Merge branch 'develop' of git.pleroma.social:pleroma/pleroma into websearch

This commit is contained in:
lain 2020-11-19 17:32:57 +01:00
commit 5e04f4156c
7 changed files with 63 additions and 6 deletions

View File

@ -22,6 +22,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
- Configuration: Add `:instance, autofollowing_nicknames` setting to provide a way to make accounts automatically follow new users that register on the local Pleroma instance. - Configuration: Add `:instance, autofollowing_nicknames` setting to provide a way to make accounts automatically follow new users that register on the local Pleroma instance.
- Ability to view remote timelines, with ex. `/api/v1/timelines/public?instance=lain.com` and streams `public:remote` and `public:remote:media`. - Ability to view remote timelines, with ex. `/api/v1/timelines/public?instance=lain.com` and streams `public:remote` and `public:remote:media`.
- The site title is now injected as a `title` tag like preloads or metadata. - The site title is now injected as a `title` tag like preloads or metadata.
- Password reset tokens now are not accepted after a certain age.
- Added a configuration option to use the postgresql `websearch` function for more complicated search queries. - Added a configuration option to use the postgresql `websearch` function for more complicated search queries.
<details> <details>
@ -36,11 +37,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
### Fixed ### Fixed
<details> - <details>
<summary>API Changes</summary> <summary>API Changes</summary>
- Mastodon API: Current user is now included in conversation if it's the only participant. - Mastodon API: Current user is now included in conversation if it's the only participant.
- Mastodon API: Fixed last_status.account being not filled with account data. - Mastodon API: Fixed last_status.account being not filled with account data.
</details> </details>
## Unreleased (Patch) ## Unreleased (Patch)
@ -52,8 +52,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
### Fixed ### Fixed
- Config generation: rename `Pleroma.Upload.Filter.ExifTool` to `Pleroma.Upload.Filter.Exiftool`. - Config generation: rename `Pleroma.Upload.Filter.ExifTool` to `Pleroma.Upload.Filter.Exiftool`.
- Search: RUM index search speed has been fixed.
- S3 Uploads with Elixir 1.11. - S3 Uploads with Elixir 1.11.
- Fixed Emoji Reaction activity filtering from blocked and muted accounts - Emoji Reaction activity filtering from blocked and muted accounts.
- Mix task pleroma.user delete_activities for source installations. - Mix task pleroma.user delete_activities for source installations.
## [2.2.0] - 2020-11-12 ## [2.2.0] - 2020-11-12

View File

@ -264,6 +264,7 @@
] ]
], ],
show_reactions: true, show_reactions: true,
password_reset_token_validity: 60 * 60 * 24,
search_function: :websearch search_function: :websearch
config :pleroma, :welcome, config :pleroma, :welcome,

View File

@ -63,6 +63,7 @@ To add configuration to your config file, you can copy it from the base config.
* `external_user_synchronization`: Enabling following/followers counters synchronization for external users. * `external_user_synchronization`: Enabling following/followers counters synchronization for external users.
* `cleanup_attachments`: Remove attachments along with statuses. Does not affect duplicate files and attachments without status. Enabling this will increase load to database when deleting statuses on larger instances. * `cleanup_attachments`: Remove attachments along with statuses. Does not affect duplicate files and attachments without status. Enabling this will increase load to database when deleting statuses on larger instances.
* `show_reactions`: Let favourites and emoji reactions be viewed through the API (default: `true`). * `show_reactions`: Let favourites and emoji reactions be viewed through the API (default: `true`).
* `password_reset_token_validity`: The time after which reset tokens aren't accepted anymore, in seconds (default: one day).
* `search_function`: What search function to use for fulltext search. Possible values are `:websearch` and `:plain`. `:websearch` enables more complex search queries, but requires at least PostgreSQL 11. (default: `websearch`) * `search_function`: What search function to use for fulltext search. Possible values are `:websearch` and `:plain`. `:websearch` enables more complex search queries, but requires at least PostgreSQL 11. (default: `websearch`)
## Welcome ## Welcome

View File

@ -29,7 +29,10 @@ def search(user, search_query, options \\ []) do
|> maybe_restrict_local(user) |> maybe_restrict_local(user)
|> maybe_restrict_author(author) |> maybe_restrict_author(author)
|> maybe_restrict_blocked(user) |> maybe_restrict_blocked(user)
|> Pagination.fetch_paginated(%{"offset" => offset, "limit" => limit}, :offset) |> Pagination.fetch_paginated(
%{"offset" => offset, "limit" => limit, "skip_order" => index_type == :rum},
:offset
)
|> maybe_fetch(user, search_query) |> maybe_fetch(user, search_query)
end end

View File

@ -40,6 +40,7 @@ def used_changeset(struct) do
@spec reset_password(binary(), map()) :: {:ok, User.t()} | {:error, binary()} @spec reset_password(binary(), map()) :: {:ok, User.t()} | {:error, binary()}
def reset_password(token, data) do def reset_password(token, data) do
with %{used: false} = token <- Repo.get_by(PasswordResetToken, %{token: token}), with %{used: false} = token <- Repo.get_by(PasswordResetToken, %{token: token}),
false <- expired?(token),
%User{} = user <- User.get_cached_by_id(token.user_id), %User{} = user <- User.get_cached_by_id(token.user_id),
{:ok, _user} <- User.reset_password(user, data), {:ok, _user} <- User.reset_password(user, data),
{:ok, token} <- Repo.update(used_changeset(token)) do {:ok, token} <- Repo.update(used_changeset(token)) do
@ -48,4 +49,14 @@ def reset_password(token, data) do
_e -> {:error, token} _e -> {:error, token}
end end
end end
def expired?(%__MODULE__{inserted_at: inserted_at}) do
validity = Pleroma.Config.get([:instance, :password_reset_token_validity], 0)
now = NaiveDateTime.utc_now()
difference = NaiveDateTime.diff(now, inserted_at)
difference > validity
end
end end

View File

@ -17,6 +17,7 @@ defmodule Pleroma.Web.TwitterAPI.PasswordController do
def reset(conn, %{"token" => token}) do def reset(conn, %{"token" => token}) do
with %{used: false} = token <- Repo.get_by(PasswordResetToken, %{token: token}), with %{used: false} = token <- Repo.get_by(PasswordResetToken, %{token: token}),
false <- PasswordResetToken.expired?(token),
%User{} = user <- User.get_cached_by_id(token.user_id) do %User{} = user <- User.get_cached_by_id(token.user_id) do
render(conn, "reset.html", %{ render(conn, "reset.html", %{
token: token, token: token,

View File

@ -31,9 +31,48 @@ test "it shows password reset form", %{conn: conn} do
assert response =~ "<h2>Password Reset for #{user.nickname}</h2>" assert response =~ "<h2>Password Reset for #{user.nickname}</h2>"
end end
test "it returns an error when the token has expired", %{conn: conn} do
clear_config([:instance, :password_reset_token_validity], 0)
user = insert(:user)
{:ok, token} = PasswordResetToken.create_token(user)
:timer.sleep(2000)
response =
conn
|> get("/api/pleroma/password_reset/#{token.token}")
|> html_response(:ok)
assert response =~ "<h2>Invalid Token</h2>"
end
end end
describe "POST /api/pleroma/password_reset" do describe "POST /api/pleroma/password_reset" do
test "it fails for an expired token", %{conn: conn} do
clear_config([:instance, :password_reset_token_validity], 0)
user = insert(:user)
{:ok, token} = PasswordResetToken.create_token(user)
:timer.sleep(2000)
{:ok, _access_token} = Token.create(insert(:oauth_app), user, %{})
params = %{
"password" => "test",
password_confirmation: "test",
token: token.token
}
response =
conn
|> assign(:user, user)
|> post("/api/pleroma/password_reset", %{data: params})
|> html_response(:ok)
refute response =~ "<h2>Password changed!</h2>"
end
test "it returns HTTP 200", %{conn: conn} do test "it returns HTTP 200", %{conn: conn} do
user = insert(:user) user = insert(:user)
{:ok, token} = PasswordResetToken.create_token(user) {:ok, token} = PasswordResetToken.create_token(user)