From 482647dab9e638a4474e1f30a4609653fedb2ceb Mon Sep 17 00:00:00 2001
From: Agate <me@agate.blue>
Date: Fri, 28 Aug 2020 20:19:08 +0200
Subject: [PATCH 1/3] Fix #1210: Enforce authentication when viewing remote
 channels, profiles and libraries

---
 api/funkwhale_api/federation/tasks.py   | 2 +-
 changes/changelog.d/1210.enhancement    | 1 +
 front/src/views/auth/ProfileBase.vue    | 7 ++++++-
 front/src/views/channels/DetailBase.vue | 4 ++++
 front/src/views/library/DetailBase.vue  | 4 ++++
 5 files changed, 16 insertions(+), 2 deletions(-)
 create mode 100644 changes/changelog.d/1210.enhancement

diff --git a/api/funkwhale_api/federation/tasks.py b/api/funkwhale_api/federation/tasks.py
index 86bef50e1..c2bdfad34 100644
--- a/api/funkwhale_api/federation/tasks.py
+++ b/api/funkwhale_api/federation/tasks.py
@@ -429,7 +429,7 @@ def fetch(fetch_obj):
                 )
             except Exception:
                 logger.exception(
-                    "Error while fetching actor outbox: %s", obj.actor.outbox.url
+                    "Error while fetching actor outbox: %s", obj.actor.outbox_url
                 )
             else:
                 if result.get("next_page"):
diff --git a/changes/changelog.d/1210.enhancement b/changes/changelog.d/1210.enhancement
new file mode 100644
index 000000000..a41d714e5
--- /dev/null
+++ b/changes/changelog.d/1210.enhancement
@@ -0,0 +1 @@
+Enforce authentication when viewing remote channels, profiles and libraries (#1210)
\ No newline at end of file
diff --git a/front/src/views/auth/ProfileBase.vue b/front/src/views/auth/ProfileBase.vue
index 353ab1581..2569e2ce0 100644
--- a/front/src/views/auth/ProfileBase.vue
+++ b/front/src/views/auth/ProfileBase.vue
@@ -93,7 +93,12 @@ export default {
     }
   },
   created() {
-    this.fetch()
+    let authenticated = this.$store.state.auth.authenticated
+    if (!authenticated && this.domain && this.$store.getters['instance/domain'] != this.domain) {
+      this.$router.push({name: 'login', query: {next: this.$route.fullPath}})
+    } else {
+     this.fetch()
+    }
   },
   beforeRouteUpdate (to, from, next) {
     to.meta.preserveScrollPosition = true
diff --git a/front/src/views/channels/DetailBase.vue b/front/src/views/channels/DetailBase.vue
index be8481daf..f11196752 100644
--- a/front/src/views/channels/DetailBase.vue
+++ b/front/src/views/channels/DetailBase.vue
@@ -270,6 +270,10 @@ export default {
   },
   async created() {
     await this.fetchData()
+    let authenticated = this.$store.state.auth.authenticated
+    if (!authenticated && this.$store.getters['instance/domain'] != this.object.actor.domain) {
+      this.$router.push({name: 'login', query: {next: this.$route.fullPath}})
+    }
   },
   methods: {
     async fetchData() {
diff --git a/front/src/views/library/DetailBase.vue b/front/src/views/library/DetailBase.vue
index a58a179be..efd0d18fc 100644
--- a/front/src/views/library/DetailBase.vue
+++ b/front/src/views/library/DetailBase.vue
@@ -148,6 +148,10 @@ export default {
   },
   async created() {
     await this.fetchData()
+    let authenticated = this.$store.state.auth.authenticated
+    if (!authenticated && this.$store.getters['instance/domain'] != this.object.actor.domain) {
+      this.$router.push({name: 'login', query: {next: this.$route.fullPath}})
+    }
   },
   methods: {
     async fetchData() {

From 89037a76dbd16ef85a6308cfcf90473a151289a8 Mon Sep 17 00:00:00 2001
From: Agate <me@agate.blue>
Date: Fri, 28 Aug 2020 20:41:42 +0200
Subject: [PATCH 2/3] Added link to origin pod for track, album, artist,
 profile, channel and library

---
 front/src/components/library/AlbumDropdown.vue | 15 +++++++++++++++
 front/src/components/library/ArtistBase.vue    | 16 ++++++++++++++++
 front/src/components/library/TrackBase.vue     | 14 ++++++++++++++
 front/src/utils.js                             |  6 ++++++
 front/src/views/auth/ProfileBase.vue           |  8 ++++++++
 front/src/views/channels/DetailBase.vue        |  8 ++++++++
 front/src/views/library/DetailBase.vue         |  8 ++++++++
 7 files changed, 75 insertions(+)

diff --git a/front/src/components/library/AlbumDropdown.vue b/front/src/components/library/AlbumDropdown.vue
index 07b7b5a76..3cc42f6ef 100644
--- a/front/src/components/library/AlbumDropdown.vue
+++ b/front/src/components/library/AlbumDropdown.vue
@@ -20,6 +20,15 @@
     <button class="ui floating dropdown circular icon basic button" :title="labels.more" v-dropdown="{direction: 'downward'}">
       <i class="ellipsis vertical icon"></i>
       <div class="menu">
+        <a
+          :href="object.fid"
+          v-if="domain != $store.getters['instance/domain']"
+          target="_blank"
+          class="basic item">
+          <i class="external icon"></i>
+          <translate :translate-params="{domain: domain}" translate-context="Content/*/Button.Label/Verb">View on %{ domain }</translate>
+        </a>
+
         <div
           role="button"
           v-if="isEmbedable"
@@ -86,6 +95,7 @@ import EmbedWizard from "@/components/audio/EmbedWizard"
 import Modal from '@/components/semantic/Modal'
 import ReportMixin from '@/components/mixins/Report'
 
+import {getDomain} from '@/utils'
 
 export default {
   mixins: [ReportMixin],
@@ -108,6 +118,11 @@ export default {
     }
   },
   computed: {
+    domain () {
+      if (this.object) {
+        return getDomain(this.object.fid)
+      }
+    },
     labels() {
       return {
         more: this.$pgettext('*/*/Button.Label/Noun', "More…"),
diff --git a/front/src/components/library/ArtistBase.vue b/front/src/components/library/ArtistBase.vue
index 35b0eb02f..f23b1311e 100644
--- a/front/src/components/library/ArtistBase.vue
+++ b/front/src/components/library/ArtistBase.vue
@@ -57,6 +57,15 @@
               <button class="ui floating dropdown icon button" ref="dropdown" v-dropdown>
                 <i class="dropdown icon"></i>
                 <div class="menu">
+                  <a
+                    :href="object.fid"
+                    v-if="domain != $store.getters['instance/domain']"
+                    target="_blank"
+                    class="basic item">
+                    <i class="external icon"></i>
+                    <translate :translate-params="{domain: domain}" translate-context="Content/*/Button.Label/Verb">View on %{ domain }</translate>
+                  </a>
+
                   <button
                     role="button"
                     v-if="publicLibraries.length > 0"
@@ -137,6 +146,8 @@ import RadioButton from "@/components/radios/Button"
 import TagsList from "@/components/tags/List"
 import ReportMixin from '@/components/mixins/Report'
 
+import {getDomain} from '@/utils'
+
 const FETCH_URL = "albums/"
 
 export default {
@@ -205,6 +216,11 @@ export default {
     }
   },
   computed: {
+    domain () {
+      if (this.object) {
+        return getDomain(this.object.fid)
+      }
+    },
     isPlayable() {
       return (
         this.object.albums.filter(a => {
diff --git a/front/src/components/library/TrackBase.vue b/front/src/components/library/TrackBase.vue
index cf9a93659..18c2ff5e0 100644
--- a/front/src/components/library/TrackBase.vue
+++ b/front/src/components/library/TrackBase.vue
@@ -44,6 +44,14 @@
               <button class="ui floating dropdown circular icon basic button" :title="labels.more" v-dropdown="{direction: 'downward'}">
                 <i class="ellipsis vertical icon"></i>
                 <div class="menu" style="right: 0; left: auto">
+                  <a
+                    :href="track.fid"
+                    v-if="domain != $store.getters['instance/domain']"
+                    target="_blank"
+                    class="basic item">
+                    <i class="external icon"></i>
+                    <translate :translate-params="{domain: domain}" translate-context="Content/*/Button.Label/Verb">View on %{ domain }</translate>
+                  </a>
                   <div
                     role="button"
                     v-if="publicLibraries.length > 0"
@@ -116,6 +124,7 @@
 import time from "@/utils/time"
 import axios from "axios"
 import url from "@/utils/url"
+import {getDomain} from '@/utils'
 import logger from "@/logging"
 import PlayButton from "@/components/audio/PlayButton"
 import TrackFavoriteIcon from "@/components/favorites/TrackFavoriteIcon"
@@ -190,6 +199,11 @@ export default {
     }
   },
   computed: {
+    domain () {
+      if (this.track) {
+        return getDomain(this.track.fid)
+      }
+    },
     publicLibraries () {
       return this.libraries.filter(l => {
         return l.privacy_level === 'everyone'
diff --git a/front/src/utils.js b/front/src/utils.js
index fb7117a20..596ec07d5 100644
--- a/front/src/utils.js
+++ b/front/src/utils.js
@@ -51,3 +51,9 @@ export function checkRedirectToLogin (store, router) {
     router.push({name: 'login', query: {next: router.currentRoute.fullPath}})
   }
 }
+
+export function getDomain (url) {
+  let parser = document.createElement("a")
+  parser.href = url
+  return parser.hostname
+}
\ No newline at end of file
diff --git a/front/src/views/auth/ProfileBase.vue b/front/src/views/auth/ProfileBase.vue
index 353ab1581..f1b1d49b6 100644
--- a/front/src/views/auth/ProfileBase.vue
+++ b/front/src/views/auth/ProfileBase.vue
@@ -9,6 +9,14 @@
           <button class="ui pointing dropdown icon small basic right floated button" ref="dropdown" v-dropdown="{direction: 'downward'}" style="position: absolute; right: 1em; top: 1em;">
             <i class="ellipsis vertical icon"></i>
             <div class="menu">
+              <a
+                :href="object.fid"
+                v-if="object.domain != $store.getters['instance/domain']"
+                target="_blank"
+                class="basic item">
+                <i class="external icon"></i>
+                <translate :translate-params="{domain: object.domain}" translate-context="Content/*/Button.Label/Verb">View on %{ domain }</translate>
+              </a>
               <div
                 role="button"
                 class="basic item"
diff --git a/front/src/views/channels/DetailBase.vue b/front/src/views/channels/DetailBase.vue
index be8481daf..b3cd03087 100644
--- a/front/src/views/channels/DetailBase.vue
+++ b/front/src/views/channels/DetailBase.vue
@@ -84,6 +84,14 @@
                       <i class="code icon"></i>
                       <translate translate-context="Content/*/Button.Label/Verb">Embed</translate>
                     </a>
+                    <a
+                      :href="object.url"
+                      v-if="object.actor.domain != $store.getters['instance/domain']"
+                      target="_blank"
+                      class="basic item">
+                      <i class="external icon"></i>
+                      <translate :translate-params="{domain: object.actor.domain}" translate-context="Content/*/Button.Label/Verb">View on %{ domain }</translate>
+                    </a>
                     <div class="divider"></div>
                     <a
                       href=""
diff --git a/front/src/views/library/DetailBase.vue b/front/src/views/library/DetailBase.vue
index a58a179be..aa3cc6f9c 100644
--- a/front/src/views/library/DetailBase.vue
+++ b/front/src/views/library/DetailBase.vue
@@ -7,6 +7,14 @@
           <button class="ui pointing dropdown icon small basic right floated button" ref="dropdown" v-dropdown="{direction: 'downward'}" style="position: absolute; right: 1em; top: 1em;">
             <i class="ellipsis vertical icon"></i>
             <div class="menu">
+              <a
+                :href="object.fid"
+                v-if="object.actor.domain != $store.getters['instance/domain']"
+                target="_blank"
+                class="basic item">
+                <i class="external icon"></i>
+                <translate :translate-params="{domain: object.actor.domain}" translate-context="Content/*/Button.Label/Verb">View on %{ domain }</translate>
+              </a>
               <div
                 role="button"
                 class="basic item"

From 712f471f1006a8061f93e2c0cc965cf7a64ff51d Mon Sep 17 00:00:00 2001
From: Agate <me@agate.blue>
Date: Fri, 28 Aug 2020 20:59:54 +0200
Subject: [PATCH 3/3] Fix #1205: Added a new, large thumbnail size for cover
 images

---
 api/config/settings/common.py           | 1 +
 api/funkwhale_api/common/models.py      | 7 +++++++
 api/funkwhale_api/common/serializers.py | 1 +
 api/funkwhale_api/common/views.py       | 2 +-
 api/tests/common/test_serializers.py    | 6 ++++++
 changes/changelog.d/1205.enhancement    | 1 +
 front/src/components/Queue.vue          | 4 ++--
 7 files changed, 19 insertions(+), 3 deletions(-)
 create mode 100644 changes/changelog.d/1205.enhancement

diff --git a/api/config/settings/common.py b/api/config/settings/common.py
index 06194348d..b1283ea86 100644
--- a/api/config/settings/common.py
+++ b/api/config/settings/common.py
@@ -1223,6 +1223,7 @@ VERSATILEIMAGEFIELD_RENDITION_KEY_SETS = {
     "attachment_square": [
         ("original", "url"),
         ("medium_square_crop", "crop__200x200"),
+        ("large_square_crop", "crop__600x600"),
     ],
 }
 VERSATILEIMAGEFIELD_SETTINGS = {
diff --git a/api/funkwhale_api/common/models.py b/api/funkwhale_api/common/models.py
index e0bd21619..688af5406 100644
--- a/api/funkwhale_api/common/models.py
+++ b/api/funkwhale_api/common/models.py
@@ -267,6 +267,13 @@ class Attachment(models.Model):
         proxy_url = reverse("api:v1:attachments-proxy", kwargs={"uuid": self.uuid})
         return federation_utils.full_url(proxy_url + "?next=medium_square_crop")
 
+    @property
+    def download_url_large_square_crop(self):
+        if self.file:
+            return utils.media_url(self.file.crop["600x600"].url)
+        proxy_url = reverse("api:v1:attachments-proxy", kwargs={"uuid": self.uuid})
+        return federation_utils.full_url(proxy_url + "?next=large_square_crop")
+
 
 class MutationAttachment(models.Model):
     """
diff --git a/api/funkwhale_api/common/serializers.py b/api/funkwhale_api/common/serializers.py
index 9210c0603..fa194ea8a 100644
--- a/api/funkwhale_api/common/serializers.py
+++ b/api/funkwhale_api/common/serializers.py
@@ -297,6 +297,7 @@ class AttachmentSerializer(serializers.Serializer):
         urls["source"] = o.url
         urls["original"] = o.download_url_original
         urls["medium_square_crop"] = o.download_url_medium_square_crop
+        urls["large_square_crop"] = o.download_url_large_square_crop
         return urls
 
     def create(self, validated_data):
diff --git a/api/funkwhale_api/common/views.py b/api/funkwhale_api/common/views.py
index a4818acd9..fe669ad21 100644
--- a/api/funkwhale_api/common/views.py
+++ b/api/funkwhale_api/common/views.py
@@ -175,7 +175,7 @@ class AttachmentViewSet(
             return r
 
         size = request.GET.get("next", "original").lower()
-        if size not in ["original", "medium_square_crop"]:
+        if size not in ["original", "medium_square_crop", "large_square_crop"]:
             size = "original"
 
         try:
diff --git a/api/tests/common/test_serializers.py b/api/tests/common/test_serializers.py
index 1d23efb66..e8ef04bca 100644
--- a/api/tests/common/test_serializers.py
+++ b/api/tests/common/test_serializers.py
@@ -200,6 +200,9 @@ def test_attachment_serializer_existing_file(factories, to_api_date):
             "medium_square_crop": federation_utils.full_url(
                 attachment.file.crop["200x200"].url
             ),
+            "large_square_crop": federation_utils.full_url(
+                attachment.file.crop["600x600"].url
+            ),
         },
     }
 
@@ -227,6 +230,9 @@ def test_attachment_serializer_remote_file(factories, to_api_date):
             "medium_square_crop": federation_utils.full_url(
                 proxy_url + "?next=medium_square_crop"
             ),
+            "large_square_crop": federation_utils.full_url(
+                proxy_url + "?next=large_square_crop"
+            ),
         },
     }
 
diff --git a/changes/changelog.d/1205.enhancement b/changes/changelog.d/1205.enhancement
new file mode 100644
index 000000000..a3ccf4dc3
--- /dev/null
+++ b/changes/changelog.d/1205.enhancement
@@ -0,0 +1 @@
+Added a new, large thumbnail size for cover images (#1205
\ No newline at end of file
diff --git a/front/src/components/Queue.vue b/front/src/components/Queue.vue
index 27365be14..d55490656 100644
--- a/front/src/components/Queue.vue
+++ b/front/src/components/Queue.vue
@@ -6,8 +6,8 @@
           <div class="ui six wide column current-track">
             <div class="ui basic segment" id="player">
               <template v-if="currentTrack">
-                <img ref="cover" alt="" v-if="currentTrack.cover && currentTrack.cover.urls.original" :src="$store.getters['instance/absoluteUrl'](currentTrack.cover.urls.original)">
-                <img ref="cover" alt="" v-else-if="currentTrack.album && currentTrack.album.cover && currentTrack.album.cover.urls.original" :src="$store.getters['instance/absoluteUrl'](currentTrack.album.cover.urls.original)">
+                <img ref="cover" alt="" v-if="currentTrack.cover && currentTrack.cover.urls.large_square_crop" :src="$store.getters['instance/absoluteUrl'](currentTrack.cover.urls.large_square_crop)">
+                <img ref="cover" alt="" v-else-if="currentTrack.album && currentTrack.album.cover && currentTrack.album.cover.urls.large_square_crop" :src="$store.getters['instance/absoluteUrl'](currentTrack.album.cover.urls.large_square_crop)">
                 <img class="ui image" alt="" v-else src="../assets/audio/default-cover.png">
                 <h1 class="ui header">
                   <div class="content ellipsis">