diff --git a/.env.production.catcatnya b/.env.production.catcatnya
index 8ac33d4bce..1fd974704d 100644
--- a/.env.production.catcatnya
+++ b/.env.production.catcatnya
@@ -47,3 +47,4 @@ MAX_REACTIONS=3
MAX_SEARCH_RESULTS=1000
MAX_REMOTE_EMOJI_SIZE=1048576
IP_RETENTION_PERIOD=86400
+ENABLE_SUSPICIOUS_SIGN_IN=false
diff --git a/.env.production.sample b/.env.production.sample
index 850c533d84..726c5ada1c 100644
--- a/.env.production.sample
+++ b/.env.production.sample
@@ -307,8 +307,14 @@ MAX_REACTIONS=1
# IP and session retention
# -----------------------
-# Make sure to modify the scheduling of ip_cleanup_scheduler in config/sidekiq.yml
+# Make sure to modify the scheduling of ip_cleanup_scheduler in config/sidekiq.yml (already applied for Catstodon)
# to be less than daily if you lower IP_RETENTION_PERIOD below two days (172800).
# -----------------------
IP_RETENTION_PERIOD=31556952
SESSION_RETENTION_PERIOD=31556952
+
+# In case you've shortened IP retention a lot, you may want to disable the suspicious sign in detector entirely,
+# in order to avoid spurious "suspicious login detected" emails being sent to users.
+# The default is true, because for the default retention period of one year, there is good data for such emails.
+# For instances having a retention period of merely a day, that may not be enough, so you may set it to false.
+#ENABLE_SUSPICIOUS_SIGN_IN=false
diff --git a/README.md b/README.md
index 2221831248..aa2fb51265 100644
--- a/README.md
+++ b/README.md
@@ -2,10 +2,13 @@
## Introduction
-This Mastodon fork is based on the [glitch-soc Fork of Mastodon](https://github.com/glitch-soc/mastodon), with changes made to suit [CatCatNya~](https://catcatnya.com).
-I intend to contribute some useful differences back to [glitch-soc](https://github.com/glitch-soc/mastodon) and [vanilla Mastodon](https://github.com/mastodon/mastodon).
+This Mastodon fork is based on the [glitch-soc Fork of Mastodon](https://github.com/glitch-soc/mastodon), with changes
+made to suit [CatCatNya~](https://catcatnya.com).
+I intend to contribute some useful differences back to [glitch-soc](https://github.com/glitch-soc/mastodon)
+and [vanilla Mastodon](https://github.com/mastodon/mastodon).
-To install, take a look at [glitch-soc.github.io/docs/](https://glitch-soc.github.io/docs/). The instructions and features are the same, except for the differences outlined below.
+To install, take a look at [glitch-soc.github.io/docs/](https://glitch-soc.github.io/docs/). The instructions and
+features are the same, except for the differences outlined below.
Contributing guidelines are available [here](CONTRIBUTING.md).
@@ -20,22 +23,35 @@ instead, use merge (fast-forward, if possible, with merge commit otherwise).
- Some files are adjusted specifically for the CatCatNya~ instance. Specifically, these:
- sounds/boop.mp3
- sounds/boop.ogg
-
You might want to revert these to the upstream files (or your own versions!) if you decide to use this fork for your own instance.
+
You might want to revert these to the upstream files (or your own versions!) if you decide to use this fork for
+ your own instance.
- The rate limits for authenticated users have been relaxed a bit.
-- The API endpoint `/api/v1/custom_emojis` is no longer affected by AUTHORIZED_FETCH, allowing anyone to copy custom emojis.
+- The API endpoint `/api/v1/custom_emojis` is no longer affected by AUTHORIZED_FETCH, allowing anyone to copy custom
+ emojis.
- Allow higher resolution images. (4096x4096 instead of the previous limit of 3840x2160)
- Allow posting polls with only one poll option (if `MIN_POLL_OPTIONS` is set to 1 on your instance).
-- Added oatstodon flavour (taken from [types.pl fork](https://github.com/ralsei/types.pl), by [@oat@hellsite.site](https://hellsite.site/@oat)), with slight adjustments since.
-- Emoji reactions on statuses (with both Unicode and custom emojis, same as for announcements), a feature originally developed for [Nyastodon](https://git.bsd.gay/fef/nyastodon).
- Ended up as a Catstodon-maintained patch after its initial two Pull Requests to glitch-soc, but was handed over to [Essem's fork, Chuckya](https://github.com/TheEssem/mastodon) and is now pending [its fourth attempt of merging into glitch-soc](https://github.com/glitch-soc/mastodon/pull/2462).
+- Added oatstodon flavour (taken from [types.pl fork](https://github.com/ralsei/types.pl),
+ by [@oat@hellsite.site](https://hellsite.site/@oat)), with slight adjustments since.
+- Emoji reactions on statuses (with both Unicode and custom emojis, same as for announcements), a feature originally
+ developed for [Nyastodon](https://git.bsd.gay/fef/nyastodon).
+ Ended up as a Catstodon-maintained patch after its initial two Pull Requests to glitch-soc, but was handed over
+ to [Essem's fork, Chuckya](https://github.com/TheEssem/mastodon) and is now
+ pending [its fourth attempt of merging into glitch-soc](https://github.com/glitch-soc/mastodon/pull/2462).
- Lifts the "only federate local favourites" restriction on favourites/likes and emoji reactions.
-- Cherry-picks the [activity filter branch](https://github.com/chikorita157/mastodon-sakura/tree/newmain-tmp3-noellabo-filtering) from [Sakurajima Mastodon](https://github.com/chikorita157/mastodon-sakura).
+- Cherry-picks the
+ [activity filter branch](https://github.com/chikorita157/mastodon-sakura/tree/newmain-tmp3-noellabo-filtering)
+ from [Sakurajima Mastodon](https://github.com/chikorita157/mastodon-sakura).
+- Adds the ability to disable the suspicious sign in detection entirely.
+ - Useful for situations where the instance may not have up-to-date IP information, such as when the period of IP
+ address retention is set to a low value (see *Previous differences now merged into vanilla Mastodon*)
## Previous differences now merged into glitch-soc
-- Fixed incorrect upload size limit display when adding new a new custom emoji. ([Pull request](https://github.com/glitch-soc/mastodon/pull/1763))
+- Fixed incorrect upload size limit display when adding new a new custom
+ emoji. ([Pull request](https://github.com/glitch-soc/mastodon/pull/1763))
- Everything merged into vanilla Mastodon
## Previous differences now merged into vanilla Mastodon
-- The period of retention of IP addresses and sessions was made configurable. ([Pull request](https://github.com/mastodon/mastodon/pull/18757))
+- The period of retention of IP addresses and sessions was made
+ configurable. ([Pull request](https://github.com/mastodon/mastodon/pull/18757))
diff --git a/app/lib/suspicious_sign_in_detector.rb b/app/lib/suspicious_sign_in_detector.rb
index 74f49aa558..de5b6026a8 100644
--- a/app/lib/suspicious_sign_in_detector.rb
+++ b/app/lib/suspicious_sign_in_detector.rb
@@ -3,13 +3,14 @@
class SuspiciousSignInDetector
IPV6_TOLERANCE_MASK = 64
IPV4_TOLERANCE_MASK = 16
+ ENABLE_SUSPICIOUS_SIGN_IN = ENV['ENABLE_SUSPICIOUS_SIGN_IN'] != 'false'
def initialize(user)
@user = user
end
def suspicious?(request)
- !sufficient_security_measures? && !freshly_signed_up? && !previously_seen_ip?(request)
+ !sufficient_security_measures? && !freshly_signed_up? && !previously_seen_ip?(request) if DISABLE_SUSPICIOUS_SIGN_IN
end
private