,
+      display_name: display_name,
       locked: user_info.locked,
       created_at: Utils.to_masto_date(user.inserted_at),
       followers_count: user_info.follower_count,

lib/pleroma/web/rich_media/helpers.ex

@@ -9,7 +9,9 @@ defmodule Pleroma.Web.RichMedia.Helpers do
   alias Pleroma.Web.RichMedia.Parser
 
   defp validate_page_url(page_url) when is_binary(page_url) do
-    if AutoLinker.Parser.url?(page_url, true) do
+    validate_tld = Application.get_env(:auto_linker, :opts)[:validate_tld]
+
+    if AutoLinker.Parser.url?(page_url, scheme: true, validate_tld: validate_tld) do
       URI.parse(page_url) |> validate_page_url
     else
       :error

lib/pleroma/web/salmon/salmon.ex

@@ -146,7 +146,7 @@ def publish_one(%{recipient: url, feed: feed} = params) when is_binary(url) do
         do: Instances.set_reachable(url)
 
       Logger.debug(fn -> "Pushed to #{url}, code #{code}" end)
-      :ok
+      {:ok, code}
     else
       e ->
         unless params[:unreachable_since], do: Instances.set_reachable(url)

mix.exs

@@ -126,7 +126,7 @@ defp deps do
       {:ueberauth, "~> 0.4"},
       {:auto_linker,
        git: "https://git.pleroma.social/pleroma/auto_linker.git",
-       ref: "e2385402bcd24fc659fee83b3eb8863b0528ad42"},
+       ref: "95e8188490e97505c56636c1379ffdf036c1fdde"},
       {:http_signatures,
        git: "https://git.pleroma.social/pleroma/http_signatures.git",
        ref: "9789401987096ead65646b52b5a2ca6bf52fc531"},
@@ -154,6 +154,8 @@ defp deps do
   # See the documentation for `Mix` for more info on aliases.
   defp aliases do
     [
+      "ecto.migrate": ["pleroma.ecto.migrate"],
+      "ecto.rollback": ["pleroma.ecto.rollback"],
       "ecto.setup": ["ecto.create", "ecto.migrate", "run priv/repo/seeds.exs"],
       "ecto.reset": ["ecto.drop", "ecto.setup"],
       test: ["ecto.create --quiet", "ecto.migrate", "test"]

mix.lock

@@ -1,6 +1,6 @@
 %{
   "accept": {:hex, :accept, "0.3.5", "b33b127abca7cc948bbe6caa4c263369abf1347cfa9d8e699c6d214660f10cd1", [:rebar3], [], "hexpm"},
-  "auto_linker": {:git, "https://git.pleroma.social/pleroma/auto_linker.git", "e2385402bcd24fc659fee83b3eb8863b0528ad42", [ref: "e2385402bcd24fc659fee83b3eb8863b0528ad42"]},
+  "auto_linker": {:git, "https://git.pleroma.social/pleroma/auto_linker.git", "95e8188490e97505c56636c1379ffdf036c1fdde", [ref: "95e8188490e97505c56636c1379ffdf036c1fdde"]},
   "base64url": {:hex, :base64url, "0.0.1", "36a90125f5948e3afd7be97662a1504b934dd5dac78451ca6e9abf85a10286be", [:rebar], [], "hexpm"},
   "bbcode": {:hex, :bbcode, "0.1.0", "400e618b640b635261611d7fb7f79d104917fc5b084aae371ab6b08477cb035b", [:mix], [{:nimble_parsec, "~> 0.5", [hex: :nimble_parsec, repo: "hexpm", optional: false]}], "hexpm"},
   "benchee": {:hex, :benchee, "1.0.1", "66b211f9bfd84bd97e6d1beaddf8fc2312aaabe192f776e8931cb0c16f53a521", [:mix], [{:deep_merge, "~> 1.0", [hex: :deep_merge, repo: "hexpm", optional: false]}], "hexpm"},

priv/static/index.html

@@ -1 +1 @@
-<!DOCTYPE html><html lang=en><head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><title>Pleroma</title><!--server-generated-meta--><link rel=icon type=image/png href=/favicon.png><link rel=stylesheet href=/static/font/css/fontello.css><link rel=stylesheet href=/static/font/css/animation.css><link href=/static/css/app.a81578273cb4c57163939ab70c80eb06.css rel=stylesheet></head><body style="display: none"><div id=app></div><script type=text/javascript src=/static/js/manifest.bf15f24d205c8cf4ee4a.js></script><script type=text/javascript src=/static/js/vendor.0d1eeaf25aa1d2fc51b0.js></script><script type=text/javascript src=/static/js/app.c914d9a57d5da7aa5553.js></script></body></html>
+<!DOCTYPE html><html lang=en><head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1,user-scalable=no"><title>Pleroma</title><!--server-generated-meta--><link rel=icon type=image/png href=/favicon.png><link rel=stylesheet href=/static/font/css/fontello.css><link rel=stylesheet href=/static/font/css/animation.css><link href=/static/css/vendors~app.b2603a50868c68a1c192.css rel=stylesheet><link href=/static/css/app.db80066bde2c96ea6198.css rel=stylesheet></head><body style="display: none"><div id=app></div><script type=text/javascript src=/static/js/vendors~app.ec33d2f791fb3c02da1d.js></script><script type=text/javascript src=/static/js/app.83ab168f1882edc9bb37.js></script></body></html>

priv/static/static/config.json

@@ -8,7 +8,6 @@
   "redirectRootLogin": "/main/friends",
   "chatDisabled": false,
   "showInstanceSpecificPanel": false,
-  "formattingOptionsEnabled": false,
   "collapseMessageWithSubject": false,
   "scopeCopy": true,
   "subjectLineBehavior": "email",

priv/static/static/css/app.db80066bde2c96ea6198.css.map

@@ -0,0 +1 @@
+{"version":3,"sources":["webpack:///./src/hocs/with_load_more/with_load_more.scss","webpack:///./src/components/tab_switcher/tab_switcher.scss","webpack:///./src/hocs/with_subscription/with_subscription.scss"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,C;ACTA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,C;ACzDA;AACA;AACA;AACA;AACA;AACA;AACA,C","file":"static/css/app.db80066bde2c96ea6198.css","sourcesContent":[".with-load-more-footer {\n  padding: 10px;\n  text-align: center;\n  border-top: 1px solid;\n  border-top-color: #222;\n  border-top-color: var(--border, #222);\n}\n.with-load-more-footer .error {\n  font-size: 14px;\n}",".tab-switcher .contents .hidden {\n  display: none;\n}\n.tab-switcher .tabs {\n  display: flex;\n  position: relative;\n  width: 100%;\n  overflow-y: hidden;\n  overflow-x: auto;\n  padding-top: 5px;\n  box-sizing: border-box;\n}\n.tab-switcher .tabs::after, .tab-switcher .tabs::before {\n  display: block;\n  content: \"\";\n  flex: 1 1 auto;\n  border-bottom: 1px solid;\n  border-bottom-color: #222;\n  border-bottom-color: var(--border, #222);\n}\n.tab-switcher .tabs .tab-wrapper {\n  height: 28px;\n  position: relative;\n  display: flex;\n  flex: 0 0 auto;\n}\n.tab-switcher .tabs .tab-wrapper .tab {\n  width: 100%;\n  min-width: 1px;\n  position: relative;\n  border-bottom-left-radius: 0;\n  border-bottom-right-radius: 0;\n  padding: 6px 1em;\n  padding-bottom: 99px;\n  margin-bottom: -93px;\n  white-space: nowrap;\n}\n.tab-switcher .tabs .tab-wrapper .tab:not(.active) {\n  z-index: 4;\n}\n.tab-switcher .tabs .tab-wrapper .tab:not(.active):hover {\n  z-index: 6;\n}\n.tab-switcher .tabs .tab-wrapper .tab.active {\n  background: transparent;\n  z-index: 5;\n}\n.tab-switcher .tabs .tab-wrapper:not(.active)::after {\n  content: \"\";\n  position: absolute;\n  left: 0;\n  right: 0;\n  bottom: 0;\n  z-index: 7;\n  border-bottom: 1px solid;\n  border-bottom-color: #222;\n  border-bottom-color: var(--border, #222);\n}",".with-subscription-loading {\n  padding: 10px;\n  text-align: center;\n}\n.with-subscription-loading .error {\n  font-size: 14px;\n}"],"sourceRoot":""}

priv/static/static/font/config.json

@@ -240,6 +240,12 @@
       "code": 59416,
       "src": "fontawesome"
     },
+    {
+      "uid": "266d5d9adf15a61800477a5acf9a4462",
+      "css": "chart-bar",
+      "code": 59419,
+      "src": "fontawesome"
+    },
     {
       "uid": "671f29fa10dda08074a4c6a341bb4f39",
       "css": "bell-alt",
@@ -251,6 +257,26 @@
       "css": "wrench",
       "code": 59418,
       "src": "fontawesome"
+    },
+    {
+      "uid": "5b0772e9484a1a11646793a82edd622a",
+      "css": "pin",
+      "code": 59417,
+      "src": "fontawesome"
+    },
+    {
+      "uid": "22411a88489225a018f68db737de3c77",
+      "css": "ellipsis",
+      "code": 61761,
+      "src": "custom_icons",
+      "selected": true,
+      "svg": {
+        "path": "M214 411V518Q214 540 199 556T161 571H54Q31 571 16 556T0 518V411Q0 388 16 373T54 357H161Q183 357 199 373T214 411ZM500 411V518Q500 540 484 556T446 571H339Q317 571 301 556T286 518V411Q286 388 301 373T339 357H446Q469 357 484 373T500 411ZM786 411V518Q786 540 770 556T732 571H625Q603 571 587 556T571 518V411Q571 388 587 373T625 357H732Q755 357 770 373T786 411Z",
+        "width": 785.7
+      },
+      "search": [
+        "ellipsis"
+      ]
     }
   ]
 }

priv/static/static/font/demo.html

@@ -229,11 +229,11 @@ body {
 }
 @font-face {
       font-family: 'fontello';
-      src: url('./font/fontello.eot?60799712');
-      src: url('./font/fontello.eot?60799712#iefix') format('embedded-opentype'),
-           url('./font/fontello.woff?60799712') format('woff'),
-           url('./font/fontello.ttf?60799712') format('truetype'),
-           url('./font/fontello.svg?60799712#fontello') format('svg');
+      src: url('./font/fontello.eot?14310629');
+      src: url('./font/fontello.eot?14310629#iefix') format('embedded-opentype'),
+           url('./font/fontello.woff?14310629') format('woff'),
+           url('./font/fontello.ttf?14310629') format('truetype'),
+           url('./font/fontello.svg?14310629#fontello') format('svg');
       font-weight: normal;
       font-style: normal;
     }
@@ -335,29 +335,31 @@ body {
       </div>
       <div class="row">
         <div class="the-icons span3" title="Code: 0xe818"><i class="demo-icon icon-pencil">&#xe818;</i> <span class="i-name">icon-pencil</span><span class="i-code">0xe818</span></div>
-        <div class="the-icons span3" title="Code: 0xe819"><i class="demo-icon icon-verified">&#xe819;</i> <span class="i-name">icon-verified</span><span class="i-code">0xe819</span></div>
+        <div class="the-icons span3" title="Code: 0xe819"><i class="demo-icon icon-pin">&#xe819;</i> <span class="i-name">icon-pin</span><span class="i-code">0xe819</span></div>
         <div class="the-icons span3" title="Code: 0xe81a"><i class="demo-icon icon-wrench">&#xe81a;</i> <span class="i-name">icon-wrench</span><span class="i-code">0xe81a</span></div>
-        <div class="the-icons span3" title="Code: 0xe832"><i class="demo-icon icon-spin3 animate-spin">&#xe832;</i> <span class="i-name">icon-spin3</span><span class="i-code">0xe832</span></div>
+        <div class="the-icons span3" title="Code: 0xe81b"><i class="demo-icon icon-chart-bar">&#xe81b;</i> <span class="i-name">icon-chart-bar</span><span class="i-code">0xe81b</span></div>
       </div>
       <div class="row">
+        <div class="the-icons span3" title="Code: 0xe832"><i class="demo-icon icon-spin3 animate-spin">&#xe832;</i> <span class="i-name">icon-spin3</span><span class="i-code">0xe832</span></div>
         <div class="the-icons span3" title="Code: 0xe834"><i class="demo-icon icon-spin4 animate-spin">&#xe834;</i> <span class="i-name">icon-spin4</span><span class="i-code">0xe834</span></div>
         <div class="the-icons span3" title="Code: 0xf08e"><i class="demo-icon icon-link-ext">&#xf08e;</i> <span class="i-name">icon-link-ext</span><span class="i-code">0xf08e</span></div>
         <div class="the-icons span3" title="Code: 0xf08f"><i class="demo-icon icon-link-ext-alt">&#xf08f;</i> <span class="i-name">icon-link-ext-alt</span><span class="i-code">0xf08f</span></div>
-        <div class="the-icons span3" title="Code: 0xf0c9"><i class="demo-icon icon-menu">&#xf0c9;</i> <span class="i-name">icon-menu</span><span class="i-code">0xf0c9</span></div>
       </div>
       <div class="row">
+        <div class="the-icons span3" title="Code: 0xf0c9"><i class="demo-icon icon-menu">&#xf0c9;</i> <span class="i-name">icon-menu</span><span class="i-code">0xf0c9</span></div>
         <div class="the-icons span3" title="Code: 0xf0e0"><i class="demo-icon icon-mail-alt">&#xf0e0;</i> <span class="i-name">icon-mail-alt</span><span class="i-code">0xf0e0</span></div>
         <div class="the-icons span3" title="Code: 0xf0e5"><i class="demo-icon icon-comment-empty">&#xf0e5;</i> <span class="i-name">icon-comment-empty</span><span class="i-code">0xf0e5</span></div>
         <div class="the-icons span3" title="Code: 0xf0f3"><i class="demo-icon icon-bell-alt">&#xf0f3;</i> <span class="i-name">icon-bell-alt</span><span class="i-code">0xf0f3</span></div>
-        <div class="the-icons span3" title="Code: 0xf0fe"><i class="demo-icon icon-plus-squared">&#xf0fe;</i> <span class="i-name">icon-plus-squared</span><span class="i-code">0xf0fe</span></div>
       </div>
       <div class="row">
+        <div class="the-icons span3" title="Code: 0xf0fe"><i class="demo-icon icon-plus-squared">&#xf0fe;</i> <span class="i-name">icon-plus-squared</span><span class="i-code">0xf0fe</span></div>
         <div class="the-icons span3" title="Code: 0xf112"><i class="demo-icon icon-reply">&#xf112;</i> <span class="i-name">icon-reply</span><span class="i-code">0xf112</span></div>
         <div class="the-icons span3" title="Code: 0xf13e"><i class="demo-icon icon-lock-open-alt">&#xf13e;</i> <span class="i-name">icon-lock-open-alt</span><span class="i-code">0xf13e</span></div>
-        <div class="the-icons span3" title="Code: 0xf144"><i class="demo-icon icon-play-circled">&#xf144;</i> <span class="i-name">icon-play-circled</span><span class="i-code">0xf144</span></div>
-        <div class="the-icons span3" title="Code: 0xf164"><i class="demo-icon icon-thumbs-up-alt">&#xf164;</i> <span class="i-name">icon-thumbs-up-alt</span><span class="i-code">0xf164</span></div>
+        <div class="the-icons span3" title="Code: 0xf141"><i class="demo-icon icon-ellipsis">&#xf141;</i> <span class="i-name">icon-ellipsis</span><span class="i-code">0xf141</span></div>
       </div>
       <div class="row">
+        <div class="the-icons span3" title="Code: 0xf144"><i class="demo-icon icon-play-circled">&#xf144;</i> <span class="i-name">icon-play-circled</span><span class="i-code">0xf144</span></div>
+        <div class="the-icons span3" title="Code: 0xf164"><i class="demo-icon icon-thumbs-up-alt">&#xf164;</i> <span class="i-name">icon-thumbs-up-alt</span><span class="i-code">0xf164</span></div>
         <div class="the-icons span3" title="Code: 0xf1e5"><i class="demo-icon icon-binoculars">&#xf1e5;</i> <span class="i-name">icon-binoculars</span><span class="i-code">0xf1e5</span></div>
         <div class="the-icons span3" title="Code: 0xf234"><i class="demo-icon icon-user-plus">&#xf234;</i> <span class="i-name">icon-user-plus</span><span class="i-code">0xf234</span></div>
       </div>

priv/static/static/font/font/fontello.svg

@@ -56,10 +56,12 @@
 
 <glyph glyph-name="pencil" unicode="&#xe818;" d="M203 0l50 51-131 131-51-51v-60h72v-71h60z m291 518q0 12-12 12-5 0-9-4l-303-302q-4-4-4-10 0-12 13-12 5 0 9 4l303 302q3 4 3 10z m-30 107l232-232-464-465h-232v233z m381-54q0-29-20-50l-93-93-232 233 93 92q20 21 50 21 29 0 51-21l131-131q20-22 20-51z" horiz-adv-x="857.1" />
 
-<glyph glyph-name="verified" unicode="&#xe819;" d="M926 453l-19 13c-21 14-30 41-23 65l6 22c10 34-13 69-48 75l-23 4c-25 4-45 23-49 48l-4 23c-6 35-41 57-75 47l-22-7c-24-7-51 2-65 22l-14 20c-21 29-62 33-88 9l-17-16c-19-17-46-21-69-8l-20 11c-31 17-70 3-84-30l-9-22c-9-24-33-39-58-37l-23 1c-36 2-65-28-62-63l2-23c2-25-13-49-36-59l-21-9c-33-14-46-53-29-84l12-20c13-22 10-50-7-69l-15-17c-24-27-19-68 11-88l19-13c21-14 30-41 23-65l-9-23c-10-34 13-69 48-75l23-4c25-4 45-23 49-48l4-23c6-35 41-57 75-47l22 7c24 7 51-2 65-22l14-19c21-29 62-33 88-9l17 16c19 17 46 21 69 8l20-11c31-17 70-3 84 30l9 22c9 24 33 39 58 37l23-1c36-2 65 28 62 63l-1 23c-2 25 13 49 36 59l21 9c33 14 46 53 29 84l-12 20c-13 22-10 50 7 69l15 17c25 26 20 68-9 88z m-399-189l-82-81-81 82-78 79 82 81 78-79 187 186 81-82-187-186z" horiz-adv-x="1000" />
+<glyph glyph-name="pin" unicode="&#xe819;" d="M268 375v250q0 8-5 13t-13 5-13-5-5-13v-250q0-8 5-13t13-5 13 5 5 13z m375-197q0-14-11-25t-25-10h-239l-29-270q-1-7-6-11t-11-5h-1q-15 0-17 15l-43 271h-225q-15 0-25 10t-11 25q0 69 44 124t99 55v286q-29 0-50 21t-22 50 22 50 50 22h357q29 0 50-22t21-50-21-50-50-21v-286q55 0 99-55t44-124z" horiz-adv-x="642.9" />
 
 <glyph glyph-name="wrench" unicode="&#xe81a;" d="M214 36q0 14-10 25t-25 10-25-10-11-25 11-25 25-11 25 11 10 25z m360 234l-381-381q-21-20-50-20-29 0-51 20l-59 61q-21 20-21 50 0 29 21 51l380 380q22-55 64-97t97-64z m354 243q0-22-13-59-27-75-92-122t-144-46q-104 0-177 73t-73 177 73 176 177 74q32 0 67-10t60-26q9-6 9-15t-9-16l-163-94v-125l108-60q2 2 44 27t75 45 40 20q8 0 13-5t5-14z" horiz-adv-x="928.6" />
 
+<glyph glyph-name="chart-bar" unicode="&#xe81b;" d="M357 357v-286h-143v286h143z m214 286v-572h-142v572h142z m572-643v-72h-1143v858h71v-786h1072z m-357 500v-429h-143v429h143z m214 214v-643h-143v643h143z" horiz-adv-x="1142.9" />
+
 <glyph glyph-name="spin3" unicode="&#xe832;" d="M494 857c-266 0-483-210-494-472-1-19 13-20 13-20l84 0c16 0 19 10 19 18 10 199 176 358 378 358 107 0 205-45 273-118l-58-57c-11-12-11-27 5-31l247-50c21-5 46 11 37 44l-58 227c-2 9-16 22-29 13l-65-60c-89 91-214 148-352 148z m409-508c-16 0-19-10-19-18-10-199-176-358-377-358-108 0-205 45-274 118l59 57c10 12 10 27-5 31l-248 50c-21 5-46-11-37-44l58-227c2-9 16-22 30-13l64 60c89-91 214-148 353-148 265 0 482 210 493 473 1 18-13 19-13 19l-84 0z" horiz-adv-x="1000" />
 
 <glyph glyph-name="spin4" unicode="&#xe834;" d="M498 857c-114 0-228-39-320-116l0 0c173 140 428 130 588-31 134-134 164-332 89-495-10-29-5-50 12-68 21-20 61-23 84 0 3 3 12 15 15 24 71 180 33 393-112 539-99 98-228 147-356 147z m-409-274c-14 0-29-5-39-16-3-3-13-15-15-24-71-180-34-393 112-539 185-185 479-195 676-31l0 0c-173-140-428-130-589 31-134 134-163 333-89 495 11 29 6 50-12 68-11 11-27 17-44 16z" horiz-adv-x="1001" />
@@ -82,6 +84,8 @@
 
 <glyph glyph-name="lock-open-alt" unicode="&#xf13e;" d="M589 428q23 0 38-15t16-38v-322q0-22-16-37t-38-16h-535q-23 0-38 16t-16 37v322q0 22 16 38t38 15h17v179q0 103 74 177t176 73 177-73 73-177q0-14-10-25t-25-11h-36q-14 0-25 11t-11 25q0 59-42 101t-101 42-101-42-41-101v-179h410z" horiz-adv-x="642.9" />
 
+<glyph glyph-name="ellipsis" unicode="&#xf141;" d="M214 446v-107q0-22-15-38t-38-15h-107q-23 0-38 15t-16 38v107q0 23 16 38t38 16h107q22 0 38-16t15-38z m286 0v-107q0-22-16-38t-38-15h-107q-22 0-38 15t-15 38v107q0 23 15 38t38 16h107q23 0 38-16t16-38z m286 0v-107q0-22-16-38t-38-15h-107q-22 0-38 15t-16 38v107q0 23 16 38t38 16h107q23 0 38-16t16-38z" horiz-adv-x="785.7" />
+
 <glyph glyph-name="play-circled" unicode="&#xf144;" d="M429 786q116 0 215-58t156-156 57-215-57-215-156-156-215-58-216 58-155 156-58 215 58 215 155 156 216 58z m214-460q18 10 18 31t-18 31l-304 178q-17 11-35 1-18-11-18-31v-358q0-20 18-31 9-4 17-4 10 0 18 5z" horiz-adv-x="857.1" />
 
 <glyph glyph-name="thumbs-up-alt" unicode="&#xf164;" d="M143 107q0 15-11 25t-25 11q-15 0-25-11t-11-25q0-15 11-25t25-11q15 0 25 11t11 25z m89 286v-357q0-15-10-25t-26-11h-160q-15 0-25 11t-11 25v357q0 14 11 25t25 10h160q15 0 26-10t10-25z m661 0q0-48-31-83 9-25 9-43 1-42-24-76 9-31 0-66-9-31-31-52 5-62-27-101-36-43-110-44h-72q-37 0-80 9t-68 16-67 22q-69 24-88 25-15 0-25 11t-11 25v357q0 14 10 25t24 11q13 1 42 33t57 67q38 49 56 67 10 10 17 27t10 27 8 34q4 22 7 34t11 29 19 28q10 11 25 11 25 0 46-6t33-15 22-22 14-25 7-28 2-25 1-22q0-21-6-43t-10-33-16-31q-1-4-5-10t-6-13-5-13h155q43 0 75-32t32-75z" horiz-adv-x="928.6" />

priv/static/static/timeago-ca.json

@@ -1,10 +0,0 @@
-[
-  "ara mateix",
-  ["fa %s s",     "fa %s s"],
-  ["fa %s min",   "fa %s min"],
-  ["fa %s h",     "fa %s h"],
-  ["fa %s dia",   "fa %s dies"],
-  ["fa %s setm.", "fa %s setm."],
-  ["fa %s mes",   "fa %s mesos"],
-  ["fa %s any",   "fa %s anys"]
-]

priv/static/static/timeago-cs.json

@@ -1,10 +0,0 @@
-[
-  "teď",
-  ["%s s", "%s s"],
-  ["%s min", "%s min"],
-  ["%s h", "%s h"],
-  ["%s d", "%s d"],
-  ["%s týd", "%s týd"],
-  ["%s měs", "%s měs"],
-  ["%s r", "%s l"]
-]

priv/static/static/timeago-en.json

@@ -1,10 +0,0 @@
-[
-  "now",
-  ["%ss", "%ss"],
-  ["%smin", "%smin"],
-  ["%sh", "%sh"],
-  ["%sd", "%sd"],
-  ["%sw", "%sw"],
-  ["%smo", "%smo"],
-  ["%sy", "%sy"]
-]

priv/static/static/timeago-ga.json

@@ -1,10 +0,0 @@
-[
-  "Anois",
-  ["%s s", "%s s"],
-  ["%s n", "%s nóimeád"],
-  ["%s u", "%s uair"],
-  ["%s l", "%s lá"],
-  ["%s se", "%s seachtaine"],
-  ["%s m", "%s mí"],
-  ["%s b", "%s bliainta"]
-]

priv/static/static/timeago-ja.json

@@ -1,10 +0,0 @@
-[
-  "たった今",
-  "%s 秒前",
-  "%s 分前",
-  "%s 時間前",
-  "%s 日前",
-  "%s 週間前",
-  "%s ヶ月前",
-  "%s 年前"
-]

priv/static/static/timeago-oc.json

@@ -1,10 +0,0 @@
-[
-  "ara meteis",
-  ["fa %s s",     "fa %s s"],
-  ["fa %s min",   "fa %s min"],
-  ["fa %s h",     "fa %s h"],
-  ["fa %s jorn",   "fa %s jorns"],
-  ["fa %s setm.", "fa %s setm."],
-  ["fa %s mes",   "fa %s meses"],
-  ["fa %s an",   "fa %s ans"]
-]

rel/pleroma_ctl

@@ -11,9 +11,16 @@ if [ -z "$1" ] || [ "$1" = "help" ]; then
 
     and any mix tasks under Pleroma namespace, for example \`mix pleroma.user COMMAND\` is
     equivalent to \`$(basename "$0") user COMMAND\`
+
+    By default pleroma_ctl will try calling into a running instance to execute non migration-related commands,
+    if for some reason this is undesired, set PLEROMA_CTL_RPC_DISABLED environment variable
 "
 else
 	SCRIPT=$(readlink -f "$0")
 	SCRIPTPATH=$(dirname "$SCRIPT")
+	if [ "$1" = "migrate" ] || [ "$1" = "rollback" ] || [ "$1" = "create" ] || [ -n "$PLEROMA_CTL_RPC_DISABLED" ]; then
 		"$SCRIPTPATH"/pleroma eval 'Pleroma.ReleaseTasks.run("'"$*"'")'
+	else
+		"$SCRIPTPATH"/pleroma rpc 'Pleroma.ReleaseTasks.run("'"$*"'")'
+	fi
 fi

test/html_test.exs

@@ -212,5 +212,21 @@ test "skips hashtags" do
 
       assert url == "https://www.pixiv.net/member_illust.php?mode=medium&illust_id=72255140"
     end
+
+    test "skips microformats hashtags" do
+      user = insert(:user)
+
+      {:ok, activity} =
+        CommonAPI.post(user, %{
+          "status" =>
+            "<a href=\"https://pleroma.gov/tags/cofe\" rel=\"tag\">#cofe</a> https://www.pixiv.net/member_illust.php?mode=medium&illust_id=72255140",
+          "content_type" => "text/html"
+        })
+
+      object = Object.normalize(activity)
+      {:ok, url} = HTML.extract_first_external_url(object, object.data["content"])
+
+      assert url == "https://www.pixiv.net/member_illust.php?mode=medium&illust_id=72255140"
+    end
   end
 end

test/object/containment_test.exs

@@ -5,6 +5,7 @@ defmodule Pleroma.Object.ContainmentTest do
   alias Pleroma.User
 
   import Pleroma.Factory
+  import ExUnit.CaptureLog
 
   setup_all do
     Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
@@ -57,7 +58,10 @@ test "users cannot be collided through fake direction spoofing attempts" do
           follower_address: User.ap_followers(%User{nickname: "rye@niu.moe"})
         })
 
+      assert capture_log(fn ->
                {:error, _} = User.get_or_fetch_by_ap_id("https://n1u.moe/users/rye")
+             end) =~
+               "[error] Could not decode user at fetch https://n1u.moe/users/rye, {:error, :error}"
     end
   end
 end

test/support/http_request_mock.ex

@@ -802,6 +802,30 @@ def post("http://example.org/needs_refresh", _, _, _) do
      }}
   end
 
+  def post("http://mastodon.example.org/inbox", _, _, _) do
+    {:ok,
+     %Tesla.Env{
+       status: 200,
+       body: ""
+     }}
+  end
+
+  def post("https://hubzilla.example.org/inbox", _, _, _) do
+    {:ok,
+     %Tesla.Env{
+       status: 200,
+       body: ""
+     }}
+  end
+
+  def post("http://gs.example.org/index.php/main/salmon/user/1", _, _, _) do
+    {:ok,
+     %Tesla.Env{
+       status: 200,
+       body: ""
+     }}
+  end
+
   def post("http://200.site" <> _, _, _, _) do
     {:ok,
      %Tesla.Env{

test/tasks/ecto/migrate_test.exs

@@ -0,0 +1,20 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-onl
+
+defmodule Mix.Tasks.Pleroma.Ecto.MigrateTest do
+  use Pleroma.DataCase, async: true
+  import ExUnit.CaptureLog
+  require Logger
+
+  test "ecto.migrate info message" do
+    level = Logger.level()
+    Logger.configure(level: :warn)
+
+    assert capture_log(fn ->
+             Mix.Tasks.Pleroma.Ecto.Migrate.run()
+           end) =~ "[info] Already up"
+
+    Logger.configure(level: level)
+  end
+end

test/tasks/ecto/rollback_test.exs

@@ -0,0 +1,16 @@
+defmodule Mix.Tasks.Pleroma.Ecto.RollbackTest do
+  use Pleroma.DataCase
+  import ExUnit.CaptureLog
+  require Logger
+
+  test "ecto.rollback info message" do
+    level = Logger.level()
+    Logger.configure(level: :warn)
+
+    assert capture_log(fn ->
+             Mix.Tasks.Pleroma.Ecto.Rollback.run()
+           end) =~ "[info] Rollback succesfully"
+
+    Logger.configure(level: level)
+  end
+end

test/web/activity_pub/transmogrifier_test.exs

@@ -15,6 +15,7 @@ defmodule Pleroma.Web.ActivityPub.TransmogrifierTest do
   alias Pleroma.Web.Websub.WebsubClientSubscription
 
   import Pleroma.Factory
+  import ExUnit.CaptureLog
   alias Pleroma.Web.CommonAPI
 
   setup_all do
@@ -73,7 +74,9 @@ test "it does not crash if the object in inReplyTo can't be fetched" do
         data
         |> Map.put("object", object)
 
+      assert capture_log(fn ->
                {:ok, _returned_activity} = Transmogrifier.handle_incoming(data)
+             end) =~ "[error] Couldn't fetch \"\"https://404.site/whatever\"\", error: nil"
     end
 
     test "it works for incoming notices" do
@@ -516,7 +519,10 @@ test "it fails for incoming deletes with spoofed origin" do
         data
         |> Map.put("object", object)
 
+      assert capture_log(fn ->
                :error = Transmogrifier.handle_incoming(data)
+             end) =~
+               "[error] Could not decode user at fetch http://mastodon.example.org/users/gargron, {:error, {:error, :nxdomain}}"
 
       assert Activity.get_by_id(activity.id)
     end

test/web/admin_api/views/report_view_test.exs

@@ -0,0 +1,98 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.AdminAPI.ReportViewTest do
+  use Pleroma.DataCase
+  import Pleroma.Factory
+  alias Pleroma.Web.AdminAPI.ReportView
+  alias Pleroma.Web.CommonAPI
+  alias Pleroma.Web.MastodonAPI.AccountView
+  alias Pleroma.Web.MastodonAPI.StatusView
+
+  test "renders a report" do
+    user = insert(:user)
+    other_user = insert(:user)
+
+    {:ok, activity} = CommonAPI.report(user, %{"account_id" => other_user.id})
+
+    expected = %{
+      content: nil,
+      actor: AccountView.render("account.json", %{user: user}),
+      account: AccountView.render("account.json", %{user: other_user}),
+      statuses: [],
+      state: "open",
+      id: activity.id
+    }
+
+    result =
+      ReportView.render("show.json", %{report: activity})
+      |> Map.delete(:created_at)
+
+    assert result == expected
+  end
+
+  test "includes reported statuses" do
+    user = insert(:user)
+    other_user = insert(:user)
+    {:ok, activity} = CommonAPI.post(other_user, %{"status" => "toot"})
+
+    {:ok, report_activity} =
+      CommonAPI.report(user, %{"account_id" => other_user.id, "status_ids" => [activity.id]})
+
+    expected = %{
+      content: nil,
+      actor: AccountView.render("account.json", %{user: user}),
+      account: AccountView.render("account.json", %{user: other_user}),
+      statuses: [StatusView.render("status.json", %{activity: activity})],
+      state: "open",
+      id: report_activity.id
+    }
+
+    result =
+      ReportView.render("show.json", %{report: report_activity})
+      |> Map.delete(:created_at)
+
+    assert result == expected
+  end
+
+  test "renders report's state" do
+    user = insert(:user)
+    other_user = insert(:user)
+
+    {:ok, activity} = CommonAPI.report(user, %{"account_id" => other_user.id})
+    {:ok, activity} = CommonAPI.update_report_state(activity.id, "closed")
+    assert %{state: "closed"} = ReportView.render("show.json", %{report: activity})
+  end
+
+  test "renders report description" do
+    user = insert(:user)
+    other_user = insert(:user)
+
+    {:ok, activity} =
+      CommonAPI.report(user, %{
+        "account_id" => other_user.id,
+        "comment" => "posts are too good for this instance"
+      })
+
+    assert %{content: "posts are too good for this instance"} =
+             ReportView.render("show.json", %{report: activity})
+  end
+
+  test "sanitizes report description" do
+    user = insert(:user)
+    other_user = insert(:user)
+
+    {:ok, activity} =
+      CommonAPI.report(user, %{
+        "account_id" => other_user.id,
+        "comment" => ""
+      })
+
+    data = Map.put(activity.data, "content", "<script> alert('hecked :D:D:D:D:D:D:D') </script>")
+    activity = Map.put(activity, :data, data)
+
+    refute "<script> alert('hecked :D:D:D:D:D:D:D') </script>" ==
+             ReportView.render("show.json", %{report: activity})[:content]
+  end
+end

test/web/mastodon_api/account_view_test.exs

@@ -269,4 +269,10 @@ test "returns the settings store if the requesting user is the represented user
     result = AccountView.render("account.json", %{user: user, for: user})
     assert result.pleroma[:settings_store] == nil
   end
+
+  test "sanitizes display names" do
+    user = insert(:user, name: "<marquee> username </marquee>")
+    result = AccountView.render("account.json", %{user: user})
+    refute result.display_name == "<marquee> username </marquee>"
+  end
 end