OStatus / Static FE access control fixes See merge request pleroma/pleroma!3053tags/v2.2.0^2
@@ -52,6 +52,7 @@ switched to a new configuration mechanism, however it was not officially removed | |||
- Add documented-but-missing chat pagination. | |||
- Allow sending out emails again. | |||
- Allow sending chat messages to yourself | |||
- OStatus / static FE endpoints: fixed inaccessibility for anonymous users on non-federating instances, switched to handling per `:restrict_unauthenticated` setting. | |||
### Upgrade notes | |||
@@ -44,29 +44,30 @@ defmodule Pleroma.Web.ActivityPub.Visibility do | |||
def is_list?(%{data: %{"listMessage" => _}}), do: true | |||
def is_list?(_), do: false | |||
@spec visible_for_user?(Activity.t(), User.t() | nil) :: boolean() | |||
def visible_for_user?(%{actor: ap_id}, %User{ap_id: ap_id}), do: true | |||
@spec visible_for_user?(Activity.t() | nil, User.t() | nil) :: boolean() | |||
def visible_for_user?(%Activity{actor: ap_id}, %User{ap_id: ap_id}), do: true | |||
def visible_for_user?(nil, _), do: false | |||
def visible_for_user?(%{data: %{"listMessage" => _}}, nil), do: false | |||
def visible_for_user?(%Activity{data: %{"listMessage" => _}}, nil), do: false | |||
def visible_for_user?(%{data: %{"listMessage" => list_ap_id}} = activity, %User{} = user) do | |||
def visible_for_user?( | |||
%Activity{data: %{"listMessage" => list_ap_id}} = activity, | |||
%User{} = user | |||
) do | |||
user.ap_id in activity.data["to"] || | |||
list_ap_id | |||
|> Pleroma.List.get_by_ap_id() | |||
|> Pleroma.List.member?(user) | |||
end | |||
def visible_for_user?(%{local: local} = activity, nil) do | |||
cfg_key = if local, do: :local, else: :remote | |||
if Pleroma.Config.restrict_unauthenticated_access?(:activities, cfg_key), | |||
def visible_for_user?(%Activity{} = activity, nil) do | |||
if restrict_unauthenticated_access?(activity), | |||
do: false, | |||
else: is_public?(activity) | |||
end | |||
def visible_for_user?(activity, user) do | |||
def visible_for_user?(%Activity{} = activity, user) do | |||
x = [user.ap_id | User.following(user)] | |||
y = [activity.actor] ++ activity.data["to"] ++ (activity.data["cc"] || []) | |||
is_public?(activity) || Enum.any?(x, &(&1 in y)) | |||
@@ -82,6 +83,26 @@ defmodule Pleroma.Web.ActivityPub.Visibility do | |||
result | |||
end | |||
def restrict_unauthenticated_access?(%Activity{local: local}) do | |||
restrict_unauthenticated_access_to_activity?(local) | |||
end | |||
def restrict_unauthenticated_access?(%Object{} = object) do | |||
object | |||
|> Object.local?() | |||
|> restrict_unauthenticated_access_to_activity?() | |||
end | |||
def restrict_unauthenticated_access?(%User{} = user) do | |||
User.visible_for(user, _reading_user = nil) | |||
end | |||
defp restrict_unauthenticated_access_to_activity?(local?) when is_boolean(local?) do | |||
cfg_key = if local?, do: :local, else: :remote | |||
Pleroma.Config.restrict_unauthenticated_access?(:activities, cfg_key) | |||
end | |||
def get_visibility(object) do | |||
to = object.data["to"] || [] | |||
cc = object.data["cc"] || [] | |||
@@ -10,14 +10,14 @@ defmodule Pleroma.Web.Feed.TagController do | |||
alias Pleroma.Web.Feed.FeedView | |||
def feed(conn, params) do | |||
unless Pleroma.Config.restrict_unauthenticated_access?(:activities, :local) do | |||
if Config.get!([:instance, :public]) do | |||
render_feed(conn, params) | |||
else | |||
render_error(conn, :not_found, "Not found") | |||
end | |||
end | |||
def render_feed(conn, %{"tag" => raw_tag} = params) do | |||
defp render_feed(conn, %{"tag" => raw_tag} = params) do | |||
{format, tag} = parse_tag(raw_tag) | |||
activities = | |||
@@ -36,12 +36,13 @@ defmodule Pleroma.Web.Feed.TagController do | |||
end | |||
@spec parse_tag(binary() | any()) :: {format :: String.t(), tag :: String.t()} | |||
defp parse_tag(raw_tag) when is_binary(raw_tag) do | |||
case Enum.reverse(String.split(raw_tag, ".")) do | |||
[format | tag] when format in ["atom", "rss"] -> {format, Enum.join(tag, ".")} | |||
_ -> {"rss", raw_tag} | |||
defp parse_tag(raw_tag) do | |||
case is_binary(raw_tag) && Enum.reverse(String.split(raw_tag, ".")) do | |||
[format | tag] when format in ["rss", "atom"] -> | |||
{format, Enum.join(tag, ".")} | |||
_ -> | |||
{"atom", raw_tag} | |||
end | |||
end | |||
defp parse_tag(raw_tag), do: {"rss", raw_tag} | |||
end |
@@ -5,6 +5,7 @@ | |||
defmodule Pleroma.Web.Feed.UserController do | |||
use Pleroma.Web, :controller | |||
alias Pleroma.Config | |||
alias Pleroma.User | |||
alias Pleroma.Web.ActivityPub.ActivityPub | |||
alias Pleroma.Web.ActivityPub.ActivityPubController | |||
@@ -22,12 +23,7 @@ defmodule Pleroma.Web.Feed.UserController do | |||
def feed_redirect(%{assigns: %{format: format}} = conn, _params) | |||
when format in ["json", "activity+json"] do | |||
with %{halted: false} = conn <- | |||
Pleroma.Web.Plugs.EnsureAuthenticatedPlug.call(conn, | |||
unless_func: &Pleroma.Web.Plugs.FederatingPlug.federating?/1 | |||
) do | |||
ActivityPubController.call(conn, :user) | |||
end | |||
ActivityPubController.call(conn, :user) | |||
end | |||
def feed_redirect(conn, %{"nickname" => nickname}) do | |||
@@ -36,25 +32,18 @@ defmodule Pleroma.Web.Feed.UserController do | |||
end | |||
end | |||
def feed(conn, params) do | |||
unless Pleroma.Config.restrict_unauthenticated_access?(:profiles, :local) do | |||
render_feed(conn, params) | |||
else | |||
errors(conn, {:error, :not_found}) | |||
end | |||
end | |||
def render_feed(conn, %{"nickname" => nickname} = params) do | |||
def feed(conn, %{"nickname" => nickname} = params) do | |||
format = get_format(conn) | |||
format = | |||
if format in ["rss", "atom"] do | |||
if format in ["atom", "rss"] do | |||
format | |||
else | |||
"atom" | |||
end | |||
with {_, %User{local: true} = user} <- {:fetch_user, User.get_cached_by_nickname(nickname)} do | |||
with {_, %User{local: true} = user} <- {:fetch_user, User.get_cached_by_nickname(nickname)}, | |||
{_, :visible} <- {:visibility, User.visible_for(user, _reading_user = nil)} do | |||
activities = | |||
%{ | |||
type: ["Create"], | |||
@@ -69,7 +58,7 @@ defmodule Pleroma.Web.Feed.UserController do | |||
|> render("user.#{format}", | |||
user: user, | |||
activities: activities, | |||
feed_config: Pleroma.Config.get([:feed]) | |||
feed_config: Config.get([:feed]) | |||
) | |||
end | |||
end | |||
@@ -81,6 +70,8 @@ defmodule Pleroma.Web.Feed.UserController do | |||
def errors(conn, {:fetch_user, %User{local: false}}), do: errors(conn, {:error, :not_found}) | |||
def errors(conn, {:fetch_user, nil}), do: errors(conn, {:error, :not_found}) | |||
def errors(conn, {:visibility, _}), do: errors(conn, {:error, :not_found}) | |||
def errors(conn, _) do | |||
render_error(conn, :internal_server_error, "Something went wrong") | |||
end | |||
@@ -16,10 +16,6 @@ defmodule Pleroma.Web.OStatus.OStatusController do | |||
alias Pleroma.Web.Plugs.RateLimiter | |||
alias Pleroma.Web.Router | |||
plug(Pleroma.Web.Plugs.EnsureAuthenticatedPlug, | |||
unless_func: &Pleroma.Web.Plugs.FederatingPlug.federating?/1 | |||
) | |||
plug( | |||
RateLimiter, | |||
[name: :ap_routes, params: ["uuid"]] when action in [:object, :activity] | |||
@@ -37,14 +33,12 @@ defmodule Pleroma.Web.OStatus.OStatusController do | |||
ActivityPubController.call(conn, :object) | |||
end | |||
def object(%{assigns: %{format: format}} = conn, _params) do | |||
def object(conn, _params) do | |||
with id <- Endpoint.url() <> conn.request_path, | |||
{_, %Activity{} = activity} <- | |||
{:activity, Activity.get_create_by_object_ap_id_with_object(id)}, | |||
{_, true} <- {:public?, Visibility.is_public?(activity)} do | |||
case format do | |||
_ -> redirect(conn, to: "/notice/#{activity.id}") | |||
end | |||
redirect(conn, to: "/notice/#{activity.id}") | |||
else | |||
reason when reason in [{:public?, false}, {:activity, nil}] -> | |||
{:error, :not_found} | |||
@@ -59,13 +53,11 @@ defmodule Pleroma.Web.OStatus.OStatusController do | |||
ActivityPubController.call(conn, :activity) | |||
end | |||
def activity(%{assigns: %{format: format}} = conn, _params) do | |||
def activity(conn, _params) do | |||
with id <- Endpoint.url() <> conn.request_path, | |||
{_, %Activity{} = activity} <- {:activity, Activity.normalize(id)}, | |||
{_, true} <- {:public?, Visibility.is_public?(activity)} do | |||
case format do | |||
_ -> redirect(conn, to: "/notice/#{activity.id}") | |||
end | |||
redirect(conn, to: "/notice/#{activity.id}") | |||
else | |||
reason when reason in [{:public?, false}, {:activity, nil}] -> | |||
{:error, :not_found} | |||
@@ -119,6 +111,7 @@ defmodule Pleroma.Web.OStatus.OStatusController do | |||
def notice_player(conn, %{"id" => id}) do | |||
with %Activity{data: %{"type" => "Create"}} = activity <- Activity.get_by_id_with_object(id), | |||
true <- Visibility.is_public?(activity), | |||
{_, true} <- {:visible?, Visibility.visible_for_user?(activity, _reading_user = nil)}, | |||
%Object{} = object <- Object.normalize(activity), | |||
%{data: %{"attachment" => [%{"url" => [url | _]} | _]}} <- object, | |||
true <- String.starts_with?(url["mediaType"], ["audio", "video"]) do | |||
@@ -5,6 +5,26 @@ | |||
defmodule Pleroma.Web.Router do | |||
use Pleroma.Web, :router | |||
pipeline :accepts_html do | |||
plug(:accepts, ["html"]) | |||
end | |||
pipeline :accepts_html_xml do | |||
plug(:accepts, ["html", "xml", "rss", "atom"]) | |||
end | |||
pipeline :accepts_html_json do | |||
plug(:accepts, ["html", "activity+json", "json"]) | |||
end | |||
pipeline :accepts_html_xml_json do | |||
plug(:accepts, ["html", "xml", "rss", "atom", "activity+json", "json"]) | |||
end | |||
pipeline :accepts_xml_rss_atom do | |||
plug(:accepts, ["xml", "rss", "atom"]) | |||
end | |||
pipeline :browser do | |||
plug(:accepts, ["html"]) | |||
plug(:fetch_session) | |||
@@ -566,30 +586,43 @@ defmodule Pleroma.Web.Router do | |||
) | |||
end | |||
pipeline :ostatus do | |||
plug(:accepts, ["html", "xml", "rss", "atom", "activity+json", "json"]) | |||
plug(Pleroma.Web.Plugs.StaticFEPlug) | |||
end | |||
pipeline :oembed do | |||
plug(:accepts, ["json", "xml"]) | |||
end | |||
scope "/", Pleroma.Web do | |||
pipe_through([:ostatus, :http_signature]) | |||
# Note: html format is supported only if static FE is enabled | |||
# Note: http signature is only considered for json requests (no auth for non-json requests) | |||
pipe_through([:accepts_html_json, :http_signature, Pleroma.Web.Plugs.StaticFEPlug]) | |||
get("/objects/:uuid", OStatus.OStatusController, :object) | |||
get("/activities/:uuid", OStatus.OStatusController, :activity) | |||
get("/notice/:id", OStatus.OStatusController, :notice) | |||
get("/notice/:id/embed_player", OStatus.OStatusController, :notice_player) | |||
# Mastodon compatibility routes | |||
get("/users/:nickname/statuses/:id", OStatus.OStatusController, :object) | |||
get("/users/:nickname/statuses/:id/activity", OStatus.OStatusController, :activity) | |||
end | |||
get("/users/:nickname/feed", Feed.UserController, :feed, as: :user_feed) | |||
scope "/", Pleroma.Web do | |||
# Note: html format is supported only if static FE is enabled | |||
# Note: http signature is only considered for json requests (no auth for non-json requests) | |||
pipe_through([:accepts_html_xml_json, :http_signature, Pleroma.Web.Plugs.StaticFEPlug]) | |||
# Note: returns user _profile_ for json requests, redirects to user _feed_ for non-json ones | |||
get("/users/:nickname", Feed.UserController, :feed_redirect, as: :user_feed) | |||
end | |||
scope "/", Pleroma.Web do | |||
# Note: html format is supported only if static FE is enabled | |||
pipe_through([:accepts_html_xml, Pleroma.Web.Plugs.StaticFEPlug]) | |||
get("/users/:nickname/feed", Feed.UserController, :feed, as: :user_feed) | |||
end | |||
scope "/", Pleroma.Web do | |||
pipe_through(:accepts_html) | |||
get("/notice/:id/embed_player", OStatus.OStatusController, :notice_player) | |||
end | |||
scope "/", Pleroma.Web do | |||
pipe_through(:accepts_xml_rss_atom) | |||
get("/tags/:tag", Feed.TagController, :feed, as: :tag_feed) | |||
end | |||
@@ -17,74 +17,14 @@ defmodule Pleroma.Web.StaticFE.StaticFEController do | |||
plug(:put_view, Pleroma.Web.StaticFE.StaticFEView) | |||
plug(:assign_id) | |||
plug(Pleroma.Web.Plugs.EnsureAuthenticatedPlug, | |||
unless_func: &Pleroma.Web.Plugs.FederatingPlug.federating?/1 | |||
) | |||
@page_keys ["max_id", "min_id", "limit", "since_id", "order"] | |||
defp get_title(%Object{data: %{"name" => name}}) when is_binary(name), | |||
do: name | |||
defp get_title(%Object{data: %{"summary" => summary}}) when is_binary(summary), | |||
do: summary | |||
defp get_title(_), do: nil | |||
defp not_found(conn, message) do | |||
conn | |||
|> put_status(404) | |||
|> render("error.html", %{message: message, meta: ""}) | |||
end | |||
defp get_counts(%Activity{} = activity) do | |||
%Object{data: data} = Object.normalize(activity) | |||
%{ | |||
likes: data["like_count"] || 0, | |||
replies: data["repliesCount"] || 0, | |||
announces: data["announcement_count"] || 0 | |||
} | |||
end | |||
defp represent(%Activity{} = activity), do: represent(activity, false) | |||
defp represent(%Activity{object: %Object{data: data}} = activity, selected) do | |||
{:ok, user} = User.get_or_fetch(activity.object.data["actor"]) | |||
link = | |||
case user.local do | |||
true -> Helpers.o_status_url(Pleroma.Web.Endpoint, :notice, activity) | |||
_ -> data["url"] || data["external_url"] || data["id"] | |||
end | |||
content = | |||
if data["content"] do | |||
data["content"] | |||
|> Pleroma.HTML.filter_tags() | |||
|> Pleroma.Emoji.Formatter.emojify(Map.get(data, "emoji", %{})) | |||
else | |||
nil | |||
end | |||
%{ | |||
user: User.sanitize_html(user), | |||
title: get_title(activity.object), | |||
content: content, | |||
attachment: data["attachment"], | |||
link: link, | |||
published: data["published"], | |||
sensitive: data["sensitive"], | |||
selected: selected, | |||
counts: get_counts(activity), | |||
id: activity.id | |||
} | |||
end | |||
@doc "Renders requested local public activity or public activities of requested user" | |||
def show(%{assigns: %{notice_id: notice_id}} = conn, _params) do | |||
with %Activity{local: true} = activity <- | |||
Activity.get_by_id_with_object(notice_id), | |||
true <- Visibility.is_public?(activity.object), | |||
{_, true} <- {:visible?, Visibility.visible_for_user?(activity, _reading_user = nil)}, | |||
%User{} = user <- User.get_by_ap_id(activity.object.data["actor"]) do | |||
meta = Metadata.build_tags(%{activity_id: notice_id, object: activity.object, user: user}) | |||
@@ -107,34 +47,35 @@ defmodule Pleroma.Web.StaticFE.StaticFEController do | |||
end | |||
def show(%{assigns: %{username_or_id: username_or_id}} = conn, params) do | |||
case User.get_cached_by_nickname_or_id(username_or_id) do | |||
%User{} = user -> | |||
meta = Metadata.build_tags(%{user: user}) | |||
params = | |||
params | |||
|> Map.take(@page_keys) | |||
|> Map.new(fn {k, v} -> {String.to_existing_atom(k), v} end) | |||
timeline = | |||
user | |||
|> ActivityPub.fetch_user_activities(nil, params) | |||
|> Enum.map(&represent/1) | |||
prev_page_id = | |||
(params["min_id"] || params["max_id"]) && | |||
List.first(timeline) && List.first(timeline).id | |||
next_page_id = List.last(timeline) && List.last(timeline).id | |||
render(conn, "profile.html", %{ | |||
user: User.sanitize_html(user), | |||
timeline: timeline, | |||
prev_page_id: prev_page_id, | |||
next_page_id: next_page_id, | |||
meta: meta | |||
}) | |||
with {_, %User{local: true} = user} <- | |||
{:fetch_user, User.get_cached_by_nickname_or_id(username_or_id)}, | |||
{_, :visible} <- {:visibility, User.visible_for(user, _reading_user = nil)} do | |||
meta = Metadata.build_tags(%{user: user}) | |||
params = | |||
params | |||
|> Map.take(@page_keys) | |||
|> Map.new(fn {k, v} -> {String.to_existing_atom(k), v} end) | |||
timeline = | |||
user | |||
|> ActivityPub.fetch_user_activities(_reading_user = nil, params) | |||
|> Enum.map(&represent/1) | |||
prev_page_id = | |||
(params["min_id"] || params["max_id"]) && | |||
List.first(timeline) && List.first(timeline).id | |||
next_page_id = List.last(timeline) && List.last(timeline).id | |||
render(conn, "profile.html", %{ | |||
user: User.sanitize_html(user), | |||
timeline: timeline, | |||
prev_page_id: prev_page_id, | |||
next_page_id: next_page_id, | |||
meta: meta | |||
}) | |||
else | |||
_ -> | |||
not_found(conn, "User not found.") | |||
end | |||
@@ -166,6 +107,64 @@ defmodule Pleroma.Web.StaticFE.StaticFEController do | |||
end | |||
end | |||
defp get_title(%Object{data: %{"name" => name}}) when is_binary(name), | |||
do: name | |||
defp get_title(%Object{data: %{"summary" => summary}}) when is_binary(summary), | |||
do: summary | |||
defp get_title(_), do: nil | |||
defp not_found(conn, message) do | |||
conn | |||
|> put_status(404) | |||
|> render("error.html", %{message: message, meta: ""}) | |||
end | |||
defp get_counts(%Activity{} = activity) do | |||
%Object{data: data} = Object.normalize(activity) | |||
%{ | |||
likes: data["like_count"] || 0, | |||
replies: data["repliesCount"] || 0, | |||
announces: data["announcement_count"] || 0 | |||
} | |||
end | |||
defp represent(%Activity{} = activity), do: represent(activity, false) | |||
defp represent(%Activity{object: %Object{data: data}} = activity, selected) do | |||
{:ok, user} = User.get_or_fetch(activity.object.data["actor"]) | |||
link = | |||
case user.local do | |||
true -> Helpers.o_status_url(Pleroma.Web.Endpoint, :notice, activity) | |||
_ -> data["url"] || data["external_url"] || data["id"] | |||
end | |||
content = | |||
if data["content"] do | |||
data["content"] | |||
|> Pleroma.HTML.filter_tags() | |||
|> Pleroma.Emoji.Formatter.emojify(Map.get(data, "emoji", %{})) | |||
else | |||
nil | |||
end | |||
%{ | |||
user: User.sanitize_html(user), | |||
title: get_title(activity.object), | |||
content: content, | |||
attachment: data["attachment"], | |||
link: link, | |||
published: data["published"], | |||
sensitive: data["sensitive"], | |||
selected: selected, | |||
counts: get_counts(activity), | |||
id: activity.id | |||
} | |||
end | |||
defp assign_id(%{path_info: ["notice", notice_id]} = conn, _opts), | |||
do: assign(conn, :notice_id, notice_id) | |||
@@ -156,21 +156,6 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do | |||
assert response == "Not found" | |||
end | |||
test "it requires authentication if instance is NOT federating", %{ | |||
conn: conn | |||
} do | |||
user = insert(:user) | |||
conn = | |||
put_req_header( | |||
conn, | |||
"accept", | |||
"application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"" | |||
) | |||
ensure_federating_or_authenticated(conn, "/users/#{user.nickname}.json", user) | |||
end | |||
end | |||
describe "mastodon compatibility routes" do | |||
@@ -338,18 +323,6 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do | |||
assert "Not found" == json_response(conn2, :not_found) | |||
end | |||
test "it requires authentication if instance is NOT federating", %{ | |||
conn: conn | |||
} do | |||
user = insert(:user) | |||
note = insert(:note) | |||
uuid = String.split(note.data["id"], "/") |> List.last() | |||
conn = put_req_header(conn, "accept", "application/activity+json") | |||
ensure_federating_or_authenticated(conn, "/objects/#{uuid}", user) | |||
end | |||
end | |||
describe "/activities/:uuid" do | |||
@@ -421,18 +394,6 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do | |||
assert "Not found" == json_response(conn2, :not_found) | |||
end | |||
test "it requires authentication if instance is NOT federating", %{ | |||
conn: conn | |||
} do | |||
user = insert(:user) | |||
activity = insert(:note_activity) | |||
uuid = String.split(activity.data["id"], "/") |> List.last() | |||
conn = put_req_header(conn, "accept", "application/activity+json") | |||
ensure_federating_or_authenticated(conn, "/activities/#{uuid}", user) | |||
end | |||
end | |||
describe "/inbox" do | |||
@@ -893,15 +854,6 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do | |||
assert response(conn, 200) =~ announce_activity.data["object"] | |||
end | |||
test "it requires authentication if instance is NOT federating", %{ | |||
conn: conn | |||
} do | |||
user = insert(:user) | |||
conn = put_req_header(conn, "accept", "application/activity+json") | |||
ensure_federating_or_authenticated(conn, "/users/#{user.nickname}/outbox", user) | |||
end | |||
end | |||
describe "POST /users/:nickname/outbox (C2S)" do | |||
@@ -8,6 +8,7 @@ defmodule Pleroma.Web.Feed.TagControllerTest do | |||
import Pleroma.Factory | |||
import SweetXml | |||
alias Pleroma.Config | |||
alias Pleroma.Object | |||
alias Pleroma.Web.CommonAPI | |||
alias Pleroma.Web.Feed.FeedView | |||
@@ -15,7 +16,7 @@ defmodule Pleroma.Web.Feed.TagControllerTest do | |||
setup do: clear_config([:feed]) | |||
test "gets a feed (ATOM)", %{conn: conn} do | |||
Pleroma.Config.put( | |||
Config.put( | |||
[:feed, :post_title], | |||
%{max_length: 25, omission: "..."} | |||
) | |||
@@ -82,7 +83,7 @@ defmodule Pleroma.Web.Feed.TagControllerTest do | |||
end | |||
test "gets a feed (RSS)", %{conn: conn} do | |||
Pleroma.Config.put( | |||
Config.put( | |||
[:feed, :post_title], | |||
%{max_length: 25, omission: "..."} | |||
) | |||
@@ -157,7 +158,7 @@ defmodule Pleroma.Web.Feed.TagControllerTest do | |||
response = | |||
conn | |||
|> put_req_header("accept", "application/rss+xml") | |||
|> get(tag_feed_path(conn, :feed, "pleromaart")) | |||
|> get(tag_feed_path(conn, :feed, "pleromaart.rss")) | |||
|> response(200) | |||
xml = parse(response) | |||
@@ -183,14 +184,12 @@ defmodule Pleroma.Web.Feed.TagControllerTest do | |||
end | |||
describe "private instance" do | |||
setup do: clear_config([:instance, :public]) | |||
setup do: clear_config([:instance, :public], false) | |||
test "returns 404 for tags feed", %{conn: conn} do | |||
Config.put([:instance, :public], false) | |||
conn | |||
|> put_req_header("accept", "application/rss+xml") | |||
|> get(tag_feed_path(conn, :feed, "pleromaart")) | |||
|> get(tag_feed_path(conn, :feed, "pleromaart.rss")) | |||
|> response(404) | |||
end | |||
end | |||
@@ -13,7 +13,7 @@ defmodule Pleroma.Web.Feed.UserControllerTest do | |||
alias Pleroma.User | |||
alias Pleroma.Web.CommonAPI | |||
setup do: clear_config([:instance, :federating], true) | |||
setup do: clear_config([:static_fe, :enabled], false) | |||
describe "feed" do | |||
setup do: clear_config([:feed]) | |||
@@ -192,6 +192,16 @@ defmodule Pleroma.Web.Feed.UserControllerTest do | |||
|> get(user_feed_path(conn, :feed, user.nickname)) | |||
|> response(404) | |||
end | |||
test "does not require authentication on non-federating instances", %{conn: conn} do | |||
clear_config([:instance, :federating], false) | |||
user = insert(:user) | |||
conn | |||
|> put_req_header("accept", "application/rss+xml") | |||
|> get("/users/#{user.nickname}/feed.rss") | |||
|> response(200) | |||
end | |||
end | |||
# Note: see ActivityPubControllerTest for JSON format tests | |||
@@ -7,7 +7,6 @@ defmodule Pleroma.Web.OStatus.OStatusControllerTest do | |||
import Pleroma.Factory | |||
alias Pleroma.Config | |||
alias Pleroma.Object | |||
alias Pleroma.User | |||
alias Pleroma.Web.ActivityPub.ActivityPub | |||
@@ -21,7 +20,7 @@ defmodule Pleroma.Web.OStatus.OStatusControllerTest do | |||
:ok | |||
end | |||
setup do: clear_config([:instance, :federating], true) | |||
setup do: clear_config([:static_fe, :enabled], false) | |||
describe "Mastodon compatibility routes" do | |||
setup %{conn: conn} do | |||
@@ -215,15 +214,16 @@ defmodule Pleroma.Web.OStatus.OStatusControllerTest do | |||
assert response(conn, 404) | |||
end | |||
test "it requires authentication if instance is NOT federating", %{ | |||
test "does not require authentication on non-federating instances", %{ | |||
conn: conn | |||
} do | |||
user = insert(:user) | |||
clear_config([:instance, :federating], false) | |||
note_activity = insert(:note_activity) | |||
conn = put_req_header(conn, "accept", "text/html") | |||
ensure_federating_or_authenticated(conn, "/notice/#{note_activity.id}", user) | |||
conn | |||
|> put_req_header("accept", "text/html") | |||
|> get("/notice/#{note_activity.id}") | |||
|> response(200) | |||
end | |||
end | |||
@@ -325,14 +325,16 @@ defmodule Pleroma.Web.OStatus.OStatusControllerTest do | |||
|> response(404) | |||
end | |||
test "it requires authentication if instance is NOT federating", %{ | |||
test "does not require authentication on non-federating instances", %{ | |||
conn: conn, | |||
note_activity: note_activity | |||
} do | |||
user = insert(:user) | |||
conn = put_req_header(conn, "accept", "text/html") | |||
clear_config([:instance, :federating], false) | |||
ensure_federating_or_authenticated(conn, "/notice/#{note_activity.id}/embed_player", user) | |||
conn | |||
|> put_req_header("accept", "text/html") | |||
|> get("/notice/#{note_activity.id}/embed_player") | |||
|> response(200) | |||
end | |||
end | |||
end |
@@ -6,14 +6,12 @@ defmodule Pleroma.Web.StaticFE.StaticFEControllerTest do | |||
use Pleroma.Web.ConnCase | |||
alias Pleroma.Activity | |||
alias Pleroma.Config | |||
alias Pleroma.Web.ActivityPub.Transmogrifier | |||
alias Pleroma.Web.CommonAPI | |||
import Pleroma.Factory | |||
setup_all do: clear_config([:static_fe, :enabled], true) | |||
setup do: clear_config([:instance, :federating], true) | |||
setup %{conn: conn} do | |||
conn = put_req_header(conn, "accept", "text/html") | |||
@@ -74,8 +72,27 @@ defmodule Pleroma.Web.StaticFE.StaticFEControllerTest do | |||
refute html =~ ">test29<" | |||
end | |||
test "it requires authentication if instance is NOT federating", %{conn: conn, user: user} do | |||
ensure_federating_or_authenticated(conn, "/users/#{user.nickname}", user) | |||
test "does not require authentication on non-federating instances", %{ | |||
conn: conn, | |||
user: user | |||
} do | |||
clear_config([:instance, :federating], false) | |||
conn = get(conn, "/users/#{user.nickname}") | |||
assert html_response(conn, 200) =~ user.nickname | |||
end | |||
test "returns 404 for local user with `restrict_unauthenticated/profiles/local` setting", %{ | |||
conn: conn | |||
} do | |||
clear_config([:restrict_unauthenticated, :profiles, :local], true) | |||
local_user = insert(:user, local: true) | |||
conn | |||
|> get("/users/#{local_user.nickname}") | |||
|> html_response(404) | |||
end | |||
end | |||
@@ -187,10 +204,28 @@ defmodule Pleroma.Web.StaticFE.StaticFEControllerTest do | |||
assert html_response(conn, 302) =~ "redirected" | |||
end | |||
test "it requires authentication if instance is NOT federating", %{conn: conn, user: user} do | |||
test "does not require authentication on non-federating instances", %{ | |||
conn: conn, | |||
user: user | |||
} do | |||
clear_config([:instance, :federating], false) | |||
{:ok, activity} = CommonAPI.post(user, %{status: "testing a thing!"}) | |||
conn = get(conn, "/notice/#{activity.id}") | |||
assert html_response(conn, 200) =~ "testing a thing!" | |||
end | |||
test "returns 404 for local public activity with `restrict_unauthenticated/activities/local` setting", | |||
%{conn: conn, user: user} do | |||
clear_config([:restrict_unauthenticated, :activities, :local], true) | |||
{:ok, activity} = CommonAPI.post(user, %{status: "testing a thing!"}) | |||
ensure_federating_or_authenticated(conn, "/notice/#{activity.id}", user) | |||
conn | |||
|> get("/notice/#{activity.id}") | |||
|> html_response(404) | |||
end | |||
end | |||
end |
@@ -112,28 +112,6 @@ defmodule Pleroma.Web.ConnCase do | |||
defp json_response_and_validate_schema(conn, _status) do | |||
flunk("Response schema not found for #{conn.method} #{conn.request_path} #{conn.status}") | |||
end | |||
defp ensure_federating_or_authenticated(conn, url, user) do | |||
initial_setting = Config.get([:instance, :federating]) | |||
on_exit(fn -> Config.put([:instance, :federating], initial_setting) end) | |||
Config.put([:instance, :federating], false) | |||
conn | |||
|> get(url) | |||
|> response(403) | |||
conn | |||
|> assign(:user, user) | |||
|> get(url) | |||
|> response(200) | |||
Config.put([:instance, :federating], true) | |||
conn | |||
|> get(url) | |||
|> response(200) | |||
end | |||
end | |||
end | |||