Merge branch 'fork' into actions

changelog.d/oban-cancel-badreq.change

@@ -0,0 +1 @@
+Publisher jobs will not retry if the error received is a 400

changelog.d/oban-cancel-poll-result.change

@@ -0,0 +1 @@
+PollWorker jobs will not retry if the activity no longer exists.

changelog.d/oban-cancel-receiverworker.change

@@ -0,0 +1 @@
+Improved detecting unrecoverable errors for incoming federation jobs

changelog.d/rich-media-hardening.fix

@@ -0,0 +1 @@
+Harden Rich Media parsing against very slow or malicious URLs

config/config.exs

@@ -462,7 +462,7 @@ config :pleroma, :rich_media,
     Pleroma.Web.RichMedia.Parsers.TwitterCard,
     Pleroma.Web.RichMedia.Parsers.OEmbed
   ],
-  failure_backoff: 60_000,
+  timeout: 5_000,
   ttl_setters: [
     Pleroma.Web.RichMedia.Parser.TTL.AwsSignedUrl,
     Pleroma.Web.RichMedia.Parser.TTL.Opengraph
@@ -590,6 +590,8 @@ config :pleroma, Pleroma.User,
   ],
   email_blacklist: []
 
+# The Pruner :max_age must be longer than Worker :unique
+# value or it cannot enforce uniqueness.
 config :pleroma, Oban,
   repo: Pleroma.Repo,
   log: false,
@@ -604,7 +606,7 @@ config :pleroma, Oban,
     search_indexing: [limit: 10, paused: true],
     slow: 5
   ],
-  plugins: [Oban.Plugins.Pruner],
+  plugins: [{Oban.Plugins.Pruner, max_age: 900}],
   crontab: [
     {"0 0 * * 0", Pleroma.Workers.Cron.CheckDomainsResolveWorker},
     {"0 0 * * 0", Pleroma.Workers.Cron.DigestEmailsWorker},

config/description.exs

@@ -2147,11 +2147,11 @@ config :pleroma, :config_description, [
         ]
       },
       %{
-        key: :failure_backoff,
+        key: :timeout,
         type: :integer,
         description:
-          "Amount of milliseconds after request failure, during which the request will not be retried.",
-        suggestions: [60_000]
+          "Amount of milliseconds after which the HTTP request is forcibly terminated.",
+        suggestions: [5_000]
       }
     ]
   },

config/test.exs

@@ -199,6 +199,8 @@ config :pleroma, Pleroma.Emoji.Loader, test_emoji: true
 config :pleroma, Pleroma.Web.RichMedia.Backfill,
   stream_out: Pleroma.Web.ActivityPub.ActivityPubMock
 
+config :pleroma, Pleroma.Web.Plugs.HTTPSecurityPlug, enable: false
+
 if File.exists?("./config/test.secret.exs") do
   import_config "test.secret.exs"
 else

docs/configuration/cheatsheet.md

@@ -435,7 +435,7 @@ config :pleroma, Pleroma.Web.MediaProxy.Invalidation.Http,
 * `ignore_hosts`: list of hosts which will be ignored by the metadata parser. For example `["accounts.google.com", "xss.website"]`, defaults to `[]`.
 * `ignore_tld`: list TLDs (top-level domains) which will ignore for parse metadata. default is ["local", "localdomain", "lan"].
 * `parsers`: list of Rich Media parsers.
-* `failure_backoff`: Amount of milliseconds after request failure, during which the request will not be retried.
+* `timeout`: Amount of milliseconds after which the HTTP request is forcibly terminated.
 
 ## HTTP server
 

lib/pleroma/application.ex

@@ -15,7 +15,6 @@ defmodule Pleroma.Application do
   @compat_name Mix.Project.config()[:compat_name]
   @version Mix.Project.config()[:version]
   @repository Mix.Project.config()[:source_url]
-  @compile_env Mix.env()
 
   def name, do: @name
   def compat_name, do: @compat_name
@@ -56,7 +55,7 @@ defmodule Pleroma.Application do
     Pleroma.Config.Oban.warn()
     Config.DeprecationWarnings.warn()
 
-    if @compile_env != :test do
+    if Config.get([Pleroma.Web.Plugs.HTTPSecurityPlug, :enable], true) do
       Pleroma.Web.Plugs.HTTPSecurityPlug.warn_if_disabled()
     end
 

lib/pleroma/conversation/participation.ex

@@ -12,6 +12,8 @@ defmodule Pleroma.Conversation.Participation do
   import Ecto.Changeset
   import Ecto.Query
 
+  @type t :: %__MODULE__{}
+
   schema "conversation_participations" do
     belongs_to(:user, User, type: FlakeId.Ecto.CompatType)
     belongs_to(:conversation, Conversation)

lib/pleroma/following_relationship.ex

@@ -199,8 +199,8 @@ defmodule Pleroma.FollowingRelationship do
     |> preload([:follower])
     |> Repo.all()
     |> Enum.map(fn following_relationship ->
-      Pleroma.Web.CommonAPI.follow(following_relationship.follower, target)
-      Pleroma.Web.CommonAPI.unfollow(following_relationship.follower, origin)
+      Pleroma.Web.CommonAPI.follow(target, following_relationship.follower)
+      Pleroma.Web.CommonAPI.unfollow(origin, following_relationship.follower)
     end)
     |> case do
       [] ->

lib/pleroma/http.ex

@@ -68,7 +68,9 @@ defmodule Pleroma.HTTP do
 
     adapter = Application.get_env(:tesla, :adapter)
 
-    client = Tesla.client(adapter_middlewares(adapter), adapter)
+    extra_middleware = options[:tesla_middleware] || []
+
+    client = Tesla.client(adapter_middlewares(adapter, extra_middleware), adapter)
 
     maybe_limit(
       fn ->
@@ -102,20 +104,21 @@ defmodule Pleroma.HTTP do
     fun.()
   end
 
-  defp adapter_middlewares(Tesla.Adapter.Gun) do
-    [Tesla.Middleware.FollowRedirects, Pleroma.Tesla.Middleware.ConnectionPool]
+  defp adapter_middlewares(Tesla.Adapter.Gun, extra_middleware) do
+    [Tesla.Middleware.FollowRedirects, Pleroma.Tesla.Middleware.ConnectionPool] ++
+      extra_middleware
   end
 
-  defp adapter_middlewares({Tesla.Adapter.Finch, _}) do
-    [Tesla.Middleware.FollowRedirects]
+  defp adapter_middlewares({Tesla.Adapter.Finch, _}, extra_middleware) do
+    [Tesla.Middleware.FollowRedirects] ++ extra_middleware
   end
 
-  defp adapter_middlewares(_) do
+  defp adapter_middlewares(_, extra_middleware) do
     if Pleroma.Config.get(:env) == :test do
       # Emulate redirects in test env, which are handled by adapters in other environments
       [Tesla.Middleware.FollowRedirects]
     else
-      []
+      extra_middleware
     end
   end
 end

lib/pleroma/notification.ex

@@ -842,7 +842,7 @@ defmodule Pleroma.Notification do
 
   def mark_as_read?(activity, target_user) do
     user = Activity.user_actor(activity)
-    User.mutes_user?(target_user, user) || CommonAPI.thread_muted?(target_user, activity)
+    User.mutes_user?(target_user, user) || CommonAPI.thread_muted?(activity, target_user)
   end
 
   def for_user_and_activity(user, activity) do

lib/pleroma/user/import.ex

@@ -31,7 +31,7 @@ defmodule Pleroma.User.Import do
       identifiers,
       fn identifier ->
         with {:ok, %User{} = blocked} <- User.get_or_fetch(identifier),
-             {:ok, _block} <- CommonAPI.block(blocker, blocked) do
+             {:ok, _block} <- CommonAPI.block(blocked, blocker) do
           blocked
         else
           error -> handle_error(:blocks_import, identifier, error)
@@ -46,7 +46,7 @@ defmodule Pleroma.User.Import do
       fn identifier ->
         with {:ok, %User{} = followed} <- User.get_or_fetch(identifier),
              {:ok, follower, followed} <- User.maybe_direct_follow(follower, followed),
-             {:ok, _, _, _} <- CommonAPI.follow(follower, followed) do
+             {:ok, _, _, _} <- CommonAPI.follow(followed, follower) do
           followed
         else
           error -> handle_error(:follow_import, identifier, error)

lib/pleroma/web/activity_pub/mrf/follow_bot_policy.ex

@@ -49,7 +49,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.FollowBotPolicy do
           "#{__MODULE__}: Follow request from #{follower.nickname} to #{user.nickname}"
         )
 
-        CommonAPI.follow(follower, user)
+        CommonAPI.follow(user, follower)
       end
     end)
 

lib/pleroma/web/activity_pub/publisher.ex

@@ -123,6 +123,7 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
         Logger.error("Publisher failed to inbox #{inbox} with status #{code}")
 
         case response do
+          %{status: 400} -> {:cancel, :bad_request}
           %{status: 403} -> {:cancel, :forbidden}
           %{status: 404} -> {:cancel, :not_found}
           %{status: 410} -> {:cancel, :not_found}

lib/pleroma/web/activity_pub/relay.ex

@@ -22,7 +22,7 @@ defmodule Pleroma.Web.ActivityPub.Relay do
   def follow(target_instance) do
     with %User{} = local_user <- get_actor(),
          {:ok, %User{} = target_user} <- User.get_or_fetch_by_ap_id(target_instance),
-         {:ok, _, _, activity} <- CommonAPI.follow(local_user, target_user) do
+         {:ok, _, _, activity} <- CommonAPI.follow(target_user, local_user) do
       Logger.info("relay: followed instance: #{target_instance}; id=#{activity.data["id"]}")
       {:ok, activity}
     else

lib/pleroma/web/activity_pub/side_effects.ex

@@ -530,7 +530,7 @@ defmodule Pleroma.Web.ActivityPub.SideEffects do
        ) do
     orig_object_ap_id = updated_object["id"]
     orig_object = Object.get_by_ap_id(orig_object_ap_id)
-    orig_object_data = orig_object.data
+    orig_object_data = Map.get(orig_object, :data)
 
     updated_object =
       if meta[:local] do