Add whitelist mode (#11291)

[mastodon.git] / app / controllers / application_controller.rb

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 5037bbe8a6371ab2b50cc792f7e26754aba7c471..0d3913ee07daaa84df486980dfa147dfee0ee4be 100644 (file)
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -9,16 +9,25 @@ class ApplicationController < ActionController::Base
 
   include Localized
   include UserTrackingConcern
+  include SessionTrackingConcern
+  include CacheConcern
+  include DomainControlHelper
 
   helper_method :current_account
+  helper_method :current_session
+  helper_method :current_theme
   helper_method :single_user_mode?
+  helper_method :use_seamless_external_login?
+  helper_method :whitelist_mode?
 
   rescue_from ActionController::RoutingError, with: :not_found
   rescue_from ActiveRecord::RecordNotFound, with: :not_found
   rescue_from ActionController::InvalidAuthenticityToken, with: :unprocessable_entity
+  rescue_from ActionController::UnknownFormat, with: :not_acceptable
+  rescue_from Mastodon::NotPermittedError, with: :forbidden
 
   before_action :store_current_location, except: :raise_not_found, unless: :devise_controller?
-  before_action :check_suspension, if: :user_signed_in?
+  before_action :require_functional!, if: :user_signed_in?
 
   def raise_not_found
     raise ActionController::RoutingError, "No route matches #{params[:unmatched_route]}"
@@ -27,23 +36,43 @@ class ApplicationController < ActionController::Base
   private
 
   def https_enabled?
-    Rails.env.production? && ENV['LOCAL_HTTPS'] == 'true'
+    Rails.env.production?
+  end
+
+  def authorized_fetch_mode?
+    ENV['AUTHORIZED_FETCH'] == 'true' || Rails.configuration.x.whitelist_mode
+  end
+
+  def public_fetch_mode?
+    !authorized_fetch_mode?
   end
 
   def store_current_location
-    store_location_for(:user, request.url)
+    store_location_for(:user, request.url) unless request.format == :json
   end
 
   def require_admin!
-    redirect_to root_path unless current_user&.admin?
+    forbidden unless current_user&.admin?
+  end
+
+  def require_staff!
+    forbidden unless current_user&.staff?
+  end
+
+  def require_functional!
+    redirect_to edit_user_registration_path unless current_user.functional?
   end
 
-  def check_suspension
-    head 403 if current_user.account.suspended?
+  def after_sign_out_path_for(_resource_or_scope)
+    new_user_session_path
   end
 
   protected
 
+  def truthy_param?(key)
+    ActiveModel::Type::Boolean.new.cast(params[key])
+  end
+
   def forbidden
     respond_with_error(403)
   end
@@ -60,45 +89,39 @@ class ApplicationController < ActionController::Base
     respond_with_error(422)
   end
 
-  def single_user_mode?
-    @single_user_mode ||= Rails.configuration.x.single_user_mode && Account.exists?
+  def not_acceptable
+    respond_with_error(406)
   end
 
-  def current_account
-    @current_account ||= current_user.try(:account)
+  def single_user_mode?
+    @single_user_mode ||= Rails.configuration.x.single_user_mode && Account.where('id > 0').exists?
   end
 
-  def cache_collection(raw, klass)
-    return raw unless klass.respond_to?(:with_includes)
-
-    raw                    = raw.cache_ids.to_a if raw.is_a?(ActiveRecord::Relation)
-    uncached_ids           = []
-    cached_keys_with_value = Rails.cache.read_multi(*raw.map(&:cache_key))
+  def use_seamless_external_login?
+    Devise.pam_authentication || Devise.ldap_authentication
+  end
 
-    raw.each do |item|
-      uncached_ids << item.id unless cached_keys_with_value.key?(item.cache_key)
-    end
+  def current_account
+    return @current_account if defined?(@current_account)
 
-    klass.reload_stale_associations!(cached_keys_with_value.values) if klass.respond_to?(:reload_stale_associations!)
+    @current_account = current_user&.account
+  end
 
-    unless uncached_ids.empty?
-      uncached = klass.where(id: uncached_ids).with_includes.map { |item| [item.id, item] }.to_h
+  def current_session
+    return @current_session if defined?(@current_session)
 
-      uncached.values.each do |item|
-        Rails.cache.write(item.cache_key, item)
-      end
-    end
+    @current_session = SessionActivation.find_by(session_id: cookies.signed['_session_id']) if cookies.signed['_session_id'].present?
+  end
 
-    raw.map { |item| cached_keys_with_value[item.cache_key] || uncached[item.id] }.compact
+  def current_theme
+    return Setting.theme unless Themes.instance.names.include? current_user&.setting_theme
+    current_user.setting_theme
   end
 
   def respond_with_error(code)
     respond_to do |format|
       format.any  { head code }
-      format.html do
-        set_locale
-        render "errors/#{code}", layout: 'error', status: code
-      end
+      format.html { render "errors/#{code}", layout: 'error', status: code }
     end
   end
 end