mirror of https://github.com/mastodon/mastodon.git
Do not try fetching keys of unknown accounts on a Delete from them (#10326)
parent
158c31b9df
commit
66d9452092
|
@ -2,11 +2,14 @@
|
||||||
|
|
||||||
class ActivityPub::InboxesController < Api::BaseController
|
class ActivityPub::InboxesController < Api::BaseController
|
||||||
include SignatureVerification
|
include SignatureVerification
|
||||||
|
include JsonLdHelper
|
||||||
|
|
||||||
before_action :set_account
|
before_action :set_account
|
||||||
|
|
||||||
def create
|
def create
|
||||||
if signed_request_account
|
if unknown_deleted_account?
|
||||||
|
head 202
|
||||||
|
elsif signed_request_account
|
||||||
upgrade_account
|
upgrade_account
|
||||||
process_payload
|
process_payload
|
||||||
head 202
|
head 202
|
||||||
|
@ -17,12 +20,19 @@ class ActivityPub::InboxesController < Api::BaseController
|
||||||
|
|
||||||
private
|
private
|
||||||
|
|
||||||
|
def unknown_deleted_account?
|
||||||
|
json = Oj.load(body, mode: :strict)
|
||||||
|
json['type'] == 'Delete' && json['actor'].present? && json['actor'] == value_or_id(json['object']) && !Account.where(uri: json['actor']).exists?
|
||||||
|
rescue Oj::ParseError
|
||||||
|
false
|
||||||
|
end
|
||||||
|
|
||||||
def set_account
|
def set_account
|
||||||
@account = Account.find_local!(params[:account_username]) if params[:account_username]
|
@account = Account.find_local!(params[:account_username]) if params[:account_username]
|
||||||
end
|
end
|
||||||
|
|
||||||
def body
|
def body
|
||||||
@body ||= request.body.read
|
@body ||= request.body.read.force_encoding('UTF-8')
|
||||||
end
|
end
|
||||||
|
|
||||||
def upgrade_account
|
def upgrade_account
|
||||||
|
@ -36,6 +46,6 @@ class ActivityPub::InboxesController < Api::BaseController
|
||||||
end
|
end
|
||||||
|
|
||||||
def process_payload
|
def process_payload
|
||||||
ActivityPub::ProcessingWorker.perform_async(signed_request_account.id, body.force_encoding('UTF-8'), @account&.id)
|
ActivityPub::ProcessingWorker.perform_async(signed_request_account.id, body, @account&.id)
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
|
@ -10,7 +10,7 @@ RSpec.describe ActivityPub::InboxesController, type: :controller do
|
||||||
Fabricate(:account)
|
Fabricate(:account)
|
||||||
end
|
end
|
||||||
|
|
||||||
post :create
|
post :create, body: '{}'
|
||||||
expect(response).to have_http_status(202)
|
expect(response).to have_http_status(202)
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
@ -21,7 +21,7 @@ RSpec.describe ActivityPub::InboxesController, type: :controller do
|
||||||
false
|
false
|
||||||
end
|
end
|
||||||
|
|
||||||
post :create
|
post :create, body: '{}'
|
||||||
expect(response).to have_http_status(401)
|
expect(response).to have_http_status(401)
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
Loading…
Reference in New Issue