No OneTemporary
Actions

Size

40 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/CHANGELOG.md b/CHANGELOG.md
	index 6d43bfe90..b92129849 100644
	--- a/CHANGELOG.md
	+++ b/CHANGELOG.md
	@@ -1,200 +1,201 @@
	# Changelog
	All notable changes to this project will be documented in this file.

	The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).

	## [Unreleased]
	### Added
	- MRF: Support for priming the mediaproxy cache (`Pleroma.Web.ActivityPub.MRF.MediaProxyWarmingPolicy`)
	Configuration: `federation_incoming_replies_max_depth` option
	- Mastodon API: Support for the [`tagged` filter](https://github.com/tootsuite/mastodon/pull/9755) in [`GET /api/v1/accounts/:id/statuses`](https://docs.joinmastodon.org/api/rest/accounts/#get-api-v1-accounts-id-statuses)
	+- Mastodon API, streaming: Add support for passing the token in the `Sec-WebSocket-Protocol` header
	- Admin API: Return users' tags when querying reports
	- Admin API: Return avatar and display name when querying users
	-- Mastodon API, streaming: Add support for passing the token in the `Sec-WebSocket-Protocol` header
	+- Admin API: Allow querying user by ID
	- Added synchronization of following/followers counters for external users

	### Fixed
	- Not being able to pin unlisted posts
	- Metadata rendering errors resulting in the entire page being inaccessible
	- Mastodon API: Handling of search timeouts (`/api/v1/search` and `/api/v2/search`)
	- Mastodon API: Embedded relationships not being properly rendered in the Account entity of Status entity

	### Changed
	- Configuration: OpenGraph and TwitterCard providers enabled by default
	- Configuration: Filter.AnonymizeFilename added ability to retain file extension with custom text

	### Changed
	- NodeInfo: Return `skipThreadContainment` in `metadata` for the `skip_thread_containment` option

	## [1.0.0] - 2019-06-29
	### Security
	- Mastodon API: Fix display names not being sanitized
	- Rich media: Do not crawl private IP ranges

	### Added
	- Add a generic settings store for frontends / clients to use.
	- Explicit addressing option for posting.
	- Optional SSH access mode. (Needs `erlang-ssh` package on some distributions).
	- [MongooseIM](https://github.com/esl/MongooseIM) http authentication support.
	- LDAP authentication
	- External OAuth provider authentication
	- Support for building a release using [`mix release`](https://hexdocs.pm/mix/master/Mix.Tasks.Release.html)
	- A [job queue](https://git.pleroma.social/pleroma/pleroma_job_queue) for federation, emails, web push, etc.
	- [Prometheus](https://prometheus.io/) metrics
	- Support for Mastodon's remote interaction
	- Mix Tasks: `mix pleroma.database bump_all_conversations`
	- Mix Tasks: `mix pleroma.database remove_embedded_objects`
	- Mix Tasks: `mix pleroma.database update_users_following_followers_counts`
	- Mix Tasks: `mix pleroma.user toggle_confirmed`
	- Mix Tasks: `mix pleroma.config migrate_to_db`
	- Mix Tasks: `mix pleroma.config migrate_from_db`
	- Federation: Support for `Question` and `Answer` objects
	- Federation: Support for reports
	- Configuration: `poll_limits` option
	- Configuration: `pack_extensions` option
	- Configuration: `safe_dm_mentions` option
	- Configuration: `link_name` option
	- Configuration: `fetch_initial_posts` option
	- Configuration: `notify_email` option
	- Configuration: Media proxy `whitelist` option
	- Configuration: `report_uri` option
	- Configuration: `limit_to_local_content` option
	- Pleroma API: User subscriptions
	- Pleroma API: Healthcheck endpoint
	- Pleroma API: `/api/v1/pleroma/mascot` per-user frontend mascot configuration endpoints
	- Admin API: Endpoints for listing/revoking invite tokens
	- Admin API: Endpoints for making users follow/unfollow each other
	- Admin API: added filters (role, tags, email, name) for users endpoint
	- Admin API: Endpoints for managing reports
	- Admin API: Endpoints for deleting and changing the scope of individual reported statuses
	- Admin API: Endpoints to view and change config settings.
	- AdminFE: initial release with basic user management accessible at /pleroma/admin/
	- Mastodon API: Add chat token to `verify_credentials` response
	- Mastodon API: Add background image setting to `update_credentials`
	- Mastodon API: [Scheduled statuses](https://docs.joinmastodon.org/api/rest/scheduled-statuses/)
	- Mastodon API: `/api/v1/notifications/destroy_multiple` (glitch-soc extension)
	- Mastodon API: `/api/v1/pleroma/accounts/:id/favourites` (API extension)
	- Mastodon API: [Reports](https://docs.joinmastodon.org/api/rest/reports/)
	- Mastodon API: `POST /api/v1/accounts` (account creation API)
	- Mastodon API: [Polls](https://docs.joinmastodon.org/api/rest/polls/)
	- ActivityPub C2S: OAuth endpoints
	- Metadata: RelMe provider
	- OAuth: added support for refresh tokens
	- Emoji packs and emoji pack manager
	- Object pruning (`mix pleroma.database prune_objects`)
	- OAuth: added job to clean expired access tokens
	- MRF: Support for rejecting reports from specific instances (`mrf_simple`)
	- MRF: Support for stripping avatars and banner images from specific instances (`mrf_simple`)
	- Ability to reset avatar, profile banner and backgroud
	- MRF: Support for running subchains.
	- Configuration: `skip_thread_containment` option
	- Configuration: `rate_limit` option. See `Pleroma.Plugs.RateLimiter` documentation for details.
	- MRF: Support for filtering out likely spam messages by rejecting posts from new users that contain links.
	- Configuration: `ignore_hosts` option
	- Configuration: `ignore_tld` option
	- Configuration: default syslog tag "Pleroma" is now lowercased to "pleroma"

	### Changed
	- Breaking: bind to 127.0.0.1 instead of 0.0.0.0 by default
	- Breaking: Configuration: move from Pleroma.Mailer to Pleroma.Emails.Mailer
	- Thread containment / test for complete visibility will be skipped by default.
	- Enforcement of OAuth scopes
	- Add multiple use/time expiring invite token
	- Restyled OAuth pages to fit with Pleroma's default theme
	- Link/mention/hashtag detection is now handled by [auto_linker](https://git.pleroma.social/pleroma/auto_linker)
	- NodeInfo: Return `safe_dm_mentions` feature flag
	- Federation: Expand the audience of delete activities to all recipients of the deleted object
	- Federation: Removed `inReplyToStatusId` from objects
	- Configuration: Dedupe enabled by default
	- Configuration: Default log level in `prod` environment is now set to `warn`
	- Configuration: Added `extra_cookie_attrs` for setting non-standard cookie attributes. Defaults to ["SameSite=Lax"] so that remote follows work.
	- Timelines: Messages involving people you have blocked will be excluded from the timeline in all cases instead of just repeats.
	- Admin API: Move the user related API to `api/pleroma/admin/users`
	- Pleroma API: Support for emoji tags in `/api/pleroma/emoji` resulting in a breaking API change
	- Mastodon API: Support for `exclude_types`, `limit` and `min_id` in `/api/v1/notifications`
	- Mastodon API: Add `languages` and `registrations` to `/api/v1/instance`
	- Mastodon API: Provide plaintext versions of cw/content in the Status entity
	- Mastodon API: Add `pleroma.conversation_id`, `pleroma.in_reply_to_account_acct` fields to the Status entity
	- Mastodon API: Add `pleroma.tags`, `pleroma.relationship{}`, `pleroma.is_moderator`, `pleroma.is_admin`, `pleroma.confirmation_pending`, `pleroma.hide_followers`, `pleroma.hide_follows`, `pleroma.hide_favorites` fields to the User entity
	- Mastodon API: Add `pleroma.show_role`, `pleroma.no_rich_text` fields to the Source subentity
	- Mastodon API: Add support for updating `no_rich_text`, `hide_followers`, `hide_follows`, `hide_favorites`, `show_role` in `PATCH /api/v1/update_credentials`
	- Mastodon API: Add `pleroma.is_seen` to the Notification entity
	- Mastodon API: Add `pleroma.local` to the Status entity
	- Mastodon API: Add `preview` parameter to `POST /api/v1/statuses`
	- Mastodon API: Add `with_muted` parameter to timeline endpoints
	- Mastodon API: Actual reblog hiding instead of a dummy
	- Mastodon API: Remove attachment limit in the Status entity
	- Mastodon API: Added support max_id & since_id for bookmark timeline endpoints.
	- Deps: Updated Cowboy to 2.6
	- Deps: Updated Ecto to 3.0.7
	- Don't ship finmoji by default, they can be installed as an emoji pack
	- Hide deactivated users and their statuses
	- Posts which are marked sensitive or tagged nsfw no longer have link previews.
	- HTTP connection timeout is now set to 10 seconds.
	- Respond with a 404 Not implemented JSON error message when requested API is not implemented
	- Rich Media: crawl only https URLs.

	### Fixed
	- Follow requests don't get 'stuck' anymore.
	- Added an FTS index on objects. Running `vacuum analyze` and setting a larger `work_mem` is recommended.
	- Followers counter not being updated when a follower is blocked
	- Deactivated users being able to request an access token
	- Limit on request body in rich media/relme parsers being ignored resulting in a possible memory leak
	- Proper Twitter Card generation instead of a dummy
	- Deletions failing for users with a large number of posts
	- NodeInfo: Include admins in `staffAccounts`
	- ActivityPub: Crashing when requesting empty local user's outbox
	- Federation: Handling of objects without `summary` property
	- Federation: Add a language tag to activities as required by ActivityStreams 2.0
	- Federation: Do not federate avatar/banner if set to default allowing other servers/clients to use their defaults
	- Federation: Cope with missing or explicitly nulled address lists
	- Federation: Explicitly ensure activities addressed to `as:Public` become addressed to the followers collection
	- Federation: Better cope with actors which do not declare a followers collection and use `as:Public` with these semantics
	- Federation: Follow requests from remote users who have been blocked will be automatically rejected if appropriate
	- MediaProxy: Parse name from content disposition headers even for non-whitelisted types
	- MediaProxy: S3 link encoding
	- Rich Media: Reject any data which cannot be explicitly encoded into JSON
	- Pleroma API: Importing follows from Mastodon 2.8+
	- Twitter API: Exposing default scope, `no_rich_text` of the user to anyone
	- Twitter API: Returning the `role` object in user entity despite `show_role = false`
	- Mastodon API: `/api/v1/favourites` serving only public activities
	- Mastodon API: Reblogs having `in_reply_to_id` - `null` even when they are replies
	- Mastodon API: Streaming API broadcasting wrong activity id
	- Mastodon API: 500 errors when requesting a card for a private conversation
	- Mastodon API: Handling of `reblogs` in `/api/v1/accounts/:id/follow`
	- Mastodon API: Correct `reblogged`, `favourited`, and `bookmarked` values in the reblog status JSON
	- Mastodon API: Exposing default scope of the user to anyone
	- Mastodon API: Make `irreversible` field default to `false` [`POST /api/v1/filters`]
	- Mastodon API: Replace missing non-nullable Card attributes with empty strings
	- User-Agent is now sent correctly for all HTTP requests.
	- MRF: Simple policy now properly delists imported or relayed statuses

	## Removed
	- Configuration: `config :pleroma, :fe` in favor of the more flexible `config :pleroma, :frontend_configurations`

	## [0.9.99999] - 2019-05-31
	### Security
	- Mastodon API: Fix lists leaking private posts

	## [0.9.9999] - 2019-04-05
	### Security
	- Mastodon API: Fix content warnings skipping HTML sanitization

	## [0.9.999] - 2019-03-13
	Frontend changes only.
	### Added
	- Added floating action button for posting status on mobile
	### Changed
	- Changed user-settings icon to a pencil
	### Fixed
	- Keyboard shortcuts activating when typing a message
	- Gaps when scrolling down on a timeline after showing new

	## [0.9.99] - 2019-03-08
	### Changed
	- Update the frontend to the 0.9.99 tag
	### Fixed
	- Sign the date header in federation to fix Mastodon federation.

	## [0.9.9] - 2019-02-22
	This is our first stable release.
	diff --git a/docs/api/admin_api.md b/docs/api/admin_api.md
	index 74bde3ece..bce5e399b 100644
	--- a/docs/api/admin_api.md
	+++ b/docs/api/admin_api.md
	@@ -1,652 +1,652 @@
	# Admin API

	Authentication is required and the user must be an admin.

	## `/api/pleroma/admin/users`

	### List users

	- Method `GET`
	- Query Params:
	- optional `query`: string search term (e.g. nickname, domain, nickname@domain)
	- optional `filters`: string comma-separated string of filters:
	- `local`: only local users
	- `external`: only external users
	- `active`: only active users
	- `deactivated`: only deactivated users
	- `is_admin`: users with admin role
	- `is_moderator`: users with moderator role
	- optional `page`: integer page number
	- optional `page_size`: integer number of users per page (default is `50`)
	- optional `tags`: [string] tags list
	- optional `name`: string user display name
	- optional `email`: string user email
	- Example: `https://mypleroma.org/api/pleroma/admin/users?query=john&filters=local,active&page=1&page_size=10&tags[]=some_tag&tags[]=another_tag&name=display_name&email=email@example.com`
	- Response:

	```json
	{
	"page_size": integer,
	"count": integer,
	"users": [
	{
	"deactivated": bool,
	"id": integer,
	"nickname": string,
	"roles": {
	"admin": bool,
	"moderator": bool
	},
	"local": bool,
	"tags": array,
	"avatar": string,
	"display_name": string
	},
	...
	]
	}
	```

	## `/api/pleroma/admin/users`

	### Remove a user

	- Method `DELETE`
	- Params:
	- `nickname`
	- Response: User’s nickname

	### Create a user

	- Method: `POST`
	- Params:
	- `nickname`
	- `email`
	- `password`
	- Response: User’s nickname

	## `/api/pleroma/admin/users/follow`
	### Make a user follow another user

	- Methods: `POST`
	- Params:
	- `follower`: The nickname of the follower
	- `followed`: The nickname of the followed
	- Response:
	- "ok"

	## `/api/pleroma/admin/users/unfollow`
	### Make a user unfollow another user

	- Methods: `POST`
	- Params:
	- `follower`: The nickname of the follower
	- `followed`: The nickname of the followed
	- Response:
	- "ok"

	## `/api/pleroma/admin/users/:nickname/toggle_activation`

	### Toggle user activation

	- Method: `PATCH`
	- Params:
	- `nickname`
	- Response: User’s object

	```json
	{
	"deactivated": bool,
	"id": integer,
	"nickname": string
	}
	```

	## `/api/pleroma/admin/users/tag`

	### Tag a list of users

	- Method: `PUT`
	- Params:
	- `nicknames` (array)
	- `tags` (array)

	### Untag a list of users

	- Method: `DELETE`
	- Params:
	- `nicknames` (array)
	- `tags` (array)

	## `/api/pleroma/admin/users/:nickname/permission_group`

	### Get user user permission groups membership

	- Method: `GET`
	- Params: none
	- Response:

	```json
	{
	"is_moderator": bool,
	"is_admin": bool
	}
	```

	## `/api/pleroma/admin/users/:nickname/permission_group/:permission_group`

	Note: Available `:permission_group` is currently moderator and admin. 404 is returned when the permission group doesn’t exist.

	### Get user user permission groups membership per permission group

	- Method: `GET`
	- Params: none
	- Response:

	```json
	{
	"is_moderator": bool,
	"is_admin": bool
	}
	```

	### Add user in permission group

	- Method: `POST`
	- Params: none
	- Response:
	- On failure: `{"error": "…"}`
	- On success: JSON of the `user.info`

	### Remove user from permission group

	- Method: `DELETE`
	- Params: none
	- Response:
	- On failure: `{"error": "…"}`
	- On success: JSON of the `user.info`
	- Note: An admin cannot revoke their own admin status.

	## `/api/pleroma/admin/users/:nickname/activation_status`

	### Active or deactivate a user

	- Method: `PUT`
	- Params:
	- `nickname`
	- `status` BOOLEAN field, false value means deactivation.

	-## `/api/pleroma/admin/users/:nickname`
	+## `/api/pleroma/admin/users/:nickname_or_id`

	### Retrive the details of a user

	- Method: `GET`
	- Params:
	- - `nickname`
	+ - `nickname` or `id`
	- Response:
	- On failure: `Not found`
	- On success: JSON of the user

	## `/api/pleroma/admin/relay`

	### Follow a Relay

	- Methods: `POST`
	- Params:
	- `relay_url`
	- Response:
	- On success: URL of the followed relay

	### Unfollow a Relay

	- Methods: `DELETE`
	- Params:
	- `relay_url`
	- Response:
	- On success: URL of the unfollowed relay

	## `/api/pleroma/admin/users/invite_token`

	### Get an account registration invite token

	- Methods: `GET`
	- Params:
	- optional `invite` => [
	- optional `max_use` (integer)
	- optional `expires_at` (date string e.g. "2019-04-07")
	]
	- Response: invite token (base64 string)

	## `/api/pleroma/admin/users/invites`

	### Get a list of generated invites

	- Methods: `GET`
	- Params: none
	- Response:

	```json
	{

	"invites": [
	{
	"id": integer,
	"token": string,
	"used": boolean,
	"expires_at": date,
	"uses": integer,
	"max_use": integer,
	"invite_type": string (possible values: `one_time`, `reusable`, `date_limited`, `reusable_date_limited`)
	},
	...
	]
	}
	```

	## `/api/pleroma/admin/users/revoke_invite`

	### Revoke invite by token

	- Methods: `POST`
	- Params:
	- `token`
	- Response:

	```json
	{
	"id": integer,
	"token": string,
	"used": boolean,
	"expires_at": date,
	"uses": integer,
	"max_use": integer,
	"invite_type": string (possible values: `one_time`, `reusable`, `date_limited`, `reusable_date_limited`)

	}
	```


	## `/api/pleroma/admin/users/email_invite`

	### Sends registration invite via email

	- Methods: `POST`
	- Params:
	- `email`
	- `name`, optional

	## `/api/pleroma/admin/users/:nickname/password_reset`

	### Get a password reset token for a given nickname

	- Methods: `GET`
	- Params: none
	- Response: password reset token (base64 string)

	## `/api/pleroma/admin/reports`
	### Get a list of reports
	- Method `GET`
	- Params:
	- `state`: optional, the state of reports. Valid values are `open`, `closed` and `resolved`
	- `limit`: optional, the number of records to retrieve
	- `since_id`: optional, returns results that are more recent than the specified id
	- `max_id`: optional, returns results that are older than the specified id
	- Response:
	- On failure: 403 Forbidden error `{"error": "error_msg"}` when requested by anonymous or non-admin
	- On success: JSON, returns a list of reports, where:
	- `account`: the user who has been reported
	- `actor`: the user who has sent the report
	- `statuses`: list of statuses that have been included to the report

	```json
	{
	"reports": [
	{
	"account": {
	"acct": "user",
	"avatar": "https://pleroma.example.org/images/avi.png",
	"avatar_static": "https://pleroma.example.org/images/avi.png",
	"bot": false,
	"created_at": "2019-04-23T17:32:04.000Z",
	"display_name": "User",
	"emojis": [],
	"fields": [],
	"followers_count": 1,
	"following_count": 1,
	"header": "https://pleroma.example.org/images/banner.png",
	"header_static": "https://pleroma.example.org/images/banner.png",
	"id": "9i6dAJqSGSKMzLG2Lo",
	"locked": false,
	"note": "",
	"pleroma": {
	"confirmation_pending": false,
	"hide_favorites": true,
	"hide_followers": false,
	"hide_follows": false,
	"is_admin": false,
	"is_moderator": false,
	"relationship": {},
	"tags": []
	},
	"source": {
	"note": "",
	"pleroma": {},
	"sensitive": false
	},
	"tags": ["force_unlisted"],
	"statuses_count": 3,
	"url": "https://pleroma.example.org/users/user",
	"username": "user"
	},
	"actor": {
	"acct": "lain",
	"avatar": "https://pleroma.example.org/images/avi.png",
	"avatar_static": "https://pleroma.example.org/images/avi.png",
	"bot": false,
	"created_at": "2019-03-28T17:36:03.000Z",
	"display_name": "Roger Braun",
	"emojis": [],
	"fields": [],
	"followers_count": 1,
	"following_count": 1,
	"header": "https://pleroma.example.org/images/banner.png",
	"header_static": "https://pleroma.example.org/images/banner.png",
	"id": "9hEkA5JsvAdlSrocam",
	"locked": false,
	"note": "",
	"pleroma": {
	"confirmation_pending": false,
	"hide_favorites": false,
	"hide_followers": false,
	"hide_follows": false,
	"is_admin": false,
	"is_moderator": false,
	"relationship": {},
	"tags": []
	},
	"source": {
	"note": "",
	"pleroma": {},
	"sensitive": false
	},
	"tags": ["force_unlisted"],
	"statuses_count": 1,
	"url": "https://pleroma.example.org/users/lain",
	"username": "lain"
	},
	"content": "Please delete it",
	"created_at": "2019-04-29T19:48:15.000Z",
	"id": "9iJGOv1j8hxuw19bcm",
	"state": "open",
	"statuses": [
	{
	"account": { ... },
	"application": {
	"name": "Web",
	"website": null
	},
	"bookmarked": false,
	"card": null,
	"content": "<span class=\"h-card\"><a data-user=\"9hEkA5JsvAdlSrocam\" class=\"u-url mention\" href=\"https://pleroma.example.org/users/lain\">@<span>lain</span></a></span> click on my link <a href=\"https://www.google.com/\">https://www.google.com/</a>",
	"created_at": "2019-04-23T19:15:47.000Z",
	"emojis": [],
	"favourited": false,
	"favourites_count": 0,
	"id": "9i6mQ9uVrrOmOime8m",
	"in_reply_to_account_id": null,
	"in_reply_to_id": null,
	"language": null,
	"media_attachments": [],
	"mentions": [
	{
	"acct": "lain",
	"id": "9hEkA5JsvAdlSrocam",
	"url": "https://pleroma.example.org/users/lain",
	"username": "lain"
	},
	{
	"acct": "user",
	"id": "9i6dAJqSGSKMzLG2Lo",
	"url": "https://pleroma.example.org/users/user",
	"username": "user"
	}
	],
	"muted": false,
	"pinned": false,
	"pleroma": {
	"content": {
	"text/plain": "@lain click on my link https://www.google.com/"
	},
	"conversation_id": 28,
	"in_reply_to_account_acct": null,
	"local": true,
	"spoiler_text": {
	"text/plain": ""
	}
	},
	"reblog": null,
	"reblogged": false,
	"reblogs_count": 0,
	"replies_count": 0,
	"sensitive": false,
	"spoiler_text": "",
	"tags": [],
	"uri": "https://pleroma.example.org/objects/8717b90f-8e09-4b58-97b0-e3305472b396",
	"url": "https://pleroma.example.org/notice/9i6mQ9uVrrOmOime8m",
	"visibility": "direct"
	}
	]
	}
	]
	}
	```

	## `/api/pleroma/admin/reports/:id`
	### Get an individual report
	- Method `GET`
	- Params:
	- `id`
	- Response:
	- On failure:
	- 403 Forbidden `{"error": "error_msg"}`
	- 404 Not Found `"Not found"`
	- On success: JSON, Report object (see above)

	## `/api/pleroma/admin/reports/:id`
	### Change the state of the report
	- Method `PUT`
	- Params:
	- `id`
	- `state`: required, the new state. Valid values are `open`, `closed` and `resolved`
	- Response:
	- On failure:
	- 400 Bad Request `"Unsupported state"`
	- 403 Forbidden `{"error": "error_msg"}`
	- 404 Not Found `"Not found"`
	- On success: JSON, Report object (see above)

	## `/api/pleroma/admin/reports/:id/respond`
	### Respond to a report
	- Method `POST`
	- Params:
	- `id`
	- `status`: required, the message
	- Response:
	- On failure:
	- 400 Bad Request `"Invalid parameters"` when `status` is missing
	- 403 Forbidden `{"error": "error_msg"}`
	- 404 Not Found `"Not found"`
	- On success: JSON, created Mastodon Status entity

	```json
	{
	"account": { ... },
	"application": {
	"name": "Web",
	"website": null
	},
	"bookmarked": false,
	"card": null,
	"content": "Your claim is going to be closed",
	"created_at": "2019-05-11T17:13:03.000Z",
	"emojis": [],
	"favourited": false,
	"favourites_count": 0,
	"id": "9ihuiSL1405I65TmEq",
	"in_reply_to_account_id": null,
	"in_reply_to_id": null,
	"language": null,
	"media_attachments": [],
	"mentions": [
	{
	"acct": "user",
	"id": "9i6dAJqSGSKMzLG2Lo",
	"url": "https://pleroma.example.org/users/user",
	"username": "user"
	},
	{
	"acct": "admin",
	"id": "9hEkA5JsvAdlSrocam",
	"url": "https://pleroma.example.org/users/admin",
	"username": "admin"
	}
	],
	"muted": false,
	"pinned": false,
	"pleroma": {
	"content": {
	"text/plain": "Your claim is going to be closed"
	},
	"conversation_id": 35,
	"in_reply_to_account_acct": null,
	"local": true,
	"spoiler_text": {
	"text/plain": ""
	}
	},
	"reblog": null,
	"reblogged": false,
	"reblogs_count": 0,
	"replies_count": 0,
	"sensitive": false,
	"spoiler_text": "",
	"tags": [],
	"uri": "https://pleroma.example.org/objects/cab0836d-9814-46cd-a0ea-529da9db5fcb",
	"url": "https://pleroma.example.org/notice/9ihuiSL1405I65TmEq",
	"visibility": "direct"
	}
	```

	## `/api/pleroma/admin/statuses/:id`
	### Change the scope of an individual reported status
	- Method `PUT`
	- Params:
	- `id`
	- `sensitive`: optional, valid values are `true` or `false`
	- `visibility`: optional, valid values are `public`, `private` and `unlisted`
	- Response:
	- On failure:
	- 400 Bad Request `"Unsupported visibility"`
	- 403 Forbidden `{"error": "error_msg"}`
	- 404 Not Found `"Not found"`
	- On success: JSON, Mastodon Status entity

	## `/api/pleroma/admin/statuses/:id`
	### Delete an individual reported status
	- Method `DELETE`
	- Params:
	- `id`
	- Response:
	- On failure:
	- 403 Forbidden `{"error": "error_msg"}`
	- 404 Not Found `"Not found"`
	- On success: 200 OK `{}`

	## `/api/pleroma/admin/config`
	### List config settings
	- Method `GET`
	- Params: none
	- Response:

	```json
	{
	configs: [
	{
	"group": string,
	"key": string,
	"value": string or {} or [] or {"tuple": []}
	}
	]
	}
	```

	## `/api/pleroma/admin/config`
	### Update config settings
	Module name can be passed as string, which starts with `Pleroma`, e.g. `"Pleroma.Upload"`.
	Atom or boolean value can be passed with `:` in the beginning, e.g. `":true"`, `":upload"`. For keys it is not needed.
	Integer with `i:`, e.g. `"i:150"`.
	Tuple with more than 2 values with `{"tuple": ["first_val", Pleroma.Module, []]}`.
	`{"tuple": ["some_string", "Pleroma.Some.Module", []]}` will be converted to `{"some_string", Pleroma.Some.Module, []}`.

	Compile time settings (need instance reboot):
	- all settings by this keys:
	- `:hackney_pools`
	- `:chat`
	- `Pleroma.Web.Endpoint`
	- `Pleroma.Repo`
	- part settings:
	- `Pleroma.Captcha` -> `:seconds_valid`
	- `Pleroma.Upload` -> `:proxy_remote`
	- `:instance` -> `:upload_limit`

	- Method `POST`
	- Params:
	- `configs` => [
	- `group` (string)
	- `key` (string)
	- `value` (string, [], {} or {"tuple": []})
	- `delete` = true (optional, if parameter must be deleted)
	]

	- Request (example):

	```json
	{
	configs: [
	{
	"group": "pleroma",
	"key": "Pleroma.Upload",
	"value": {
	"uploader": "Pleroma.Uploaders.Local",
	"filters": ["Pleroma.Upload.Filter.Dedupe"],
	"link_name": ":true",
	"proxy_remote": ":false",
	"proxy_opts": {
	"redirect_on_failure": ":false",
	"max_body_length": "i:1048576",
	"http": {
	"follow_redirect": ":true",
	"pool": ":upload"
	}
	},
	"dispatch": {
	"tuple": ["/api/v1/streaming", "Pleroma.Web.MastodonAPI.WebsocketHandler", []]
	}
	}
	}
	]
	}

	- Response:

	```json
	{
	configs: [
	{
	"group": string,
	"key": string,
	"value": string or {} or [] or {"tuple": []}
	}
	]
	}
	```
	diff --git a/lib/pleroma/web/admin_api/admin_api_controller.ex b/lib/pleroma/web/admin_api/admin_api_controller.ex
	index 498beb56a..0a2482a8c 100644
	--- a/lib/pleroma/web/admin_api/admin_api_controller.ex
	+++ b/lib/pleroma/web/admin_api/admin_api_controller.ex
	@@ -1,447 +1,447 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.AdminAPI.AdminAPIController do
	use Pleroma.Web, :controller
	alias Pleroma.Activity
	alias Pleroma.User
	alias Pleroma.UserInviteToken
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Relay
	alias Pleroma.Web.AdminAPI.AccountView
	alias Pleroma.Web.AdminAPI.Config
	alias Pleroma.Web.AdminAPI.ConfigView
	alias Pleroma.Web.AdminAPI.ReportView
	alias Pleroma.Web.AdminAPI.Search
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.MastodonAPI.StatusView

	import Pleroma.Web.ControllerHelper, only: [json_response: 3]

	require Logger

	@users_page_size 50

	action_fallback(:errors)

	def user_delete(conn, %{"nickname" => nickname}) do
	User.get_cached_by_nickname(nickname)
	\|> User.delete()

	conn
	\|> json(nickname)
	end

	def user_follow(conn, %{"follower" => follower_nick, "followed" => followed_nick}) do
	with %User{} = follower <- User.get_cached_by_nickname(follower_nick),
	%User{} = followed <- User.get_cached_by_nickname(followed_nick) do
	User.follow(follower, followed)
	end

	conn
	\|> json("ok")
	end

	def user_unfollow(conn, %{"follower" => follower_nick, "followed" => followed_nick}) do
	with %User{} = follower <- User.get_cached_by_nickname(follower_nick),
	%User{} = followed <- User.get_cached_by_nickname(followed_nick) do
	User.unfollow(follower, followed)
	end

	conn
	\|> json("ok")
	end

	def user_create(
	conn,
	%{"nickname" => nickname, "email" => email, "password" => password}
	) do
	user_data = %{
	nickname: nickname,
	name: nickname,
	email: email,
	password: password,
	password_confirmation: password,
	bio: "."
	}

	changeset = User.register_changeset(%User{}, user_data, need_confirmation: false)
	{:ok, user} = User.register(changeset)

	conn
	\|> json(user.nickname)
	end

	def user_show(conn, %{"nickname" => nickname}) do
	- with %User{} = user <- User.get_cached_by_nickname(nickname) do
	+ with %User{} = user <- User.get_cached_by_nickname_or_id(nickname) do
	conn
	\|> json(AccountView.render("show.json", %{user: user}))
	else
	_ -> {:error, :not_found}
	end
	end

	def user_toggle_activation(conn, %{"nickname" => nickname}) do
	user = User.get_cached_by_nickname(nickname)

	{:ok, updated_user} = User.deactivate(user, !user.info.deactivated)

	conn
	\|> json(AccountView.render("show.json", %{user: updated_user}))
	end

	def tag_users(conn, %{"nicknames" => nicknames, "tags" => tags}) do
	with {:ok, _} <- User.tag(nicknames, tags),
	do: json_response(conn, :no_content, "")
	end

	def untag_users(conn, %{"nicknames" => nicknames, "tags" => tags}) do
	with {:ok, _} <- User.untag(nicknames, tags),
	do: json_response(conn, :no_content, "")
	end

	def list_users(conn, params) do
	{page, page_size} = page_params(params)
	filters = maybe_parse_filters(params["filters"])

	search_params = %{
	query: params["query"],
	page: page,
	page_size: page_size,
	tags: params["tags"],
	name: params["name"],
	email: params["email"]
	}

	with {:ok, users, count} <- Search.user(Map.merge(search_params, filters)),
	do:
	conn
	\|> json(
	AccountView.render("index.json",
	users: users,
	count: count,
	page_size: page_size
	)
	)
	end

	@filters ~w(local external active deactivated is_admin is_moderator)

	@spec maybe_parse_filters(String.t()) :: %{required(String.t()) => true} \| %{}
	defp maybe_parse_filters(filters) when is_nil(filters) or filters == "", do: %{}

	defp maybe_parse_filters(filters) do
	filters
	\|> String.split(",")
	\|> Enum.filter(&Enum.member?(@filters, &1))
	\|> Enum.map(&String.to_atom(&1))
	\|> Enum.into(%{}, &{&1, true})
	end

	def right_add(conn, %{"permission_group" => permission_group, "nickname" => nickname})
	when permission_group in ["moderator", "admin"] do
	user = User.get_cached_by_nickname(nickname)

	info =
	%{}
	\|> Map.put("is_" <> permission_group, true)

	info_cng = User.Info.admin_api_update(user.info, info)

	cng =
	user
	\|> Ecto.Changeset.change()
	\|> Ecto.Changeset.put_embed(:info, info_cng)

	{:ok, _user} = User.update_and_set_cache(cng)

	json(conn, info)
	end

	def right_add(conn, _) do
	conn
	\|> put_status(404)
	\|> json(%{error: "No such permission_group"})
	end

	def right_get(conn, %{"nickname" => nickname}) do
	user = User.get_cached_by_nickname(nickname)

	conn
	\|> json(%{
	is_moderator: user.info.is_moderator,
	is_admin: user.info.is_admin
	})
	end

	def right_delete(
	%{assigns: %{user: %User{:nickname => admin_nickname}}} = conn,
	%{
	"permission_group" => permission_group,
	"nickname" => nickname
	}
	)
	when permission_group in ["moderator", "admin"] do
	if admin_nickname == nickname do
	conn
	\|> put_status(403)
	\|> json(%{error: "You can't revoke your own admin status."})
	else
	user = User.get_cached_by_nickname(nickname)

	info =
	%{}
	\|> Map.put("is_" <> permission_group, false)

	info_cng = User.Info.admin_api_update(user.info, info)

	cng =
	Ecto.Changeset.change(user)
	\|> Ecto.Changeset.put_embed(:info, info_cng)

	{:ok, _user} = User.update_and_set_cache(cng)

	json(conn, info)
	end
	end

	def right_delete(conn, _) do
	conn
	\|> put_status(404)
	\|> json(%{error: "No such permission_group"})
	end

	def set_activation_status(conn, %{"nickname" => nickname, "status" => status}) do
	with {:ok, status} <- Ecto.Type.cast(:boolean, status),
	%User{} = user <- User.get_cached_by_nickname(nickname),
	{:ok, _} <- User.deactivate(user, !status),
	do: json_response(conn, :no_content, "")
	end

	def relay_follow(conn, %{"relay_url" => target}) do
	with {:ok, _message} <- Relay.follow(target) do
	json(conn, target)
	else
	_ ->
	conn
	\|> put_status(500)
	\|> json(target)
	end
	end

	def relay_unfollow(conn, %{"relay_url" => target}) do
	with {:ok, _message} <- Relay.unfollow(target) do
	json(conn, target)
	else
	_ ->
	conn
	\|> put_status(500)
	\|> json(target)
	end
	end

	@doc "Sends registration invite via email"
	def email_invite(%{assigns: %{user: user}} = conn, %{"email" => email} = params) do
	with true <-
	Pleroma.Config.get([:instance, :invites_enabled]) &&
	!Pleroma.Config.get([:instance, :registrations_open]),
	{:ok, invite_token} <- UserInviteToken.create_invite(),
	email <-
	Pleroma.Emails.UserEmail.user_invitation_email(
	user,
	invite_token,
	email,
	params["name"]
	),
	{:ok, _} <- Pleroma.Emails.Mailer.deliver(email) do
	json_response(conn, :no_content, "")
	end
	end

	@doc "Get a account registeration invite token (base64 string)"
	def get_invite_token(conn, params) do
	options = params["invite"] \|\| %{}
	{:ok, invite} = UserInviteToken.create_invite(options)

	conn
	\|> json(invite.token)
	end

	@doc "Get list of created invites"
	def invites(conn, _params) do
	invites = UserInviteToken.list_invites()

	conn
	\|> json(AccountView.render("invites.json", %{invites: invites}))
	end

	@doc "Revokes invite by token"
	def revoke_invite(conn, %{"token" => token}) do
	invite = UserInviteToken.find_by_token!(token)
	{:ok, updated_invite} = UserInviteToken.update_invite(invite, %{used: true})

	conn
	\|> json(AccountView.render("invite.json", %{invite: updated_invite}))
	end

	@doc "Get a password reset token (base64 string) for given nickname"
	def get_password_reset(conn, %{"nickname" => nickname}) do
	(%User{local: true} = user) = User.get_cached_by_nickname(nickname)
	{:ok, token} = Pleroma.PasswordResetToken.create_token(user)

	conn
	\|> json(token.token)
	end

	def list_reports(conn, params) do
	params =
	params
	\|> Map.put("type", "Flag")
	\|> Map.put("skip_preload", true)

	reports =
	[]
	\|> ActivityPub.fetch_activities(params)
	\|> Enum.reverse()

	conn
	\|> put_view(ReportView)
	\|> render("index.json", %{reports: reports})
	end

	def report_show(conn, %{"id" => id}) do
	with %Activity{} = report <- Activity.get_by_id(id) do
	conn
	\|> put_view(ReportView)
	\|> render("show.json", %{report: report})
	else
	_ -> {:error, :not_found}
	end
	end

	def report_update_state(conn, %{"id" => id, "state" => state}) do
	with {:ok, report} <- CommonAPI.update_report_state(id, state) do
	conn
	\|> put_view(ReportView)
	\|> render("show.json", %{report: report})
	end
	end

	def report_respond(%{assigns: %{user: user}} = conn, %{"id" => id} = params) do
	with false <- is_nil(params["status"]),
	%Activity{} <- Activity.get_by_id(id) do
	params =
	params
	\|> Map.put("in_reply_to_status_id", id)
	\|> Map.put("visibility", "direct")

	{:ok, activity} = CommonAPI.post(user, params)

	conn
	\|> put_view(StatusView)
	\|> render("status.json", %{activity: activity})
	else
	true ->
	{:param_cast, nil}

	nil ->
	{:error, :not_found}
	end
	end

	def status_update(conn, %{"id" => id} = params) do
	with {:ok, activity} <- CommonAPI.update_activity_scope(id, params) do
	conn
	\|> put_view(StatusView)
	\|> render("status.json", %{activity: activity})
	end
	end

	def status_delete(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with {:ok, %Activity{}} <- CommonAPI.delete(id, user) do
	json(conn, %{})
	end
	end

	def config_show(conn, _params) do
	configs = Pleroma.Repo.all(Config)

	conn
	\|> put_view(ConfigView)
	\|> render("index.json", %{configs: configs})
	end

	def config_update(conn, %{"configs" => configs}) do
	updated =
	if Pleroma.Config.get([:instance, :dynamic_configuration]) do
	updated =
	Enum.map(configs, fn
	%{"group" => group, "key" => key, "value" => value} ->
	{:ok, config} = Config.update_or_create(%{group: group, key: key, value: value})
	config

	%{"group" => group, "key" => key, "delete" => "true"} ->
	{:ok, _} = Config.delete(%{group: group, key: key})
	nil
	end)
	\|> Enum.reject(&is_nil(&1))

	Pleroma.Config.TransferTask.load_and_update_env()
	Mix.Tasks.Pleroma.Config.run(["migrate_from_db", Pleroma.Config.get(:env), "false"])
	updated
	else
	[]
	end

	conn
	\|> put_view(ConfigView)
	\|> render("index.json", %{configs: updated})
	end

	def errors(conn, {:error, :not_found}) do
	conn
	\|> put_status(404)
	\|> json("Not found")
	end

	def errors(conn, {:error, reason}) do
	conn
	\|> put_status(400)
	\|> json(reason)
	end

	def errors(conn, {:param_cast, _}) do
	conn
	\|> put_status(400)
	\|> json("Invalid parameters")
	end

	def errors(conn, _) do
	conn
	\|> put_status(500)
	\|> json("Something went wrong")
	end

	defp page_params(params) do
	{get_page(params["page"]), get_page_size(params["page_size"])}
	end

	defp get_page(page_string) when is_nil(page_string), do: 1

	defp get_page(page_string) do
	case Integer.parse(page_string) do
	{page, _} -> page
	:error -> 1
	end
	end

	defp get_page_size(page_size_string) when is_nil(page_size_string), do: @users_page_size

	defp get_page_size(page_size_string) do
	case Integer.parse(page_size_string) do
	{page_size, _} -> page_size
	:error -> @users_page_size
	end
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Sat, Sep 19, 7:06 AM (1 d, 15 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1769072
Default Alt Text: (40 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions