Right, so far today we’ve fixed: - A DbContext use-after-dispose causing background user refreshes to fail - A race condition causing multiple user refreshes to be queued simultaneously - Bugs in the activity content type validation (it was too strict & didn’t accept some less common valid ones) - A bug where the home timeline heuristics query would fail if the database had not been populated with notes yet - A bug where the http signature signing string wouldn’t sign headers that occur more than once correctly
We’ve also - Bypassed a GTS bug - Added a User-Agent header to all outgoing HTTP requests, not just signed ones - Improved debug logging in some places
Though, hmm. I’m already validating the host & content type, so I’m not sure if this would actually help in any way, and I’m not sure increasing complexity is a good idea here.
Yawn! Long day. Today I fixed several security vulns in the JS codebase, added support for follow requests, invite code generation, handlers for user updates, handlers for incoming note edits, outgoing note edit federation & note edit notifications.
oh, and I almost forgot: I fixed the most recent masto vuln in iceshrimp.net as well, I had already implemented some safeguards against this a couple weeks ago but I made them even stricter now
I also made some tweaks to the follower/following counters so that they are more accurate (there’s functions to recalculate them now, should I have missed any discrepancies)
speaking of: I just implemented the ability to generate invites (if you’re an admin), as well as accepting & rejecting follow requests
I also overhauled the follow/follow-request notification system so that it prunes old notifications when they’re superseded by a new action, which the database will appreciate for sure
@zotan@next.e2net.social
