mirrors/mastodon
1
0
Fork 0
mirror of https://github.com/mastodon/mastodon.git synced 2024-11-21 12:05:07 +01:00
Code Issues Projects Releases Wiki Activity

Do not try fetching keys of unknown accounts on a Delete from them (#10326)

Browse Source
This commit is contained in:
ThibG 2019-03-20 17:20:16 +01:00 committed by Eugen Rochko
parent 158c31b9df
commit 66d9452092
2 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
app/controllers/activitypub/inboxes_controller.rb
View File

@ -2,11 +2,14 @@
class ActivityPub::InboxesController < Api::BaseController class ActivityPub::InboxesController < Api::BaseController
include SignatureVerification include SignatureVerification
include JsonLdHelper
before_action :set_account before_action :set_account
def create def create
if signed_request_account if unknown_deleted_account?
head 202
elsif signed_request_account
upgrade_account upgrade_account
process_payload process_payload
head 202 head 202
@ -17,12 +20,19 @@ class ActivityPub::InboxesController < Api::BaseController
private private
def unknown_deleted_account?
json = Oj.load(body, mode: :strict)
json['type'] == 'Delete' && json['actor'].present? && json['actor'] == value_or_id(json['object']) && !Account.where(uri: json['actor']).exists?
rescue Oj::ParseError
false
end
def set_account def set_account
@account = Account.find_local!(params[:account_username]) if params[:account_username] @account = Account.find_local!(params[:account_username]) if params[:account_username]
end end
def body def body
@body ||= request.body.read @body ||= request.body.read.force_encoding('UTF-8')
end end
def upgrade_account def upgrade_account
@ -36,6 +46,6 @@ class ActivityPub::InboxesController < Api::BaseController
end end
def process_payload def process_payload
ActivityPub::ProcessingWorker.perform_async(signed_request_account.id, body.force_encoding('UTF-8'), @account&.id) ActivityPub::ProcessingWorker.perform_async(signed_request_account.id, body, @account&.id)
end end
end end

4
spec/controllers/activitypub/inboxes_controller_spec.rb
View File

@ -10,7 +10,7 @@ RSpec.describe ActivityPub::InboxesController, type: :controller do
Fabricate(:account) Fabricate(:account)
end end
post :create post :create, body: '{}'
expect(response).to have_http_status(202) expect(response).to have_http_status(202)
end end
end end
@ -21,7 +21,7 @@ RSpec.describe ActivityPub::InboxesController, type: :controller do
false false
end end
post :create post :create, body: '{}'
expect(response).to have_http_status(401) expect(response).to have_http_status(401)
end end
end end