Commit Graph

475 Commits

Author SHA1 Message Date
fdb-hiroshima
7c8599b0a2
Disallow interaction with medias owned by others (#410)
Notably prevent media deletion by other users
2019-01-05 22:09:57 +01:00
fdb-hiroshima
2896eb1705
Fix login issue (#401)
Regression introduced by 4059a840be
2018-12-31 11:45:59 +01:00
Baptiste Gelez
80a4dae8bd
Avoid panics (#392)
- Use `Result` as much as possible
- Display errors instead of panicking

TODO (maybe in another PR? this one is already quite big):
- Find a way to merge Ructe/ErrorPage types, so that we can have routes returning `Result<X, ErrorPage>` instead of panicking when we have an `Error`
- Display more details about the error, to make it easier to debug

(sorry, this isn't going to be fun to review, the diff is huge, but it is always the same changes)
2018-12-29 09:36:07 +01:00
fdb-hiroshima
ccba485215
Trim email and username (#386)
Also forbid whitespaces in username
Fix #385
2018-12-25 18:00:21 +01:00
Baptiste Gelez
4ec2480f50
Post creation API (#307) 2018-12-24 16:42:40 +01:00
fdb-hiroshima
fdfeeed6d9 Comment visibility (#364)
Add some support for comment visibility, fix #217 

This add a new column to comment, denoting if they are public or not, and a new table linking private comments to those allowed to read them. There is currently no way to write a private comment from Plume.
Git is having a hard time what happened in Comment::from_activity, but most of it is just re-indentation because a new block was needed to please the borrow checker. I've marked with comments where things actually changed.
At this point only mentioned users can see private comments, even when posted as "follower only" or equivalent.

What should we do when someone isn't allowed to see a comment? Hide the whole thread, or just the comment? If hiding just the comment, should we mark there is a comment one can't see, but answers they can, or put other comments like if they answered to the same comment the hidden one do?
2018-12-24 11:23:04 +01:00
fdb-hiroshima
5c5cf36b0d
Allow for comment deletion (#363)
* Allow for comment deletion

Receive and emit deletion activity
Add button to delete comment

* Remove debug print and fix copy-past typo

* Improve style of comment deletion button
2018-12-23 11:13:36 +01:00
fdb-hiroshima
0df9c4d400
Give reshare and like ap_url before inserting (#369)
Fix #367
2018-12-23 11:13:02 +01:00
fdb-hiroshima
0ea1d57e48
Fix some federation issues (#357)
* Fix some follow issues

Fix not receiving notifications when followed by remote users
Fix imposibility to be unfollowed by Mastodon/Pleroma users (tested only against Pleroma)

* Fix notification on every post

* Fix issues with federation

Send Link instead of Object when emiting Follow request
Receive both Link and Object for Follow request
Don't panic when fetching user with no followers or posts from Pleroma
Reorder follower routes so Activity Pub one is reachable

* Generate absolute urls for mentions and tags

* Verify author when undoing activity by Link
2018-12-23 11:12:15 +01:00
fdb-hiroshima
ab2998e214
Make Plume compile on release (#365)
* Remove use of String for body parameters

Create SignedJson and implement FromData for it

* Make Travis test on release

* Remove warning when installing and fix coverage
2018-12-22 18:27:21 +01:00
Baptiste Gelez
38302203f4
Count items in database as much as possible (#344)
* Count items in database as much as possible

* Fix the tests

* Remove two useless queries

* Run pragma directive before each sqlite connection

* Pragma for tests too

* Remove debug messages
2018-12-14 23:16:18 +01:00
Baptiste Gelez
b0089e59b7
Remove useless pagination routes (#351)
Rocket 0.4 let us have routes with optional query parameter
2018-12-13 22:20:19 +01:00
Trinity Pointard
fcbaf6eee3 Allow to keep query params in paginate
Fix #349
2018-12-12 00:52:26 +01:00
Baptiste Gelez
b73fbd3768
License federation (#343)
* Federate license

* Make it possible to use no license
2018-12-09 18:43:34 +01:00
fdb-hiroshima
e9f2f769be Add microformat tags (#341)
Close #229 
Adding `<div>` might have broken the layout in some places. I've tried to fix it, tell me if I missed it somewhere
2018-12-08 21:52:46 +01:00
fdb-hiroshima
e1ecc7289f
Upgrade plume dependencies (#332)
* Bump base64 from 0.9.3 to 0.10.0
* Bump bcrypt from 0.2.0 to 0.2.1
* Bump canapi from 0.1.0 to 0.2.0
* Bump failure from 0.1.2 to 0.1.3
* Bump hyper from 0.11.27 to 0.12.11
* Bump hyper from 0.11.27 to 0.12.16
* Bump lazy_static from 1.1.0 to 1.2.0
* Bump multipart from 0.15.3 to 0.15.4
* Bump openssl from 0.10.12 to 0.10.15
* Bump pulldown-cmark from 0.1.2 to 0.2.0
* Bump reqwest from 0.9.2 to 0.9.5
* Bump rocket from 0.4.0-rc.1 to 0.4.0
* Bump rpassword from 2.0.0 to 2.1.0
* Bump ructe from 0.5.2 to 0.5.4
* Bump serde_derive from 1.0.79 to 1.0.80
* Bump serde from 1.0.79 to 1.0.80
* Bump serde_json from 1.0.32 to 1.0.33
* Bump tera from 0.11.17 to 0.11.20
* Bump url from 1.7.1 to 1.7.2
* Bump validator to from 0.7.2 to 0.8.0
* Bump validator_derive from 0.7.2 to 0.8.0
* Bump whatlang from 0.5.0 to 0.6.0
* Remove hyper from plume-common dependencies
* Remove rpassword from Plume dependancies
* Upgrade compiler to nightly-2018-12-06
2018-12-07 21:00:12 +01:00
Trinity Pointard
b4e4b497ee Works on template
Use uri! to generate links instead of hardcoded urls
Fix #110
Fix invalid links needing to be POST forms
Translate login message for boost and like directly from template
Put js for search in its own file
2018-12-07 12:10:03 +01:00
Baptiste Gelez
70af57c6e1
Use Ructe (#327)
All the template are now compiled at compile-time with the `ructe` crate.

I preferred to use it instead of askama because it allows more complex Rust expressions, where askama only supports a small subset of expressions and doesn't allow them everywhere (for instance, `{{ macro!() | filter }}` would result in a parsing error).

The diff is quite huge, but there is normally no changes in functionality.

Fixes #161 and unblocks #110 and #273
2018-12-06 18:54:16 +01:00
Trinity Pointard
5f059c3e98 Fix issues with tags and mentions
Fix issue where leading @ or # of a mention/hashtag get duplicated
Fix issue where normal tags were being overwritten by hashtags
2018-12-06 15:10:07 +01:00
fdb-hiroshima
449641d158
Add a search engine into Plume (#324)
* Add search engine to the model

Add a Tantivy based search engine to the model
Implement most required functions for it

* Implement indexing and plm subcommands

Implement indexation on insert, update and delete
Modify func args to get the indexer where required
Add subcommand to initialize, refill and unlock search db

* Move to a new threadpool engine allowing scheduling

* Autocommit search index every half an hour

* Implement front part of search

Add default fields for search
Add new routes and templates for search and result
Implement FromFormValue for Page to reuse it on search result pagination
Add optional query parameters to paginate template's macro
Update to newer rocket_csrf, don't get csrf token on GET forms

* Handle process termination to release lock

Handle process termination
Add tests to search

* Add proper support for advanced search

Add an advanced search form to /search, in template and route
Modify Tantivy schema, add new tokenizer for some properties
Create new String query parser
Create Tantivy query AST from our own

* Split search.rs, add comment and tests

Split search.rs into multiple submodules
Add comments and tests for Query
Make user@domain be treated as one could assume
2018-12-02 17:37:51 +01:00
Trinity Pointard
9714bafded Verify username for special characters on signup 2018-12-02 12:43:03 +01:00
fdb-hiroshima
74c398d60c
Run cargo clippy on whole project (#322)
* Run cargo clippy on plume-common

Run clippy on plume-common and adjuste code accordingly

* Run cargo clippy on plume-model

Run clippy on plume-model and adjuste code accordingly

* Reduce need for allocation in plume-common

* Reduce need for allocation in plume-model

add a quick compilation failure if no database backend is enabled

* Run cargo clippy on plume-cli

* Run cargo clippy on plume
2018-11-26 10:21:52 +01:00
fdb-hiroshima
8a4702df92 Add unit tests for main model parts (#310)
Add tests for following models:
- Blog
- Instance
- Media
- User
2018-11-24 12:44:17 +01:00
KokaKiwi
67fe28177e Decode unfollow activities in inbox properly (#316) 2018-11-23 13:17:37 +01:00
Baptiste Gelez
a64c4912cf
Add support for CW in comments (#308)
All the backend/federation code was already, I just added the UI 🤷‍♀️ 

Fixes #253
2018-11-07 15:57:31 +01:00
Baptiste Gelez
94904fa3d5 Escape titles in RSS feeds 2018-11-06 10:49:46 +01:00
Baptiste Gelez
f593ce40af Remove some debug messages 2018-10-31 15:07:40 +01:00
Baptiste Gelez
485aac2e20 Add an interface to select an article illustration 2018-10-31 15:07:40 +01:00
Baptiste Gelez
ab5edbc6a5 Add a cover field to posts
Referencing the media to use to illustrate the article
2018-10-31 15:07:40 +01:00
Baptiste Gelez
e26a150164 Make Authorization optional for read routes
Only require it when reading draft articles.
2018-10-30 18:13:49 +01:00
Baptiste Gelez
28fbf35779 Use PhantomData intead of two Options useless for Authorization
And remove some warnings about unused parameters
2018-10-30 18:13:49 +01:00
Baptiste Gelez
647a5af070 Make it impossible to know if an username is used or not with the API 2018-10-30 18:13:49 +01:00
Baptiste Gelez
31641b1ea1 New request guard: Authorization<Action, Scope>
Filter requests that don't have an API token authorized to read or write
a specific scope;
2018-10-30 18:13:49 +01:00
Baptiste Gelez
9a13d804c5 impl FromRequest for ApiToken
and use it for the posts API
2018-10-30 18:13:49 +01:00
Baptiste Gelez
663ec52fea Disable CSRF for the whole API 2018-10-30 18:13:49 +01:00
Baptiste Gelez
2394ff424b Add an ApiToken model, and an endpoint to get one 2018-10-30 18:13:49 +01:00
Baptiste Gelez
f2190adfc2 Add an API endpoint to register apps 2018-10-30 18:13:49 +01:00
Trinity Pointard
76ca76f068 Update tags and hashtags on remote post edition 2018-10-29 20:54:27 +01:00
Trinity Pointard
c4fc656809 Update mentions on remote post edition 2018-10-29 20:54:27 +01:00
Trinity Pointard
2523f3b523 Prevent duplication of mention on post update
and delete mentions and notifications of user no longer mentioned
2018-10-29 20:54:27 +01:00
Trinity Pointard
1689813df4 Deduplicate tags and mentions
Use set to work on tags and mentions, allowing deduplication of them,
and clearer code
May also help with distinguishing tags and hashtags latter
2018-10-29 20:54:27 +01:00
Trinity Pointard
0bb2e6293a Send Create activity when undrafting post
Send a Create activity when a post get undrafted, instead of sending an
	Update activity for a non federated post
Fix #221
2018-10-28 11:42:01 +01:00
Trinity Pointard
cbbd0ca920 Group post by 12 instead of 10
Fix #251
2018-10-28 11:26:24 +01:00
Baptiste Gelez
fcf911fac9 ActivityPub: don't delete anything if the actor is not authorized 2018-10-22 16:29:25 +01:00
Baptiste Gelez
fc5acac861
Merge pull request #283 from Plume-org/hashtags
Support hashtags
2018-10-21 13:53:15 +01:00
Trinity Pointard
95ea248518 Add support for hashtag on user interface
Add migration to fix typo
Add support for linking hashtags with posts
Rework tag search page so it says a nicer message than page not found
when no post use that tag
Add new string to translation
2018-10-20 19:27:49 +02:00
Trinity Pointard
4fa3a0f6ee Add support for hashtags in md parser 2018-10-20 16:38:16 +02:00
Trinity Pointard
eca458b0e5 Add support for blog deletion
fix #181
2018-10-20 15:03:59 +02:00
Trinity Pointard
a6e73f4667 Allow tag deletion
Fix #232
2018-10-20 14:05:41 +02:00
Trinity Pointard
fd92383f87 Normalize panic message and return 400 or 404 when suitable 2018-10-20 11:04:20 +02:00
Bat
9d70eeae61 Don't register the media serving route (they are now served with other static files)
And remove some unused imports
2018-10-12 20:48:11 +01:00
Bat
14969d489c Save medias in static/media
Fixes #272
2018-10-12 20:32:34 +01:00
Trinity Pointard
f9498828c4 Modify post slug only when it's still drafted
Fix #207
2018-10-11 14:23:23 +02:00
Baptiste Gelez
8fdb55a501
Merge pull request #256 from Plume-org/verify-signature
Verify activity's signature
2018-10-10 21:31:11 +01:00
Trinity Pointard
ba4695f490 Add support for signature verification on pseudo header
Add support for pseudo-header '(request-target)'
Add some logging for denied request
2018-10-10 21:10:43 +02:00
Bat
1b9c3f69bf Add icons to Web Manifest 2018-10-09 19:38:01 +01:00
Bat
3b7842d040 Rocket should manage DbConn, not Option<DbConn>
Otherwise it fails when using DbConn as a request guard
2018-10-08 20:02:17 +01:00
Baptiste Gelez
0469b8dae2
Merge pull request #266 from Plume-org/cc-by-sa
Change default license to CC-BY-SA
2018-10-07 21:28:43 +01:00
Baptiste Gelez
3a13d80dc6
Merge pull request #267 from Plume-org/db-url
Replace DB_URL with DATABASE_URL
2018-10-07 21:28:28 +01:00
Bat
9cc795d8be Replace DB_URL with DATABASE_URL
This way it is shared with diesel, which simplifies a lot the setup

Also fixes a few issues in the documentation, that are not directly related
2018-10-07 11:00:50 +01:00
Bat
915b9bb0e5 Use env!("CARGO_PKG_VERSION") instead of hardcoding version when possible
See https://doc.rust-lang.org/cargo/reference/environment-variables.html#environment-variables-cargo-sets-for-crates
2018-10-06 18:55:30 +01:00
Bat
387efbf3e9 Change default license to CC-BY-SA
Fixes #258
2018-10-06 18:19:45 +01:00
Baptiste Gelez
00fe11fcbb
Merge pull request #261 from Plume-org/setup-tools
CLI tools
2018-10-06 14:28:13 +01:00
Bat
478e9dcac9 Show your own posts in your feed
Fixes #213
2018-10-06 13:42:57 +01:00
Bat
4d382d8014 Fix compatibility with SQlite
Also fixes a bug in plume-models
2018-10-06 12:59:08 +01:00
Bat
5fa7a2a742 Remove legacy setup script 2018-10-06 12:31:00 +01:00
Baptiste Gelez
b464671cf0
Merge pull request #226 from igalic/feat/sqlite
Add SQLite as supported database
2018-10-06 12:15:00 +01:00
Trinity Pointard
3466e55548 Implement JSON-ld signature verification
Implement JSON-ld signature verification
Move signature verification functions to the proper file
2018-10-06 10:06:06 +02:00
Trinity Pointard
62c94ed463 Refactor and verify http signature on personnal inbox
Verify signature on personnal inbox
Reduce code duplication
Put Headers in plume-models
2018-10-03 20:48:25 +02:00
Trinity Pointard
0a5d435249 Verify http signatures 2018-10-03 09:31:38 +02:00
Trinity Pointard
d3ed2d8af5 Fix regression and update rocket_csrf
Fix account creation, introduced by fceb9ab
Update to latest rocket_csrf
2018-10-02 11:51:12 +02:00
Bat
07f2c979ec Make the REST API compatible with SQlite 2018-09-30 14:21:07 +01:00
Bat
743620eb6a
Fix the SQlite build 2018-09-30 14:13:56 +02:00
Trinity Pointard
fceb9ab0cd Update cookie management a bit
Update to latest rocket_csrf
Make user_id a samesite lax cookie (see https://github.com/Plume-org/Plume/issues/233#issuecomment-422660275)
2018-09-30 11:56:12 +02:00
Baptiste Gelez
236cf14406
Merge pull request #245 from Plume-org/rest-api
Some API endpoints for articles
2018-09-29 16:33:31 +01:00
Bat
72fd9eb610 API: Filter posts in the list 2018-09-29 15:45:27 +01:00
Bat
f893056d6d Mount the API endpoints 2018-09-25 20:45:32 +01:00
Bat
d8ca1d70b7 Fix CSRF issues
GET routes are not protected against CSRF. This commit changes the needed URLs to
POST and replace simple links with forms.

Thanks @fdb-hiroshima for noticing it!
2018-09-19 18:13:07 +01:00
Bat
1500267125 Add canapi and try to use for the API 2018-09-19 15:49:34 +01:00
Igor Galić
06718a5c8a
directly use SafeString in InstanceSettingsForm 2018-09-14 20:25:16 +02:00
Igor Galić
65e213309b
do not allocate empty strings
follow review from @pwoolcoc, and do not use

    SafeString::new(&<String>::new())

since this makes an allocation which will then just be thrown away.
Instead, we pass ""
2018-09-14 18:24:27 +02:00
Igor Galić
f5c299f23c
make blog/instance description a SafeString
long_description & short_description's documentation say they can be
Markdown, but they are String, not SafeString.

This led to escaped strings being printed in the editor
https://github.com/Plume-org/Plume/issues/220
2018-09-14 15:14:24 +02:00
Bat
0200a7b223 Only send notifications for mentions if the post is not a draft 2018-09-12 17:00:00 +01:00
Bat
b01212f4a6 Make it impossible to view drafts if you are not the author
Even if you got the URL
2018-09-12 16:58:38 +01:00
Bat
8fa83dfe25 Version bump
0.1.x was the pre-alpha.

The first Alpha will be 0.2.x
2018-09-11 19:53:14 +01:00
Baptiste Gelez
13ef50bb78
Merge pull request #212 from zcdunn/add_webapp_manifest
Add webapp manifest
2018-09-10 20:44:44 +01:00
Bat
10da8f31b6 Hide articles on public pages
Only show them in the dashboard
2018-09-10 20:06:00 +01:00
Zachary Dunn
8765b12229 Unwrap option 2018-09-10 14:54:18 -04:00
Bat
8879935925 Add the possibility to save an article as draft 2018-09-10 19:38:19 +01:00
Zachary Dunn
3a81dd7089 Add webapp manifest 2018-09-10 10:14:08 -04:00
Bat
de3707983a Account deletion
Fixes #182
2018-09-09 20:49:24 +01:00
Bat
54f6e7dfc6 Use a more classical flow for creating comments
Don't locally federate them anymore

It allows us to have them fetched later too
2018-09-09 16:08:53 +01:00
Bat
642884034d Fix build errors 2018-09-09 12:37:20 +01:00
Bat
08cb337df6 Broadcast activities to all known instances
We consider everything posted with Plume public (for the moment at least)
2018-09-09 12:19:11 +01:00
Bat
b4391b55f2 Fix panic because of invalid URL parsing when commenting 2018-09-09 11:53:22 +01:00
Bat
1f2bd105b6 Implement user ban 2018-09-09 11:25:55 +01:00
Bat
c0d0f98d1f Update rocket_csrf and enable protection again 2018-09-09 10:27:03 +01:00
Bat
995c173146 Downgrade Tera + Temporary disable CSRF protection
Bugs in these crates prevented articles from displaying correctly.
2018-09-08 23:09:59 +01:00
Bat
f66ddf6ef2 Actually implement blocks 2018-09-08 22:05:48 +01:00
Bat
0a70ff2594 Merge branch 'master' of github.com:Plume-org/Plume 2018-09-08 20:32:12 +01:00