No OneTemporary
Actions

Size

60 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/docs/dev.md b/docs/dev.md
	index e3e04c8eb..22e0691f1 100644
	--- a/docs/dev.md
	+++ b/docs/dev.md
	@@ -1,23 +1,23 @@
	This document contains notes and guidelines for Pleroma developers.

	# Authentication & Authorization

	## OAuth token-based authentication & authorization

	* Pleroma supports hierarchical OAuth scopes, just like Mastodon but with added granularity of admin scopes. For a reference, see [Mastodon OAuth scopes](https://docs.joinmastodon.org/api/oauth-scopes/).

	* It is important to either define OAuth scope restrictions or explicitly mark OAuth scope check as skipped, for every controller action. To define scopes, call `plug(Pleroma.Web.Plugs.OAuthScopesPlug, %{scopes: [...]})`. To explicitly set OAuth scopes check skipped, call `plug(:skip_plug, Pleroma.Web.Plugs.OAuthScopesPlug <when ...>)`.

	* In controllers, `use Pleroma.Web, :controller` will result in `action/2` (see `Pleroma.Web.controller/0` for definition) be called prior to actual controller action, and it'll perform security / privacy checks before passing control to actual controller action.

	For routes with `:authenticated_api` pipeline, authentication & authorization are expected, thus `OAuthScopesPlug` will be run unless explicitly skipped (also `EnsureAuthenticatedPlug` will be executed immediately before action even if there was an early run to give an early error, since `OAuthScopesPlug` supports `:proceed_unauthenticated` option, and other plugs may support similar options as well).

	For `:api` pipeline routes, it'll be verified whether `OAuthScopesPlug` was called or explicitly skipped, and if it was not then auth information will be dropped for request. Then `EnsurePublicOrAuthenticatedPlug` will be called to ensure that either the instance is not private or user is authenticated (unless explicitly skipped). Such automated checks help to prevent human errors and result in higher security / privacy for users.

	## [HTTP Basic Authentication](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization)

	-* With HTTP Basic Auth, OAuth scopes check is _not_ performed for any action (since password is provided during the auth, requester is able to obtain a token with full permissions anyways). `Pleroma.Plugs.AuthenticationPlug` and `Pleroma.Web.Plugs.LegacyAuthenticationPlug` both call `Pleroma.Web.Plugs.OAuthScopesPlug.skip_plug(conn)` when password is provided.
	+* With HTTP Basic Auth, OAuth scopes check is _not_ performed for any action (since password is provided during the auth, requester is able to obtain a token with full permissions anyways). `Pleroma.Web.Plugs.AuthenticationPlug` and `Pleroma.Web.Plugs.LegacyAuthenticationPlug` both call `Pleroma.Web.Plugs.OAuthScopesPlug.skip_plug(conn)` when password is provided.

	## Auth-related configuration, OAuth consumer mode etc.

	See `Authentication` section of [the configuration cheatsheet](configuration/cheatsheet.md#authentication).
	diff --git a/lib/pleroma/bbs/authenticator.ex b/lib/pleroma/bbs/authenticator.ex
	index 815de7002..f837a103a 100644
	--- a/lib/pleroma/bbs/authenticator.ex
	+++ b/lib/pleroma/bbs/authenticator.ex
	@@ -1,20 +1,20 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.BBS.Authenticator do
	use Sshd.PasswordAuthenticator
	- alias Pleroma.Plugs.AuthenticationPlug
	+ alias Pleroma.Web.Plugs.AuthenticationPlug
	alias Pleroma.User

	def authenticate(username, password) do
	username = to_string(username)
	password = to_string(password)

	with %User{} = user <- User.get_by_nickname(username) do
	AuthenticationPlug.checkpw(password, user.password_hash)
	else
	_e -> false
	end
	end
	end
	diff --git a/lib/pleroma/web/auth/pleroma_authenticator.ex b/lib/pleroma/web/auth/pleroma_authenticator.ex
	index c611b3e09..36e7ff0fa 100644
	--- a/lib/pleroma/web/auth/pleroma_authenticator.ex
	+++ b/lib/pleroma/web/auth/pleroma_authenticator.ex
	@@ -1,105 +1,105 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Auth.PleromaAuthenticator do
	- alias Pleroma.Plugs.AuthenticationPlug
	+ alias Pleroma.Web.Plugs.AuthenticationPlug
	alias Pleroma.Registration
	alias Pleroma.Repo
	alias Pleroma.User

	import Pleroma.Web.Auth.Authenticator,
	only: [fetch_credentials: 1, fetch_user: 1]

	@behaviour Pleroma.Web.Auth.Authenticator

	def get_user(%Plug.Conn{} = conn) do
	with {:ok, {name, password}} <- fetch_credentials(conn),
	{_, %User{} = user} <- {:user, fetch_user(name)},
	{_, true} <- {:checkpw, AuthenticationPlug.checkpw(password, user.password_hash)},
	{:ok, user} <- AuthenticationPlug.maybe_update_password(user, password) do
	{:ok, user}
	else
	{:error, _reason} = error -> error
	error -> {:error, error}
	end
	end

	@doc """
	Gets or creates Pleroma.Registration record from Ueberauth assigns.
	Note: some strategies (like `keycloak`) might need extra configuration to fill `uid` from callback response —
	see [`docs/config.md`](docs/config.md).
	"""
	def get_registration(%Plug.Conn{assigns: %{ueberauth_auth: %{uid: nil}}}),
	do: {:error, :missing_uid}

	def get_registration(%Plug.Conn{
	assigns: %{ueberauth_auth: %{provider: provider, uid: uid} = auth}
	}) do
	registration = Registration.get_by_provider_uid(provider, uid)

	if registration do
	{:ok, registration}
	else
	info = auth.info

	%Registration{}
	\|> Registration.changeset(%{
	provider: to_string(provider),
	uid: to_string(uid),
	info: %{
	"nickname" => info.nickname,
	"email" => info.email,
	"name" => info.name,
	"description" => info.description
	}
	})
	\|> Repo.insert()
	end
	end

	def get_registration(%Plug.Conn{} = _conn), do: {:error, :missing_credentials}

	@doc "Creates Pleroma.User record basing on params and Pleroma.Registration record."
	def create_from_registration(
	%Plug.Conn{params: %{"authorization" => registration_attrs}},
	%Registration{} = registration
	) do
	nickname = value([registration_attrs["nickname"], Registration.nickname(registration)])
	email = value([registration_attrs["email"], Registration.email(registration)])
	name = value([registration_attrs["name"], Registration.name(registration)]) \|\| nickname
	bio = value([registration_attrs["bio"], Registration.description(registration)]) \|\| ""

	random_password = :crypto.strong_rand_bytes(64) \|> Base.encode64()

	with {:ok, new_user} <-
	User.register_changeset(
	%User{},
	%{
	email: email,
	nickname: nickname,
	name: name,
	bio: bio,
	password: random_password,
	password_confirmation: random_password
	},
	external: true,
	need_confirmation: false
	)
	\|> Repo.insert(),
	{:ok, _} <-
	Registration.changeset(registration, %{user_id: new_user.id}) \|> Repo.update() do
	{:ok, new_user}
	end
	end

	defp value(list), do: Enum.find(list, &(to_string(&1) != ""))

	def handle_error(%Plug.Conn{} = _conn, error) do
	error
	end

	def auth_template, do: nil

	def oauth_consumer_template, do: nil
	end
	diff --git a/lib/pleroma/web/auth/totp_authenticator.ex b/lib/pleroma/web/auth/totp_authenticator.ex
	index 1794e407c..b4df422fe 100644
	--- a/lib/pleroma/web/auth/totp_authenticator.ex
	+++ b/lib/pleroma/web/auth/totp_authenticator.ex
	@@ -1,45 +1,45 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Auth.TOTPAuthenticator do
	alias Pleroma.MFA
	alias Pleroma.MFA.TOTP
	- alias Pleroma.Plugs.AuthenticationPlug
	+ alias Pleroma.Web.Plugs.AuthenticationPlug
	alias Pleroma.User

	@doc "Verify code or check backup code."
	@spec verify(String.t(), User.t()) ::
	{:ok, :pass} \| {:error, :invalid_token \| :invalid_secret_and_token}
	def verify(
	token,
	%User{
	multi_factor_authentication_settings:
	%{enabled: true, totp: %{secret: secret, confirmed: true}} = _
	} = _user
	)
	when is_binary(token) and byte_size(token) > 0 do
	TOTP.validate_token(secret, token)
	end

	def verify(_, _), do: {:error, :invalid_token}

	@spec verify_recovery_code(User.t(), String.t()) ::
	{:ok, :pass} \| {:error, :invalid_token}
	def verify_recovery_code(
	%User{multi_factor_authentication_settings: %{enabled: true, backup_codes: codes}} = user,
	code
	)
	when is_list(codes) and is_binary(code) do
	hash_code = Enum.find(codes, fn hash -> AuthenticationPlug.checkpw(code, hash) end)

	if hash_code do
	MFA.invalidate_backup_code(user, hash_code)
	{:ok, :pass}
	else
	{:error, :invalid_token}
	end
	end

	def verify_recovery_code(_, _), do: {:error, :invalid_token}
	end
	diff --git a/lib/pleroma/web/common_api/utils.ex b/lib/pleroma/web/common_api/utils.ex
	index 9d7b24eb2..10093a806 100644
	--- a/lib/pleroma/web/common_api/utils.ex
	+++ b/lib/pleroma/web/common_api/utils.ex
	@@ -1,565 +1,565 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.CommonAPI.Utils do
	import Pleroma.Web.Gettext
	import Pleroma.Web.ControllerHelper, only: [truthy_param?: 1]

	alias Calendar.Strftime
	alias Pleroma.Activity
	alias Pleroma.Config
	alias Pleroma.Conversation.Participation
	alias Pleroma.Formatter
	alias Pleroma.Object
	- alias Pleroma.Plugs.AuthenticationPlug
	+ alias Pleroma.Web.Plugs.AuthenticationPlug
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.Utils
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.MediaProxy

	require Logger
	require Pleroma.Constants

	def attachments_from_ids(%{media_ids: ids, descriptions: desc}) do
	attachments_from_ids_descs(ids, desc)
	end

	def attachments_from_ids(%{media_ids: ids}) do
	attachments_from_ids_no_descs(ids)
	end

	def attachments_from_ids(_), do: []

	def attachments_from_ids_no_descs([]), do: []

	def attachments_from_ids_no_descs(ids) do
	Enum.map(ids, fn media_id ->
	case Repo.get(Object, media_id) do
	%Object{data: data} -> data
	_ -> nil
	end
	end)
	\|> Enum.reject(&is_nil/1)
	end

	def attachments_from_ids_descs([], _), do: []

	def attachments_from_ids_descs(ids, descs_str) do
	{_, descs} = Jason.decode(descs_str)

	Enum.map(ids, fn media_id ->
	case Repo.get(Object, media_id) do
	%Object{data: data} ->
	Map.put(data, "name", descs[media_id])

	_ ->
	nil
	end
	end)
	\|> Enum.reject(&is_nil/1)
	end

	@spec get_to_and_cc(
	User.t(),
	list(String.t()),
	Activity.t() \| nil,
	String.t(),
	Participation.t() \| nil
	) :: {list(String.t()), list(String.t())}

	def get_to_and_cc(_, _, _, _, %Participation{} = participation) do
	participation = Repo.preload(participation, :recipients)
	{Enum.map(participation.recipients, & &1.ap_id), []}
	end

	def get_to_and_cc(user, mentioned_users, inReplyTo, "public", _) do
	to = [Pleroma.Constants.as_public() \| mentioned_users]
	cc = [user.follower_address]

	if inReplyTo do
	{Enum.uniq([inReplyTo.data["actor"] \| to]), cc}
	else
	{to, cc}
	end
	end

	def get_to_and_cc(user, mentioned_users, inReplyTo, "unlisted", _) do
	to = [user.follower_address \| mentioned_users]
	cc = [Pleroma.Constants.as_public()]

	if inReplyTo do
	{Enum.uniq([inReplyTo.data["actor"] \| to]), cc}
	else
	{to, cc}
	end
	end

	def get_to_and_cc(user, mentioned_users, inReplyTo, "private", _) do
	{to, cc} = get_to_and_cc(user, mentioned_users, inReplyTo, "direct", nil)
	{[user.follower_address \| to], cc}
	end

	def get_to_and_cc(_user, mentioned_users, inReplyTo, "direct", _) do
	# If the OP is a DM already, add the implicit actor.
	if inReplyTo && Visibility.is_direct?(inReplyTo) do
	{Enum.uniq([inReplyTo.data["actor"] \| mentioned_users]), []}
	else
	{mentioned_users, []}
	end
	end

	def get_to_and_cc(_user, mentions, _inReplyTo, {:list, _}, _), do: {mentions, []}

	def get_addressed_users(_, to) when is_list(to) do
	User.get_ap_ids_by_nicknames(to)
	end

	def get_addressed_users(mentioned_users, _), do: mentioned_users

	def maybe_add_list_data(activity_params, user, {:list, list_id}) do
	case Pleroma.List.get(list_id, user) do
	%Pleroma.List{} = list ->
	activity_params
	\|> put_in([:additional, "bcc"], [list.ap_id])
	\|> put_in([:additional, "listMessage"], list.ap_id)
	\|> put_in([:object, "listMessage"], list.ap_id)

	_ ->
	activity_params
	end
	end

	def maybe_add_list_data(activity_params, _, _), do: activity_params

	def make_poll_data(%{"poll" => %{"expires_in" => expires_in}} = data)
	when is_binary(expires_in) do
	# In some cases mastofe sends out strings instead of integers
	data
	\|> put_in(["poll", "expires_in"], String.to_integer(expires_in))
	\|> make_poll_data()
	end

	def make_poll_data(%{poll: %{options: options, expires_in: expires_in}} = data)
	when is_list(options) do
	limits = Config.get([:instance, :poll_limits])

	with :ok <- validate_poll_expiration(expires_in, limits),
	:ok <- validate_poll_options_amount(options, limits),
	:ok <- validate_poll_options_length(options, limits) do
	{option_notes, emoji} =
	Enum.map_reduce(options, %{}, fn option, emoji ->
	note = %{
	"name" => option,
	"type" => "Note",
	"replies" => %{"type" => "Collection", "totalItems" => 0}
	}

	{note, Map.merge(emoji, Pleroma.Emoji.Formatter.get_emoji_map(option))}
	end)

	end_time =
	DateTime.utc_now()
	\|> DateTime.add(expires_in)
	\|> DateTime.to_iso8601()

	key = if truthy_param?(data.poll[:multiple]), do: "anyOf", else: "oneOf"
	poll = %{"type" => "Question", key => option_notes, "closed" => end_time}

	{:ok, {poll, emoji}}
	end
	end

	def make_poll_data(%{"poll" => poll}) when is_map(poll) do
	{:error, "Invalid poll"}
	end

	def make_poll_data(_data) do
	{:ok, {%{}, %{}}}
	end

	defp validate_poll_options_amount(options, %{max_options: max_options}) do
	if Enum.count(options) > max_options do
	{:error, "Poll can't contain more than #{max_options} options"}
	else
	:ok
	end
	end

	defp validate_poll_options_length(options, %{max_option_chars: max_option_chars}) do
	if Enum.any?(options, &(String.length(&1) > max_option_chars)) do
	{:error, "Poll options cannot be longer than #{max_option_chars} characters each"}
	else
	:ok
	end
	end

	defp validate_poll_expiration(expires_in, %{min_expiration: min, max_expiration: max}) do
	cond do
	expires_in > max -> {:error, "Expiration date is too far in the future"}
	expires_in < min -> {:error, "Expiration date is too soon"}
	true -> :ok
	end
	end

	def make_content_html(
	status,
	attachments,
	data,
	visibility
	) do
	attachment_links =
	data
	\|> Map.get("attachment_links", Config.get([:instance, :attachment_links]))
	\|> truthy_param?()

	content_type = get_content_type(data[:content_type])

	options =
	if visibility == "direct" && Config.get([:instance, :safe_dm_mentions]) do
	[safe_mention: true]
	else
	[]
	end

	status
	\|> format_input(content_type, options)
	\|> maybe_add_attachments(attachments, attachment_links)
	\|> maybe_add_nsfw_tag(data)
	end

	defp get_content_type(content_type) do
	if Enum.member?(Config.get([:instance, :allowed_post_formats]), content_type) do
	content_type
	else
	"text/plain"
	end
	end

	defp maybe_add_nsfw_tag({text, mentions, tags}, %{"sensitive" => sensitive})
	when sensitive in [true, "True", "true", "1"] do
	{text, mentions, [{"#nsfw", "nsfw"} \| tags]}
	end

	defp maybe_add_nsfw_tag(data, _), do: data

	def make_context(_, %Participation{} = participation) do
	Repo.preload(participation, :conversation).conversation.ap_id
	end

	def make_context(%Activity{data: %{"context" => context}}, _), do: context
	def make_context(_, _), do: Utils.generate_context_id()

	def maybe_add_attachments(parsed, _attachments, false = _no_links), do: parsed

	def maybe_add_attachments({text, mentions, tags}, attachments, _no_links) do
	text = add_attachments(text, attachments)
	{text, mentions, tags}
	end

	def add_attachments(text, attachments) do
	attachment_text = Enum.map(attachments, &build_attachment_link/1)
	Enum.join([text \| attachment_text], "<br>")
	end

	defp build_attachment_link(%{"url" => [%{"href" => href} \| _]} = attachment) do
	name = attachment["name"] \|\| URI.decode(Path.basename(href))
	href = MediaProxy.url(href)
	"<a href=\"#{href}\" class='attachment'>#{shortname(name)}</a>"
	end

	defp build_attachment_link(_), do: ""

	def format_input(text, format, options \\ [])

	@doc """
	Formatting text to plain text.
	"""
	def format_input(text, "text/plain", options) do
	text
	\|> Formatter.html_escape("text/plain")
	\|> Formatter.linkify(options)
	\|> (fn {text, mentions, tags} ->
	{String.replace(text, ~r/\r?\n/, "<br>"), mentions, tags}
	end).()
	end

	@doc """
	Formatting text as BBCode.
	"""
	def format_input(text, "text/bbcode", options) do
	text
	\|> String.replace(~r/\r/, "")
	\|> Formatter.html_escape("text/plain")
	\|> BBCode.to_html()
	\|> (fn {:ok, html} -> html end).()
	\|> Formatter.linkify(options)
	end

	@doc """
	Formatting text to html.
	"""
	def format_input(text, "text/html", options) do
	text
	\|> Formatter.html_escape("text/html")
	\|> Formatter.linkify(options)
	end

	@doc """
	Formatting text to markdown.
	"""
	def format_input(text, "text/markdown", options) do
	text
	\|> Formatter.mentions_escape(options)
	\|> Earmark.as_html!(%Earmark.Options{renderer: Pleroma.EarmarkRenderer})
	\|> Formatter.linkify(options)
	\|> Formatter.html_escape("text/html")
	end

	def make_note_data(
	actor,
	to,
	context,
	content_html,
	attachments,
	in_reply_to,
	tags,
	summary \\ nil,
	cc \\ [],
	sensitive \\ false,
	extra_params \\ %{}
	) do
	%{
	"type" => "Note",
	"to" => to,
	"cc" => cc,
	"content" => content_html,
	"summary" => summary,
	"sensitive" => truthy_param?(sensitive),
	"context" => context,
	"attachment" => attachments,
	"actor" => actor,
	"tag" => Keyword.values(tags) \|> Enum.uniq()
	}
	\|> add_in_reply_to(in_reply_to)
	\|> Map.merge(extra_params)
	end

	defp add_in_reply_to(object, nil), do: object

	defp add_in_reply_to(object, in_reply_to) do
	with %Object{} = in_reply_to_object <- Object.normalize(in_reply_to) do
	Map.put(object, "inReplyTo", in_reply_to_object.data["id"])
	else
	_ -> object
	end
	end

	def format_naive_asctime(date) do
	date \|> DateTime.from_naive!("Etc/UTC") \|> format_asctime
	end

	def format_asctime(date) do
	Strftime.strftime!(date, "%a %b %d %H:%M:%S %z %Y")
	end

	def date_to_asctime(date) when is_binary(date) do
	with {:ok, date, _offset} <- DateTime.from_iso8601(date) do
	format_asctime(date)
	else
	_e ->
	Logger.warn("Date #{date} in wrong format, must be ISO 8601")
	""
	end
	end

	def date_to_asctime(date) do
	Logger.warn("Date #{date} in wrong format, must be ISO 8601")
	""
	end

	def to_masto_date(%NaiveDateTime{} = date) do
	date
	\|> NaiveDateTime.to_iso8601()
	\|> String.replace(~r/(\.\d+)?$/, ".000Z", global: false)
	end

	def to_masto_date(date) when is_binary(date) do
	with {:ok, date} <- NaiveDateTime.from_iso8601(date) do
	to_masto_date(date)
	else
	_ -> ""
	end
	end

	def to_masto_date(_), do: ""

	defp shortname(name) do
	with max_length when max_length > 0 <-
	Config.get([Pleroma.Upload, :filename_display_max_length], 30),
	true <- String.length(name) > max_length do
	String.slice(name, 0..max_length) <> "…"
	else
	_ -> name
	end
	end

	@spec confirm_current_password(User.t(), String.t()) :: {:ok, User.t()} \| {:error, String.t()}
	def confirm_current_password(user, password) do
	with %User{local: true} = db_user <- User.get_cached_by_id(user.id),
	true <- AuthenticationPlug.checkpw(password, db_user.password_hash) do
	{:ok, db_user}
	else
	_ -> {:error, dgettext("errors", "Invalid password.")}
	end
	end

	def maybe_notify_to_recipients(
	recipients,
	%Activity{data: %{"to" => to, "type" => _type}} = _activity
	) do
	recipients ++ to
	end

	def maybe_notify_to_recipients(recipients, _), do: recipients

	def maybe_notify_mentioned_recipients(
	recipients,
	%Activity{data: %{"to" => _to, "type" => type} = data} = activity
	)
	when type == "Create" do
	object = Object.normalize(activity, false)

	object_data =
	cond do
	not is_nil(object) ->
	object.data

	is_map(data["object"]) ->
	data["object"]

	true ->
	%{}
	end

	tagged_mentions = maybe_extract_mentions(object_data)

	recipients ++ tagged_mentions
	end

	def maybe_notify_mentioned_recipients(recipients, _), do: recipients

	# Do not notify subscribers if author is making a reply
	def maybe_notify_subscribers(recipients, %Activity{
	object: %Object{data: %{"inReplyTo" => _ap_id}}
	}) do
	recipients
	end

	def maybe_notify_subscribers(
	recipients,
	%Activity{data: %{"actor" => actor, "type" => type}} = activity
	)
	when type == "Create" do
	with %User{} = user <- User.get_cached_by_ap_id(actor) do
	subscriber_ids =
	user
	\|> User.subscriber_users()
	\|> Enum.filter(&Visibility.visible_for_user?(activity, &1))
	\|> Enum.map(& &1.ap_id)

	recipients ++ subscriber_ids
	else
	_e -> recipients
	end
	end

	def maybe_notify_subscribers(recipients, _), do: recipients

	def maybe_notify_followers(recipients, %Activity{data: %{"type" => "Move"}} = activity) do
	with %User{} = user <- User.get_cached_by_ap_id(activity.actor) do
	user
	\|> User.get_followers()
	\|> Enum.map(& &1.ap_id)
	\|> Enum.concat(recipients)
	else
	_e -> recipients
	end
	end

	def maybe_notify_followers(recipients, _), do: recipients

	def maybe_extract_mentions(%{"tag" => tag}) do
	tag
	\|> Enum.filter(fn x -> is_map(x) && x["type"] == "Mention" end)
	\|> Enum.map(fn x -> x["href"] end)
	\|> Enum.uniq()
	end

	def maybe_extract_mentions(_), do: []

	def make_report_content_html(nil), do: {:ok, {nil, [], []}}

	def make_report_content_html(comment) do
	max_size = Config.get([:instance, :max_report_comment_size], 1000)

	if String.length(comment) <= max_size do
	{:ok, format_input(comment, "text/plain")}
	else
	{:error,
	dgettext("errors", "Comment must be up to %{max_size} characters", max_size: max_size)}
	end
	end

	def get_report_statuses(%User{ap_id: actor}, %{status_ids: status_ids})
	when is_list(status_ids) do
	{:ok, Activity.all_by_actor_and_id(actor, status_ids)}
	end

	def get_report_statuses(_, _), do: {:ok, nil}

	# DEPRECATED mostly, context objects are now created at insertion time.
	def context_to_conversation_id(context) do
	with %Object{id: id} <- Object.get_cached_by_ap_id(context) do
	id
	else
	_e ->
	changeset = Object.context_mapping(context)

	case Repo.insert(changeset) do
	{:ok, %{id: id}} ->
	id

	# This should be solved by an upsert, but it seems ecto
	# has problems accessing the constraint inside the jsonb.
	{:error, _} ->
	Object.get_cached_by_ap_id(context).id
	end
	end
	end

	def conversation_id_to_context(id) do
	with %Object{data: %{"id" => context}} <- Repo.get(Object, id) do
	context
	else
	_e ->
	{:error, dgettext("errors", "No such conversation")}
	end
	end

	def validate_character_limit("" = _full_payload, [] = _attachments) do
	{:error, dgettext("errors", "Cannot post an empty status without attachments")}
	end

	def validate_character_limit(full_payload, _attachments) do
	limit = Config.get([:instance, :limit])
	length = String.length(full_payload)

	if length <= limit do
	:ok
	else
	{:error, dgettext("errors", "The status is over the character limit")}
	end
	end
	end
	diff --git a/lib/pleroma/web/mongoose_im/mongoose_im_controller.ex b/lib/pleroma/web/mongoose_im/mongoose_im_controller.ex
	index 42cf5a85f..ba8eb56fa 100644
	--- a/lib/pleroma/web/mongoose_im/mongoose_im_controller.ex
	+++ b/lib/pleroma/web/mongoose_im/mongoose_im_controller.ex
	@@ -1,46 +1,46 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MongooseIM.MongooseIMController do
	use Pleroma.Web, :controller

	- alias Pleroma.Plugs.AuthenticationPlug
	+ alias Pleroma.Web.Plugs.AuthenticationPlug
	alias Pleroma.Web.Plugs.RateLimiter
	alias Pleroma.Repo
	alias Pleroma.User

	plug(RateLimiter, [name: :authentication] when action in [:user_exists, :check_password])
	plug(RateLimiter, [name: :authentication, params: ["user"]] when action == :check_password)

	def user_exists(conn, %{"user" => username}) do
	with %User{} <- Repo.get_by(User, nickname: username, local: true, deactivated: false) do
	conn
	\|> json(true)
	else
	_ ->
	conn
	\|> put_status(:not_found)
	\|> json(false)
	end
	end

	def check_password(conn, %{"user" => username, "pass" => password}) do
	with %User{password_hash: password_hash, deactivated: false} <-
	Repo.get_by(User, nickname: username, local: true),
	true <- AuthenticationPlug.checkpw(password, password_hash) do
	conn
	\|> json(true)
	else
	false ->
	conn
	\|> put_status(:forbidden)
	\|> json(false)

	_ ->
	conn
	\|> put_status(:not_found)
	\|> json(false)
	end
	end
	end
	diff --git a/lib/pleroma/web/plugs/authentication_plug.ex b/lib/pleroma/web/plugs/authentication_plug.ex
	index a8a4a8380..e2a8b1b69 100644
	--- a/lib/pleroma/web/plugs/authentication_plug.ex
	+++ b/lib/pleroma/web/plugs/authentication_plug.ex
	@@ -1,79 +1,79 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	-defmodule Pleroma.Plugs.AuthenticationPlug do
	+defmodule Pleroma.Web.Plugs.AuthenticationPlug do
	alias Pleroma.User

	import Plug.Conn

	require Logger

	def init(options), do: options

	def checkpw(password, "$6" <> _ = password_hash) do
	:crypt.crypt(password, password_hash) == password_hash
	end

	def checkpw(password, "$2" <> _ = password_hash) do
	# Handle bcrypt passwords for Mastodon migration
	Bcrypt.verify_pass(password, password_hash)
	end

	def checkpw(password, "$pbkdf2" <> _ = password_hash) do
	Pbkdf2.verify_pass(password, password_hash)
	end

	def checkpw(_password, _password_hash) do
	Logger.error("Password hash not recognized")
	false
	end

	def maybe_update_password(%User{password_hash: "$2" <> _} = user, password) do
	do_update_password(user, password)
	end

	def maybe_update_password(%User{password_hash: "$6" <> _} = user, password) do
	do_update_password(user, password)
	end

	def maybe_update_password(user, _), do: {:ok, user}

	defp do_update_password(user, password) do
	user
	\|> User.password_update_changeset(%{
	"password" => password,
	"password_confirmation" => password
	})
	\|> Pleroma.Repo.update()
	end

	def call(%{assigns: %{user: %User{}}} = conn, _), do: conn

	def call(
	%{
	assigns: %{
	auth_user: %{password_hash: password_hash} = auth_user,
	auth_credentials: %{password: password}
	}
	} = conn,
	_
	) do
	if checkpw(password, password_hash) do
	{:ok, auth_user} = maybe_update_password(auth_user, password)

	conn
	\|> assign(:user, auth_user)
	\|> Pleroma.Web.Plugs.OAuthScopesPlug.skip_plug()
	else
	conn
	end
	end

	def call(%{assigns: %{auth_credentials: %{password: _}}} = conn, _) do
	Pbkdf2.no_user_verify()
	conn
	end

	def call(conn, _), do: conn
	end
	diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
	index 46f007d3d..855e69077 100644
	--- a/lib/pleroma/web/router.ex
	+++ b/lib/pleroma/web/router.ex
	@@ -1,748 +1,748 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Router do
	use Pleroma.Web, :router

	pipeline :browser do
	plug(:accepts, ["html"])
	plug(:fetch_session)
	end

	pipeline :oauth do
	plug(:fetch_session)
	plug(Pleroma.Web.Plugs.OAuthPlug)
	plug(Pleroma.Web.Plugs.UserEnabledPlug)
	end

	pipeline :expect_authentication do
	plug(Pleroma.Web.Plugs.ExpectAuthenticatedCheckPlug)
	end

	pipeline :expect_public_instance_or_authentication do
	plug(Pleroma.Web.Plugs.ExpectPublicOrAuthenticatedCheckPlug)
	end

	pipeline :authenticate do
	plug(Pleroma.Web.Plugs.OAuthPlug)
	plug(Pleroma.Web.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Web.Plugs.UserFetcherPlug)
	plug(Pleroma.Web.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Web.Plugs.LegacyAuthenticationPlug)
	- plug(Pleroma.Plugs.AuthenticationPlug)
	+ plug(Pleroma.Web.Plugs.AuthenticationPlug)
	end

	pipeline :after_auth do
	plug(Pleroma.Web.Plugs.UserEnabledPlug)
	plug(Pleroma.Web.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Web.Plugs.EnsureUserKeyPlug)
	end

	pipeline :base_api do
	plug(:accepts, ["json"])
	plug(:fetch_session)
	plug(:authenticate)
	plug(OpenApiSpex.Plug.PutApiSpec, module: Pleroma.Web.ApiSpec)
	end

	pipeline :api do
	plug(:expect_public_instance_or_authentication)
	plug(:base_api)
	plug(:after_auth)
	plug(Pleroma.Web.Plugs.IdempotencyPlug)
	end

	pipeline :authenticated_api do
	plug(:expect_authentication)
	plug(:base_api)
	plug(:after_auth)
	plug(Pleroma.Web.Plugs.EnsureAuthenticatedPlug)
	plug(Pleroma.Web.Plugs.IdempotencyPlug)
	end

	pipeline :admin_api do
	plug(:expect_authentication)
	plug(:base_api)
	plug(Pleroma.Plugs.AdminSecretAuthenticationPlug)
	plug(:after_auth)
	plug(Pleroma.Web.Plugs.EnsureAuthenticatedPlug)
	plug(Pleroma.Web.Plugs.UserIsAdminPlug)
	plug(Pleroma.Web.Plugs.IdempotencyPlug)
	end

	pipeline :mastodon_html do
	plug(:browser)
	plug(:authenticate)
	plug(:after_auth)
	end

	pipeline :pleroma_html do
	plug(:browser)
	plug(:authenticate)
	plug(Pleroma.Web.Plugs.EnsureUserKeyPlug)
	end

	pipeline :well_known do
	plug(:accepts, ["json", "jrd+json", "xml", "xrd+xml"])
	end

	pipeline :config do
	plug(:accepts, ["json", "xml"])
	plug(OpenApiSpex.Plug.PutApiSpec, module: Pleroma.Web.ApiSpec)
	end

	pipeline :pleroma_api do
	plug(:accepts, ["html", "json"])
	plug(OpenApiSpex.Plug.PutApiSpec, module: Pleroma.Web.ApiSpec)
	end

	pipeline :mailbox_preview do
	plug(:accepts, ["html"])

	plug(:put_secure_browser_headers, %{
	"content-security-policy" =>
	"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' 'unsafe-eval'"
	})
	end

	pipeline :http_signature do
	plug(Pleroma.Web.Plugs.HTTPSignaturePlug)
	plug(Pleroma.Web.Plugs.MappedSignatureToIdentityPlug)
	end

	scope "/api/pleroma", Pleroma.Web.TwitterAPI do
	pipe_through(:pleroma_api)

	get("/password_reset/:token", PasswordController, :reset, as: :reset_password)
	post("/password_reset", PasswordController, :do_reset, as: :reset_password)
	get("/emoji", UtilController, :emoji)
	get("/captcha", UtilController, :captcha)
	get("/healthcheck", UtilController, :healthcheck)
	end

	scope "/api/pleroma", Pleroma.Web do
	pipe_through(:pleroma_api)
	post("/uploader_callback/:upload_path", UploaderController, :callback)
	end

	scope "/api/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:admin_api)

	post("/users/follow", AdminAPIController, :user_follow)
	post("/users/unfollow", AdminAPIController, :user_unfollow)

	put("/users/disable_mfa", AdminAPIController, :disable_mfa)
	delete("/users", AdminAPIController, :user_delete)
	post("/users", AdminAPIController, :users_create)
	patch("/users/:nickname/toggle_activation", AdminAPIController, :user_toggle_activation)
	patch("/users/activate", AdminAPIController, :user_activate)
	patch("/users/deactivate", AdminAPIController, :user_deactivate)
	patch("/users/approve", AdminAPIController, :user_approve)
	put("/users/tag", AdminAPIController, :tag_users)
	delete("/users/tag", AdminAPIController, :untag_users)

	get("/users/:nickname/permission_group", AdminAPIController, :right_get)
	get("/users/:nickname/permission_group/:permission_group", AdminAPIController, :right_get)

	post("/users/:nickname/permission_group/:permission_group", AdminAPIController, :right_add)

	delete(
	"/users/:nickname/permission_group/:permission_group",
	AdminAPIController,
	:right_delete
	)

	post("/users/permission_group/:permission_group", AdminAPIController, :right_add_multiple)

	delete(
	"/users/permission_group/:permission_group",
	AdminAPIController,
	:right_delete_multiple
	)

	get("/relay", RelayController, :index)
	post("/relay", RelayController, :follow)
	delete("/relay", RelayController, :unfollow)

	post("/users/invite_token", InviteController, :create)
	get("/users/invites", InviteController, :index)
	post("/users/revoke_invite", InviteController, :revoke)
	post("/users/email_invite", InviteController, :email)

	get("/users/:nickname/password_reset", AdminAPIController, :get_password_reset)
	patch("/users/force_password_reset", AdminAPIController, :force_password_reset)
	get("/users/:nickname/credentials", AdminAPIController, :show_user_credentials)
	patch("/users/:nickname/credentials", AdminAPIController, :update_user_credentials)

	get("/users", AdminAPIController, :list_users)
	get("/users/:nickname", AdminAPIController, :user_show)
	get("/users/:nickname/statuses", AdminAPIController, :list_user_statuses)
	get("/users/:nickname/chats", AdminAPIController, :list_user_chats)

	get("/instances/:instance/statuses", AdminAPIController, :list_instance_statuses)

	get("/instance_document/:name", InstanceDocumentController, :show)
	patch("/instance_document/:name", InstanceDocumentController, :update)
	delete("/instance_document/:name", InstanceDocumentController, :delete)

	patch("/users/confirm_email", AdminAPIController, :confirm_email)
	patch("/users/resend_confirmation_email", AdminAPIController, :resend_confirmation_email)

	get("/reports", ReportController, :index)
	get("/reports/:id", ReportController, :show)
	patch("/reports", ReportController, :update)
	post("/reports/:id/notes", ReportController, :notes_create)
	delete("/reports/:report_id/notes/:id", ReportController, :notes_delete)

	get("/statuses/:id", StatusController, :show)
	put("/statuses/:id", StatusController, :update)
	delete("/statuses/:id", StatusController, :delete)
	get("/statuses", StatusController, :index)

	get("/config", ConfigController, :show)
	post("/config", ConfigController, :update)
	get("/config/descriptions", ConfigController, :descriptions)
	get("/need_reboot", AdminAPIController, :need_reboot)
	get("/restart", AdminAPIController, :restart)

	get("/moderation_log", AdminAPIController, :list_log)

	post("/reload_emoji", AdminAPIController, :reload_emoji)
	get("/stats", AdminAPIController, :stats)

	get("/oauth_app", OAuthAppController, :index)
	post("/oauth_app", OAuthAppController, :create)
	patch("/oauth_app/:id", OAuthAppController, :update)
	delete("/oauth_app/:id", OAuthAppController, :delete)

	get("/media_proxy_caches", MediaProxyCacheController, :index)
	post("/media_proxy_caches/delete", MediaProxyCacheController, :delete)
	post("/media_proxy_caches/purge", MediaProxyCacheController, :purge)

	get("/chats/:id", ChatController, :show)
	get("/chats/:id/messages", ChatController, :messages)
	delete("/chats/:id/messages/:message_id", ChatController, :delete_message)
	end

	scope "/api/pleroma/emoji", Pleroma.Web.PleromaAPI do
	scope "/pack" do
	pipe_through(:admin_api)

	post("/", EmojiPackController, :create)
	patch("/", EmojiPackController, :update)
	delete("/", EmojiPackController, :delete)
	end

	scope "/pack" do
	pipe_through(:api)

	get("/", EmojiPackController, :show)
	end

	# Modifying packs
	scope "/packs" do
	pipe_through(:admin_api)

	get("/import", EmojiPackController, :import_from_filesystem)
	get("/remote", EmojiPackController, :remote)
	post("/download", EmojiPackController, :download)

	post("/files", EmojiFileController, :create)
	patch("/files", EmojiFileController, :update)
	delete("/files", EmojiFileController, :delete)
	end

	# Pack info / downloading
	scope "/packs" do
	pipe_through(:api)

	get("/", EmojiPackController, :index)
	get("/archive", EmojiPackController, :archive)
	end
	end

	scope "/", Pleroma.Web.TwitterAPI do
	pipe_through(:pleroma_html)

	post("/main/ostatus", UtilController, :remote_subscribe)
	get("/ostatus_subscribe", RemoteFollowController, :follow)

	post("/ostatus_subscribe", RemoteFollowController, :do_follow)
	end

	scope "/api/pleroma", Pleroma.Web.TwitterAPI do
	pipe_through(:authenticated_api)

	post("/change_email", UtilController, :change_email)
	post("/change_password", UtilController, :change_password)
	post("/delete_account", UtilController, :delete_account)
	put("/notification_settings", UtilController, :update_notificaton_settings)
	post("/disable_account", UtilController, :disable_account)
	end

	scope "/api/pleroma", Pleroma.Web.PleromaAPI do
	pipe_through(:authenticated_api)

	post("/mutes_import", UserImportController, :mutes)
	post("/blocks_import", UserImportController, :blocks)
	post("/follow_import", UserImportController, :follow)

	get("/accounts/mfa", TwoFactorAuthenticationController, :settings)
	get("/accounts/mfa/backup_codes", TwoFactorAuthenticationController, :backup_codes)
	get("/accounts/mfa/setup/:method", TwoFactorAuthenticationController, :setup)
	post("/accounts/mfa/confirm/:method", TwoFactorAuthenticationController, :confirm)
	delete("/accounts/mfa/:method", TwoFactorAuthenticationController, :disable)
	end

	scope "/oauth", Pleroma.Web.OAuth do
	scope [] do
	pipe_through(:oauth)
	get("/authorize", OAuthController, :authorize)
	end

	post("/authorize", OAuthController, :create_authorization)
	post("/token", OAuthController, :token_exchange)
	post("/revoke", OAuthController, :token_revoke)
	get("/registration_details", OAuthController, :registration_details)

	post("/mfa/challenge", MFAController, :challenge)
	post("/mfa/verify", MFAController, :verify, as: :mfa_verify)
	get("/mfa", MFAController, :show)

	scope [] do
	pipe_through(:browser)

	get("/prepare_request", OAuthController, :prepare_request)
	get("/:provider", OAuthController, :request)
	get("/:provider/callback", OAuthController, :callback)
	post("/register", OAuthController, :register)
	end
	end

	scope "/api/v1/pleroma", Pleroma.Web.PleromaAPI do
	pipe_through(:api)

	get("/statuses/:id/reactions/:emoji", EmojiReactionController, :index)
	get("/statuses/:id/reactions", EmojiReactionController, :index)
	end

	scope "/api/v1/pleroma", Pleroma.Web.PleromaAPI do
	scope [] do
	pipe_through(:authenticated_api)

	post("/chats/by-account-id/:id", ChatController, :create)
	get("/chats", ChatController, :index)
	get("/chats/:id", ChatController, :show)
	get("/chats/:id/messages", ChatController, :messages)
	post("/chats/:id/messages", ChatController, :post_chat_message)
	delete("/chats/:id/messages/:message_id", ChatController, :delete_message)
	post("/chats/:id/read", ChatController, :mark_as_read)
	post("/chats/:id/messages/:message_id/read", ChatController, :mark_message_as_read)

	get("/conversations/:id/statuses", ConversationController, :statuses)
	get("/conversations/:id", ConversationController, :show)
	post("/conversations/read", ConversationController, :mark_as_read)
	patch("/conversations/:id", ConversationController, :update)

	put("/statuses/:id/reactions/:emoji", EmojiReactionController, :create)
	delete("/statuses/:id/reactions/:emoji", EmojiReactionController, :delete)
	post("/notifications/read", NotificationController, :mark_as_read)

	get("/mascot", MascotController, :show)
	put("/mascot", MascotController, :update)

	post("/scrobble", ScrobbleController, :create)
	end

	scope [] do
	pipe_through(:api)
	get("/accounts/:id/favourites", AccountController, :favourites)
	end

	scope [] do
	pipe_through(:authenticated_api)

	post("/accounts/:id/subscribe", AccountController, :subscribe)
	post("/accounts/:id/unsubscribe", AccountController, :unsubscribe)
	end

	post("/accounts/confirmation_resend", AccountController, :confirmation_resend)
	end

	scope "/api/v1/pleroma", Pleroma.Web.PleromaAPI do
	pipe_through(:api)
	get("/accounts/:id/scrobbles", ScrobbleController, :index)
	end

	scope "/api/v1", Pleroma.Web.MastodonAPI do
	pipe_through(:authenticated_api)

	get("/accounts/verify_credentials", AccountController, :verify_credentials)
	patch("/accounts/update_credentials", AccountController, :update_credentials)

	get("/accounts/relationships", AccountController, :relationships)
	get("/accounts/:id/lists", AccountController, :lists)
	get("/accounts/:id/identity_proofs", AccountController, :identity_proofs)
	get("/endorsements", AccountController, :endorsements)
	get("/blocks", AccountController, :blocks)
	get("/mutes", AccountController, :mutes)

	post("/follows", AccountController, :follow_by_uri)
	post("/accounts/:id/follow", AccountController, :follow)
	post("/accounts/:id/unfollow", AccountController, :unfollow)
	post("/accounts/:id/block", AccountController, :block)
	post("/accounts/:id/unblock", AccountController, :unblock)
	post("/accounts/:id/mute", AccountController, :mute)
	post("/accounts/:id/unmute", AccountController, :unmute)

	get("/apps/verify_credentials", AppController, :verify_credentials)

	get("/conversations", ConversationController, :index)
	post("/conversations/:id/read", ConversationController, :mark_as_read)

	get("/domain_blocks", DomainBlockController, :index)
	post("/domain_blocks", DomainBlockController, :create)
	delete("/domain_blocks", DomainBlockController, :delete)

	get("/filters", FilterController, :index)

	post("/filters", FilterController, :create)
	get("/filters/:id", FilterController, :show)
	put("/filters/:id", FilterController, :update)
	delete("/filters/:id", FilterController, :delete)

	get("/follow_requests", FollowRequestController, :index)
	post("/follow_requests/:id/authorize", FollowRequestController, :authorize)
	post("/follow_requests/:id/reject", FollowRequestController, :reject)

	get("/lists", ListController, :index)
	get("/lists/:id", ListController, :show)
	get("/lists/:id/accounts", ListController, :list_accounts)

	delete("/lists/:id", ListController, :delete)
	post("/lists", ListController, :create)
	put("/lists/:id", ListController, :update)
	post("/lists/:id/accounts", ListController, :add_to_list)
	delete("/lists/:id/accounts", ListController, :remove_from_list)

	get("/markers", MarkerController, :index)
	post("/markers", MarkerController, :upsert)

	post("/media", MediaController, :create)
	get("/media/:id", MediaController, :show)
	put("/media/:id", MediaController, :update)

	get("/notifications", NotificationController, :index)
	get("/notifications/:id", NotificationController, :show)

	post("/notifications/:id/dismiss", NotificationController, :dismiss)
	post("/notifications/clear", NotificationController, :clear)
	delete("/notifications/destroy_multiple", NotificationController, :destroy_multiple)
	# Deprecated: was removed in Mastodon v3, use `/notifications/:id/dismiss` instead
	post("/notifications/dismiss", NotificationController, :dismiss_via_body)

	post("/polls/:id/votes", PollController, :vote)

	post("/reports", ReportController, :create)

	get("/scheduled_statuses", ScheduledActivityController, :index)
	get("/scheduled_statuses/:id", ScheduledActivityController, :show)

	put("/scheduled_statuses/:id", ScheduledActivityController, :update)
	delete("/scheduled_statuses/:id", ScheduledActivityController, :delete)

	# Unlike `GET /api/v1/accounts/:id/favourites`, demands authentication
	get("/favourites", StatusController, :favourites)
	get("/bookmarks", StatusController, :bookmarks)

	post("/statuses", StatusController, :create)
	delete("/statuses/:id", StatusController, :delete)
	post("/statuses/:id/reblog", StatusController, :reblog)
	post("/statuses/:id/unreblog", StatusController, :unreblog)
	post("/statuses/:id/favourite", StatusController, :favourite)
	post("/statuses/:id/unfavourite", StatusController, :unfavourite)
	post("/statuses/:id/pin", StatusController, :pin)
	post("/statuses/:id/unpin", StatusController, :unpin)
	post("/statuses/:id/bookmark", StatusController, :bookmark)
	post("/statuses/:id/unbookmark", StatusController, :unbookmark)
	post("/statuses/:id/mute", StatusController, :mute_conversation)
	post("/statuses/:id/unmute", StatusController, :unmute_conversation)

	post("/push/subscription", SubscriptionController, :create)
	get("/push/subscription", SubscriptionController, :show)
	put("/push/subscription", SubscriptionController, :update)
	delete("/push/subscription", SubscriptionController, :delete)

	get("/suggestions", SuggestionController, :index)

	get("/timelines/home", TimelineController, :home)
	get("/timelines/direct", TimelineController, :direct)
	get("/timelines/list/:list_id", TimelineController, :list)
	end

	scope "/api/web", Pleroma.Web do
	pipe_through(:authenticated_api)

	# Backend-obscure settings blob for MastoFE, don't parse/reuse elsewhere
	put("/settings", MastoFEController, :put_settings)
	end

	scope "/api/v1", Pleroma.Web.MastodonAPI do
	pipe_through(:api)

	get("/accounts/search", SearchController, :account_search)
	get("/search", SearchController, :search)

	get("/accounts/:id/statuses", AccountController, :statuses)
	get("/accounts/:id/followers", AccountController, :followers)
	get("/accounts/:id/following", AccountController, :following)
	get("/accounts/:id", AccountController, :show)

	post("/accounts", AccountController, :create)

	get("/instance", InstanceController, :show)
	get("/instance/peers", InstanceController, :peers)

	post("/apps", AppController, :create)

	get("/statuses", StatusController, :index)
	get("/statuses/:id", StatusController, :show)
	get("/statuses/:id/context", StatusController, :context)
	get("/statuses/:id/card", StatusController, :card)
	get("/statuses/:id/favourited_by", StatusController, :favourited_by)
	get("/statuses/:id/reblogged_by", StatusController, :reblogged_by)

	get("/custom_emojis", CustomEmojiController, :index)

	get("/trends", MastodonAPIController, :empty_array)

	get("/timelines/public", TimelineController, :public)
	get("/timelines/tag/:tag", TimelineController, :hashtag)

	get("/polls/:id", PollController, :show)
	end

	scope "/api/v2", Pleroma.Web.MastodonAPI do
	pipe_through(:api)
	get("/search", SearchController, :search2)

	post("/media", MediaController, :create2)
	end

	scope "/api", Pleroma.Web do
	pipe_through(:config)

	get("/pleroma/frontend_configurations", TwitterAPI.UtilController, :frontend_configurations)
	end

	scope "/api", Pleroma.Web do
	pipe_through(:api)

	get(
	"/account/confirm_email/:user_id/:token",
	TwitterAPI.Controller,
	:confirm_email,
	as: :confirm_email
	)
	end

	scope "/api" do
	pipe_through(:base_api)

	get("/openapi", OpenApiSpex.Plug.RenderSpec, [])
	end

	scope "/api", Pleroma.Web, as: :authenticated_twitter_api do
	pipe_through(:authenticated_api)

	get("/oauth_tokens", TwitterAPI.Controller, :oauth_tokens)
	delete("/oauth_tokens/:id", TwitterAPI.Controller, :revoke_token)

	post(
	"/qvitter/statuses/notifications/read",
	TwitterAPI.Controller,
	:mark_notifications_as_read
	)
	end

	pipeline :ostatus do
	plug(:accepts, ["html", "xml", "rss", "atom", "activity+json", "json"])
	plug(Pleroma.Web.Plugs.StaticFEPlug)
	end

	pipeline :oembed do
	plug(:accepts, ["json", "xml"])
	end

	scope "/", Pleroma.Web do
	pipe_through([:ostatus, :http_signature])

	get("/objects/:uuid", OStatus.OStatusController, :object)
	get("/activities/:uuid", OStatus.OStatusController, :activity)
	get("/notice/:id", OStatus.OStatusController, :notice)
	get("/notice/:id/embed_player", OStatus.OStatusController, :notice_player)

	# Mastodon compatibility routes
	get("/users/:nickname/statuses/:id", OStatus.OStatusController, :object)
	get("/users/:nickname/statuses/:id/activity", OStatus.OStatusController, :activity)

	get("/users/:nickname/feed", Feed.UserController, :feed, as: :user_feed)
	get("/users/:nickname", Feed.UserController, :feed_redirect, as: :user_feed)

	get("/tags/:tag", Feed.TagController, :feed, as: :tag_feed)
	end

	scope "/", Pleroma.Web do
	pipe_through(:browser)
	get("/mailer/unsubscribe/:token", Mailer.SubscriptionController, :unsubscribe)
	end

	pipeline :ap_service_actor do
	plug(:accepts, ["activity+json", "json"])
	end

	# Server to Server (S2S) AP interactions
	pipeline :activitypub do
	plug(:ap_service_actor)
	plug(:http_signature)
	end

	# Client to Server (C2S) AP interactions
	pipeline :activitypub_client do
	plug(:ap_service_actor)
	plug(:fetch_session)
	plug(:authenticate)
	plug(:after_auth)
	end

	scope "/", Pleroma.Web.ActivityPub do
	pipe_through([:activitypub_client])

	get("/api/ap/whoami", ActivityPubController, :whoami)
	get("/users/:nickname/inbox", ActivityPubController, :read_inbox)

	get("/users/:nickname/outbox", ActivityPubController, :outbox)
	post("/users/:nickname/outbox", ActivityPubController, :update_outbox)
	post("/api/ap/upload_media", ActivityPubController, :upload_media)

	# The following two are S2S as well, see `ActivityPub.fetch_follow_information_for_user/1`:
	get("/users/:nickname/followers", ActivityPubController, :followers)
	get("/users/:nickname/following", ActivityPubController, :following)
	end

	scope "/", Pleroma.Web.ActivityPub do
	pipe_through(:activitypub)
	post("/inbox", ActivityPubController, :inbox)
	post("/users/:nickname/inbox", ActivityPubController, :inbox)
	end

	scope "/relay", Pleroma.Web.ActivityPub do
	pipe_through(:ap_service_actor)

	get("/", ActivityPubController, :relay)

	scope [] do
	pipe_through(:http_signature)
	post("/inbox", ActivityPubController, :inbox)
	end

	get("/following", ActivityPubController, :relay_following)
	get("/followers", ActivityPubController, :relay_followers)
	end

	scope "/internal/fetch", Pleroma.Web.ActivityPub do
	pipe_through(:ap_service_actor)

	get("/", ActivityPubController, :internal_fetch)
	post("/inbox", ActivityPubController, :inbox)
	end

	scope "/.well-known", Pleroma.Web do
	pipe_through(:well_known)

	get("/host-meta", WebFinger.WebFingerController, :host_meta)
	get("/webfinger", WebFinger.WebFingerController, :webfinger)
	get("/nodeinfo", Nodeinfo.NodeinfoController, :schemas)
	end

	scope "/nodeinfo", Pleroma.Web do
	get("/:version", Nodeinfo.NodeinfoController, :nodeinfo)
	end

	scope "/", Pleroma.Web do
	pipe_through(:api)

	get("/web/manifest.json", MastoFEController, :manifest)
	end

	scope "/", Pleroma.Web do
	pipe_through(:mastodon_html)

	get("/web/login", MastodonAPI.AuthController, :login)
	delete("/auth/sign_out", MastodonAPI.AuthController, :logout)

	post("/auth/password", MastodonAPI.AuthController, :password_reset)

	get("/web/*path", MastoFEController, :index)

	get("/embed/:id", EmbedController, :show)
	end

	scope "/proxy/", Pleroma.Web.MediaProxy do
	get("/preview/:sig/:url", MediaProxyController, :preview)
	get("/preview/:sig/:url/:filename", MediaProxyController, :preview)
	get("/:sig/:url", MediaProxyController, :remote)
	get("/:sig/:url/:filename", MediaProxyController, :remote)
	end

	if Pleroma.Config.get(:env) == :dev do
	scope "/dev" do
	pipe_through([:mailbox_preview])

	forward("/mailbox", Plug.Swoosh.MailboxPreview, base_path: "/dev/mailbox")
	end
	end

	# Test-only routes needed to test action dispatching and plug chain execution
	if Pleroma.Config.get(:env) == :test do
	@test_actions [
	:do_oauth_check,
	:fallback_oauth_check,
	:skip_oauth_check,
	:fallback_oauth_skip_publicity_check,
	:skip_oauth_skip_publicity_check,
	:missing_oauth_check_definition
	]

	scope "/test/api", Pleroma.Tests do
	pipe_through(:api)

	for action <- @test_actions do
	get("/#{action}", AuthTestController, action)
	end
	end

	scope "/test/authenticated_api", Pleroma.Tests do
	pipe_through(:authenticated_api)

	for action <- @test_actions do
	get("/#{action}", AuthTestController, action)
	end
	end
	end

	scope "/", Pleroma.Web.MongooseIM do
	get("/user_exists", MongooseIMController, :user_exists)
	get("/check_password", MongooseIMController, :check_password)
	end

	scope "/", Pleroma.Web.Fallback do
	get("/registration/:token", RedirectController, :registration_page)
	get("/:maybe_nickname_or_id", RedirectController, :redirector_with_meta)
	get("/api*path", RedirectController, :api_not_implemented)
	get("/*path", RedirectController, :redirector_with_preload)

	options("/*path", RedirectController, :empty)
	end
	end
	diff --git a/test/pleroma/web/plugs/authentication_plug_test.exs b/test/pleroma/web/plugs/authentication_plug_test.exs
	index 5b6186e4e..2167f2457 100644
	--- a/test/pleroma/web/plugs/authentication_plug_test.exs
	+++ b/test/pleroma/web/plugs/authentication_plug_test.exs
	@@ -1,125 +1,125 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Plugs.AuthenticationPlugTest do
	use Pleroma.Web.ConnCase, async: true

	- alias Pleroma.Plugs.AuthenticationPlug
	+ alias Pleroma.Web.Plugs.AuthenticationPlug
	alias Pleroma.Web.Plugs.OAuthScopesPlug
	alias Pleroma.Web.Plugs.PlugHelper
	alias Pleroma.User

	import ExUnit.CaptureLog
	import Pleroma.Factory

	setup %{conn: conn} do
	user = %User{
	id: 1,
	name: "dude",
	password_hash: Pbkdf2.hash_pwd_salt("guy")
	}

	conn =
	conn
	\|> assign(:auth_user, user)

	%{user: user, conn: conn}
	end

	test "it does nothing if a user is assigned", %{conn: conn} do
	conn =
	conn
	\|> assign(:user, %User{})

	ret_conn =
	conn
	\|> AuthenticationPlug.call(%{})

	assert ret_conn == conn
	end

	test "with a correct password in the credentials, " <>
	"it assigns the auth_user and marks OAuthScopesPlug as skipped",
	%{conn: conn} do
	conn =
	conn
	\|> assign(:auth_credentials, %{password: "guy"})
	\|> AuthenticationPlug.call(%{})

	assert conn.assigns.user == conn.assigns.auth_user
	assert PlugHelper.plug_skipped?(conn, OAuthScopesPlug)
	end

	test "with a bcrypt hash, it updates to a pkbdf2 hash", %{conn: conn} do
	user = insert(:user, password_hash: Bcrypt.hash_pwd_salt("123"))
	assert "$2" <> _ = user.password_hash

	conn =
	conn
	\|> assign(:auth_user, user)
	\|> assign(:auth_credentials, %{password: "123"})
	\|> AuthenticationPlug.call(%{})

	assert conn.assigns.user.id == conn.assigns.auth_user.id
	assert PlugHelper.plug_skipped?(conn, OAuthScopesPlug)

	user = User.get_by_id(user.id)
	assert "$pbkdf2" <> _ = user.password_hash
	end

	@tag :skip_on_mac
	test "with a crypt hash, it updates to a pkbdf2 hash", %{conn: conn} do
	user =
	insert(:user,
	password_hash:
	"$6$9psBWV8gxkGOZWBz$PmfCycChoxeJ3GgGzwvhlgacb9mUoZ.KUXNCssekER4SJ7bOK53uXrHNb2e4i8yPFgSKyzaW9CcmrDXWIEMtD1"
	)

	conn =
	conn
	\|> assign(:auth_user, user)
	\|> assign(:auth_credentials, %{password: "password"})
	\|> AuthenticationPlug.call(%{})

	assert conn.assigns.user.id == conn.assigns.auth_user.id
	assert PlugHelper.plug_skipped?(conn, OAuthScopesPlug)

	user = User.get_by_id(user.id)
	assert "$pbkdf2" <> _ = user.password_hash
	end

	describe "checkpw/2" do
	test "check pbkdf2 hash" do
	hash =
	"$pbkdf2-sha512$160000$loXqbp8GYls43F0i6lEfIw$AY.Ep.2pGe57j2hAPY635sI/6w7l9Q9u9Bp02PkPmF3OrClDtJAI8bCiivPr53OKMF7ph6iHhN68Rom5nEfC2A"

	assert AuthenticationPlug.checkpw("test-password", hash)
	refute AuthenticationPlug.checkpw("test-password1", hash)
	end

	@tag :skip_on_mac
	test "check sha512-crypt hash" do
	hash =
	"$6$9psBWV8gxkGOZWBz$PmfCycChoxeJ3GgGzwvhlgacb9mUoZ.KUXNCssekER4SJ7bOK53uXrHNb2e4i8yPFgSKyzaW9CcmrDXWIEMtD1"

	assert AuthenticationPlug.checkpw("password", hash)
	end

	test "check bcrypt hash" do
	hash = "$2a$10$uyhC/R/zoE1ndwwCtMusK.TLVzkQ/Ugsbqp3uXI.CTTz0gBw.24jS"

	assert AuthenticationPlug.checkpw("password", hash)
	refute AuthenticationPlug.checkpw("password1", hash)
	end

	test "it returns false when hash invalid" do
	hash =
	"psBWV8gxkGOZWBz$PmfCycChoxeJ3GgGzwvhlgacb9mUoZ.KUXNCssekER4SJ7bOK53uXrHNb2e4i8yPFgSKyzaW9CcmrDXWIEMtD1"

	assert capture_log(fn ->
	refute Pleroma.Plugs.AuthenticationPlug.checkpw("password", hash)
	end) =~ "[error] Password hash not recognized"
	end
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Sat, Aug 29, 1:40 PM (1 d, 16 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1737100
Default Alt Text: (60 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions