mastodon/app/controllers
ThibG cd4ec7cd74
Do not serve account actors at all in limited federation mode (#14800)
* Do not serve account actors at all in limited federation mode

When an account is fetched without a signature from an allowed instance,
return an error.

This isn't really an improvement in security, as the only information that was
previously returned was required protocol-level info, and the only personal bit
was the existence of the account. The existence of the account can still be
checked by issuing a webfinger query, as those are accepted without signatures.

However, this change makes it so that unallowed instances won't create account
records on their end when they find a reference to an unknown account.

The previous behavior of rendering a limited list of fields, instead of not
rendering the actor at all, was in order to prevent situations in which two
instances in Authorized Fetch mode or Limited Federation mode would fail to
reach each other because resolving an account would require a signed query…
from an account which can only be fetched with a signed query itself. However,
this should now be fine as fetching accounts is done by signing on behalf of
the special instance actor, which does not require any kind of valid signature
to be fetched.

* Fix tests
2020-09-14 13:04:29 +02:00
..
activitypub Change REST API to return empty data for suspended accounts (#14765) 2020-09-11 15:16:29 +02:00
admin Improve email address validation (#14565) 2020-08-12 12:40:25 +02:00
api Change REST API to return empty data for suspended accounts (#14765) 2020-09-11 15:16:29 +02:00
auth Add WebAuthn as an alternative 2FA method (#14466) 2020-08-24 16:46:27 +02:00
concerns Refactor settings controllers (#14767) 2020-09-11 20:56:35 +02:00
oauth Refactor settings controllers (#14767) 2020-09-11 20:56:35 +02:00
settings Refactor settings controllers (#14767) 2020-09-11 20:56:35 +02:00
well_known Fix webfinger returning wrong status code on malformed or missing param (#13759) 2020-05-14 23:28:06 +02:00
about_controller.rb Add table of contents to about page (#11885) 2019-09-19 11:09:05 +02:00
account_follow_controller.rb Add specific rate limits for posting and following (#13172) 2020-03-08 15:17:39 +01:00
account_unfollow_controller.rb
accounts_controller.rb Do not serve account actors at all in limited federation mode (#14800) 2020-09-14 13:04:29 +02:00
application_controller.rb Fix RSS feeds not being cachable (#14368) 2020-07-22 11:44:02 +02:00
authorize_interactions_controller.rb Add specific rate limits for posting and following (#13172) 2020-03-08 15:17:39 +01:00
custom_css_controller.rb Fix redirecting non-functional accounts on public pages (#11978) 2019-09-28 01:33:27 +02:00
directories_controller.rb Fix functional user requirements in whitelist mode (#14093) 2020-06-19 19:18:47 +02:00
emojis_controller.rb
filters_controller.rb Fix missing authentication call in filters controller (#12746) 2020-01-03 05:29:08 +01:00
follower_accounts_controller.rb Fix functional user requirements in whitelist mode (#14093) 2020-06-19 19:18:47 +02:00
following_accounts_controller.rb Fix functional user requirements in whitelist mode (#14093) 2020-06-19 19:18:47 +02:00
home_controller.rb Fix other sessions not being logged out on password change (#14252) 2020-07-07 15:26:31 +02:00
instance_actors_controller.rb Add outbox attribute to instance actor (#14721) 2020-09-02 18:42:50 +02:00
intents_controller.rb
invites_controller.rb
manifests_controller.rb Fix redirecting non-functional accounts on public pages (#11978) 2019-09-28 01:33:27 +02:00
media_controller.rb Fix functional user requirements in whitelist mode (#14093) 2020-06-19 19:18:47 +02:00
media_proxy_controller.rb Fix media attachments enumeration (#14254) 2020-07-07 15:26:51 +02:00
public_timelines_controller.rb
relationships_controller.rb Change followers page to relationships page in admin UI (#12927) 2020-01-23 20:33:20 +01:00
remote_follow_controller.rb Fix redirecting non-functional accounts on public pages (#11978) 2019-09-28 01:33:27 +02:00
remote_interaction_controller.rb Fix functional user requirements in whitelist mode (#14093) 2020-06-19 19:18:47 +02:00
shares_controller.rb
statuses_controller.rb Fix functional user requirements in whitelist mode (#14093) 2020-06-19 19:18:47 +02:00
tags_controller.rb Refactor how public and tag timelines are queried (#14728) 2020-09-07 11:02:04 +02:00