Merge tag '13.4.0' into io

.dockerignore

@@ -16,9 +16,15 @@ files/
 misskey-assets/
 fluent-emojis/
 .pnp.*
+
+# .yarn関連
 .yarn/*
 !.yarn/patches
 !.yarn/plugins
 !.yarn/releases
 !.yarn/sdks
 !.yarn/versions
+
+.idea/
+packages/*/.vscode/
+packages/backend/test/docker-compose.yml

.dockleignore

@@ -0,0 +1,3 @@
+DKL-DI-0005
+DKL-DI-0006
+DKL-LI-0003

.github/workflows/docker-develop.yml

@@ -14,6 +14,8 @@ jobs:
     steps:
       - name: Check out the repo
         uses: actions/[email protected]
+      - name: Set up Docker Buildx
+        uses: docker/[email protected]
       - name: Docker meta
         id: meta
         uses: docker/metadata-action@v4

.github/workflows/dockle.yml

@@ -0,0 +1,30 @@
+---
+name: Dockle
+
+on:
+  push:
+    branches:
+      - master
+      - develop
+  pull_request:
+
+jobs:
+  dockle:
+    runs-on: ubuntu-latest
+    env:
+      DOCKER_CONTENT_TRUST: 1
+    steps:
+      - uses: actions/[email protected]
+      - run: |
+          curl -L -o dockle.deb "https://github.com/goodwithtech/dockle/releases/download/v0.4.10/dockle_0.4.10_Linux-64bit.deb"
+          sudo dpkg -i dockle.deb
+      - run: |
+          cp .config/docker_example.env .config/docker.env
+          cp ./docker-compose.yml.example ./docker-compose.yml
+      - run: |
+          docker compose up -d web
+          docker tag "$(docker compose images web | awk 'OFS=":" {print $4}' | tail -n +2)" misskey-web:latest
+      - run: |
+          cmd="dockle --exit-code 1 misskey-web:latest ${image_name}"
+          echo "> ${cmd}"
+          eval "${cmd}"

CHANGELOG.md

@@ -8,6 +8,23 @@
 
 You should also include the user name that made the change.
 -->
+## 13.4.0 (2023/02/05)
+
+### Improvements
+- ロールにアイコンを設定してユーザー名の横に表示できるように
+- feat: timeline page for non-login users
+- 実績の単なるラッキーの獲得確立を調整
+- Add Thai language support
+
+### Bugfixes
+- fix(server): 自分のノートをお気に入りに登録しても実績解除される問題を修正
+- fix(server): clean up file in FileServer
+- fix(server): Deny UNIX domain socket
+- fix(server): validate filename and emoji name to improve security
+- fix(client): validate input response in aiscript
+- fix(client): add webhook delete button
+- fix(client): tweak notification style
+- fix(client): インラインコードを折り返して表示する
 
 ## 13.3.3 (2023/02/04)
 

CONTRIBUTING.md

@@ -121,7 +121,7 @@ cp .github/misskey/test.yml .config/
 ```
 Prepare DB/Redis for testing.
 ```
-docker-compose -f packages/backend/test/docker-compose.yml up
+docker compose -f packages/backend/test/docker-compose.yml up
 ```
 Alternatively, prepare an empty (data can be erased) DB and edit `.config/test.yml`. 
 

Dockerfile

@@ -8,7 +8,9 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
 	; echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache \
 	&& apt-get update \
 	&& apt-get install -yqq --no-install-recommends \
-	build-essential
+	build-essential wget ca-certificates \
+	&& wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -O /usr/bin/yq \
+	&& chmod +x /usr/bin/yq
 
 RUN corepack enable
 
@@ -29,6 +31,7 @@ ARG NODE_ENV=production
 
 RUN git submodule update --init
 RUN pnpm build
+RUN rm -rf .git/
 
 FROM node:${NODE_VERSION}-slim AS runner
 
@@ -44,11 +47,14 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
 	ffmpeg tini \
 	&& corepack enable \
 	&& groupadd -g "${GID}" misskey \
-	&& useradd -l -u "${UID}" -g "${GID}" -m -d /misskey misskey
+	&& useradd -l -u "${UID}" -g "${GID}" -m -d /misskey misskey \
+	&& find / -type f -perm /u+s -ignore_readdir_race -exec chmod u-s {} \; \
+	&& find / -type f -perm /g+s -ignore_readdir_race -exec chmod g-s {} \;
 
 USER misskey
 WORKDIR /misskey
 
+COPY --from=builder /usr/bin/yq /usr/bin/yq
 COPY --chown=misskey:misskey --from=builder /misskey/node_modules ./node_modules
 COPY --chown=misskey:misskey --from=builder /misskey/built ./built
 COPY --chown=misskey:misskey --from=builder /misskey/packages/backend/node_modules ./packages/backend/node_modules
@@ -58,5 +64,6 @@ COPY --chown=misskey:misskey --from=builder /misskey/fluent-emojis /misskey/flue
 COPY --chown=misskey:misskey . ./
 
 ENV NODE_ENV=production
+HEALTHCHECK --interval=5s --retries=20 CMD ["/bin/bash", "/misskey/healthcheck.sh"]
 ENTRYPOINT ["/usr/bin/tini", "--"]
 CMD ["pnpm", "run", "migrateandstart"]

healthcheck.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+PORT=$(yq '.port' /misskey/.config/default.yml)
+curl -s -S -o /dev/null "http://localhost:${PORT}"

locales/de-DE.yml

@@ -1195,6 +1195,9 @@ _role:
   baseRole: "Rollenvorlage"
   useBaseValue: "Wert der Rollenvorlage verwenden"
   chooseRoleToAssign: "Zuzuweisende Rolle auswählen"
+  iconUrl: "Icon-URL"
+  asBadge: "Als Abzeichen anzeigen"
+  descriptionOfAsBadge: "Ist dies aktiviert, so wird das Icon dieser Rolle an der Seite der Namen von Benutzern mit dieser Rolle angezeigt."
   canEditMembersByModerator: "Moderatoren können Benutzern diese Rolle zuweisen"
   descriptionOfCanEditMembersByModerator: "Wenn aktiviert, so können Moderatoren und Adminstratoren anderen Benutzern diese Rolle zuweisen bzw. diese Zuweisung aufheben. Wenn deaktiviert, so ist es nur Administratoren möglich, Zuweisungen dieser Rolle zu verwalten."
   priority: "Priorität"

locales/en-US.yml

@@ -1195,6 +1195,9 @@ _role:
   baseRole: "Role template"
   useBaseValue: "Use role template value"
   chooseRoleToAssign: "Select the role to assign"
+  iconUrl: "Icon URL"
+  asBadge: "Show as badge"
+  descriptionOfAsBadge: "This role's icon will be displayed next to the username of users with this role if turned on."
   canEditMembersByModerator: "Allow moderators to edit the list of members for this role"
   descriptionOfCanEditMembersByModerator: "When turned on, moderators as well as administrators will be able to assign and unassign users to this role. When turned off, only administrators will be able to assign users."
   priority: "Priority"

locales/es-ES.yml

@@ -1195,6 +1195,9 @@ _role:
   baseRole: "Rol base"
   useBaseValue: "Usar los valores del rol base"
   chooseRoleToAssign: "Selecciona el rol para asignar"
+  iconUrl: "URL del ícono"
+  asBadge: "Mostrar como emblema"
+  descriptionOfAsBadge: "Este ícono de rol se mostrará a lado del nombre de usuario cuando este rol se encuentre activo."
   canEditMembersByModerator: "Permitir a los moderadores editar los miembros"
   descriptionOfCanEditMembersByModerator: "Si se activa, los moderadores, al igual que los administradores, serán capaces de asignar/quitar usuarios a éste rol. Si se desactiva, sólo los administradores podrán hacerlo."
   priority: "Prioridad"

locales/index.js

@@ -34,6 +34,7 @@ const languages = [
 	'pt-PT',
 	'ru-RU',
 	'sk-SK',
+	'th-TH',
 	'ug-CN',
 	'uk-UA',
 	'vi-VN',

locales/ja-JP.yml

@@ -1148,7 +1148,7 @@ _achievements:
       description: "ここをクリックした"
     _justPlainLucky:
       title: "単なるラッキー"
-      description: "10秒ごとに0.01%の確率で獲得"
+      description: "10秒ごとに0.005%の確率で獲得"
     _setNameToSyuilo:
       title: "神様コンプレックス"
       description: "名前を syuilo に設定した"
@@ -1184,7 +1184,7 @@ _role:
   description: "ロールの説明"
   permission: "ロールの権限"
   descriptionOfPermission: "<b>モデレーター</b>は基本的なモデレーションに関する操作を行えます。\n<b>管理者</b>はインスタンスの全ての設定を変更できます。"
-  assignTarget: "アサインターゲット"
+  assignTarget: "アサイン"
   descriptionOfAssignTarget: "<b>マニュアル</b>は誰がこのロールに含まれるかを手動で管理します。\n<b>コンディショナル</b>は条件を設定し、それに合致するユーザーが自動で含まれるようになります。"
   manual: "マニュアル"
   conditional: "コンディショナル"
@@ -1197,6 +1197,9 @@ _role:
   baseRole: "ベースロール"
   useBaseValue: "ベースロールの値を使用"
   chooseRoleToAssign: "アサインするロールを選択"
+  iconUrl: "アイコン画像のURL"
+  asBadge: "バッジとして表示"
+  descriptionOfAsBadge: "オンにすると、ユーザー名の横にロールのアイコンが表示されます。"
   canEditMembersByModerator: "モデレーターのメンバー編集を許可"
   descriptionOfCanEditMembersByModerator: "オンにすると、管理者に加えてモデレーターもこのロールへユーザーをアサイン/アサイン解除できるようになります。オフにすると管理者のみが行えます。"
   priority: "優先度"

locales/lo-LA.yml

@@ -0,0 +1,2 @@
+---
+_lang_: "ພາສາລາວ"

locales/th-TH.yml

@@ -1195,6 +1195,9 @@ _role:
   baseRole: "บทบาทพื้นฐาน"
   useBaseValue: "ใช้บทบาทพื้นฐานเริ่มต้น"
   chooseRoleToAssign: "เลือกบทบาทที่ต้องการกำหนด"
+  iconUrl: "ไอคอน URL"
+  asBadge: "แสดงเป็นตรา"
+  descriptionOfAsBadge: "ไอคอนของบทบาทนี้จะปรากฏถัดจากชื่อผู้ใช้ของผู้ใช้งานด้วยบทบาทนี้ถ้าหากเปิดใช้งาน"
   canEditMembersByModerator: "อนุญาตให้ผู้ดูแลแก้ไขสมาชิก"
   descriptionOfCanEditMembersByModerator: "เมื่อเปิดใช้ ผู้ดูแลนอกเหนือจากผู้ดูแลระบบแล้ว จะสามารถกำหนดและยกเลิกการมอบหมายบทบาทนี้ให้กับผู้ใช้ได้ เมื่อปิด เฉพาะผู้ดูแลระบบเท่านั้นที่จะสามารถกำหนดผู้ใช้ได้นะ"
   priority: "ลำดับความสำคัญ"

locales/zh-CN.yml

@@ -1195,6 +1195,9 @@ _role:
   baseRole: "基本角色"
   useBaseValue: "使用基本角色的值"
   chooseRoleToAssign: "选择要分配的角色"
+  iconUrl: "图标URL"
+  asBadge: "作为徽章显示"
+  descriptionOfAsBadge: "开启后，用户名旁边将会出现角色图标。"
   canEditMembersByModerator: "允许监察者编辑成员"
   descriptionOfCanEditMembersByModerator: "如果选中，监察者和管理员都能够为用户分配/取消分配角色。如果未选中，则只有管理员可以执行此操作。"
   priority: "优先级"

locales/zh-TW.yml

@@ -1195,6 +1195,9 @@ _role:
   baseRole: "基本角色"
   useBaseValue: "使用基本角色的值"
   chooseRoleToAssign: "選擇要指派的角色"
+  iconUrl: "圖示的URL"
+  asBadge: "顯示為徽章"
+  descriptionOfAsBadge: "開啟的話，角色圖示會顯示在用戶名旁邊。"
   canEditMembersByModerator: "允許編輯監察員的成員"
   descriptionOfCanEditMembersByModerator: "如果開啟，管理員與監察員都可以為使用者指派/解除指派該角色。如果關閉，則只有管理員可以執行。"
   priority: "優先級"

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "misskey",
-	"version": "13.3.4",
+	"version": "13.4.0",
 	"codename": "nasubi",
 	"repository": {
 		"type": "git",

packages/backend/migration/1675557528704-role-icon-badge.js

@@ -0,0 +1,13 @@
+export class roleIconBadge1675557528704 {
+    name = 'roleIconBadge1675557528704'
+
+    async up(queryRunner) {
+        await queryRunner.query(`ALTER TABLE "role" ADD "iconUrl" character varying(512)`);
+        await queryRunner.query(`ALTER TABLE "role" ADD "asBadge" boolean NOT NULL DEFAULT false`);
+    }
+
+    async down(queryRunner) {
+        await queryRunner.query(`ALTER TABLE "role" DROP COLUMN "asBadge"`);
+        await queryRunner.query(`ALTER TABLE "role" DROP COLUMN "iconUrl"`);
+    }
+}

packages/backend/src/core/DownloadService.ts

@@ -60,6 +60,7 @@ export class DownloadService {
 			retry: {
 				limit: 0,
 			},
+			enableUnixSockets: false,
 		}).on('response', (res: Got.Response) => {
 			if ((process.env.NODE_ENV === 'production' || process.env.NODE_ENV === 'test') && !this.config.proxy && res.ip) {
 				if (this.isPrivateIp(res.ip)) {

packages/backend/src/core/RoleService.ts

@@ -202,6 +202,19 @@ export class RoleService implements OnApplicationShutdown {
 		return [...assignedRoles, ...matchedCondRoles];
 	}
 
+	/**
+	 * 指定ユーザーのバッジロール一覧取得
+	 */
+	@bindThis
+	public async getUserBadgeRoles(userId: User['id']) {
+		const assigns = await this.roleAssignmentByUserIdCache.fetch(userId, () => this.roleAssignmentsRepository.findBy({ userId }));
+		const assignedRoleIds = assigns.map(x => x.roleId);
+		const roles = await this.rolesCache.fetch(null, () => this.rolesRepository.findBy({}));
+		const assignedBadgeRoles = roles.filter(r => r.asBadge && assignedRoleIds.includes(r.id));
+		// コンディショナルロールも含めるのは負荷高そうだから一旦無し
+		return assignedBadgeRoles;
+	}
+
 	@bindThis
 	public async getUserPolicies(userId: User['id'] | null): Promise<RolePolicies> {
 		const meta = await this.metaService.fetch();

packages/backend/src/core/entities/RoleEntityService.ts

@@ -56,11 +56,13 @@ export class RoleEntityService {
 			name: role.name,
 			description: role.description,
 			color: role.color,
+			iconUrl: role.iconUrl,
 			target: role.target,
 			condFormula: role.condFormula,
 			isPublic: role.isPublic,
 			isAdministrator: role.isAdministrator,
 			isModerator: role.isModerator,
+			asBadge: role.asBadge,
 			canEditMembersByModerator: role.canEditMembersByModerator,
 			policies: policies,
 			usersCount: assigns.length,

packages/backend/src/core/entities/UserEntityService.ts

@@ -415,6 +415,11 @@ export class UserEntityService implements OnModuleInit {
 			} : undefined) : undefined,
 			emojis: this.customEmojiService.populateEmojis(user.emojis, user.host),
 			onlineStatus: this.getOnlineStatus(user),
+			// パフォーマンス上の理由でローカルユーザーのみ
+			badgeRoles: user.host == null ? this.roleService.getUserBadgeRoles(user.id).then(rs => rs.map(r => ({
+				name: r.name,
+				iconUrl: r.iconUrl,
+			}))) : undefined,
 
 			...(opts.detail ? {
 				url: profile!.url,
@@ -454,6 +459,7 @@ export class UserEntityService implements OnModuleInit {
 					id: role.id,
 					name: role.name,
 					color: role.color,
+					iconUrl: role.iconUrl,
 					description: role.description,
 					isModerator: role.isModerator,
 					isAdministrator: role.isAdministrator,

packages/backend/src/models/entities/Role.ts

@@ -102,6 +102,11 @@ export class Role {
 	})
 	public color: string | null;
 
+	@Column('varchar', {
+		length: 512, nullable: true,
+	})
+	public iconUrl: string | null;
+
 	@Column('enum', {
 		enum: ['manual', 'conditional'],
 		default: 'manual',
@@ -118,6 +123,12 @@ export class Role {
 	})
 	public isPublic: boolean;
 
+	// trueの場合ユーザー名の横にバッジとして表示
+	@Column('boolean', {
+		default: false,
+	})
+	public asBadge: boolean;
+
 	@Column('boolean', {
 		default: false,
 	})

packages/backend/src/queue/processors/ExportCustomEmojisProcessorService.ts

@@ -12,9 +12,9 @@ import type Logger from '@/logger.js';
 import { DriveService } from '@/core/DriveService.js';
 import { createTemp, createTempDir } from '@/misc/create-temp.js';
 import { DownloadService } from '@/core/DownloadService.js';
+import { bindThis } from '@/decorators.js';
 import { QueueLoggerService } from '../QueueLoggerService.js';
 import type Bull from 'bull';
-import { bindThis } from '@/decorators.js';
 
 @Injectable()
 export class ExportCustomEmojisProcessorService {
@@ -82,6 +82,10 @@ export class ExportCustomEmojisProcessorService {
 		});
 
 		for (const emoji of customEmojis) {
+			if (!/^[a-zA-Z0-9_]+$/.test(emoji.name)) {
+				this.logger.error(`invalid emoji name: ${emoji.name}`);
+				continue;
+			}
 			const ext = mime.extension(emoji.type ?? 'image/png');
 			const fileName = emoji.name + (ext ? '.' + ext : '');
 			const emojiPath = path + '/' + fileName;

packages/backend/src/queue/processors/ImportCustomEmojisProcessorService.ts

@@ -81,6 +81,10 @@ export class ImportCustomEmojisProcessorService {
 
 			for (const record of meta.emojis) {
 				if (!record.downloaded) continue;
+				if (!/^[a-zA-Z0-9_]+?([a-zA-Z0-9\.]+)?$/.test(record.fileName)) {
+					this.logger.error(`invalid filename: ${record.fileName}`);
+					continue;
+				}
 				const emojiInfo = record.emoji;
 				const emojiPath = outputPath + '/' + record.fileName;
 				await this.emojisRepository.delete({

packages/backend/src/server/FileServerService.ts

@@ -146,6 +146,8 @@ export class FileServerService {
 						const url = new URL(`${this.config.mediaProxy}/static.webp`);
 						url.searchParams.set('url', file.url);
 						url.searchParams.set('static', '1');
+
+						file.cleanup();
 						return await reply.redirect(301, url.toString());
 					} else if (file.mime.startsWith('video/')) {
 						image = await this.videoProcessingService.generateVideoThumbnail(file.path);
@@ -158,6 +160,8 @@ export class FileServerService {
 
 						const url = new URL(`${this.config.mediaProxy}/svg.webp`);
 						url.searchParams.set('url', file.url);
+
+						file.cleanup();
 						return await reply.redirect(301, url.toString());
 					}
 				}