hj/pleroma - Forgejo

hj/pleroma

1 line

122 B

Text

Raw Normal View History

fix(federation): reject actors that point at other hosts A remote actor could set its inbox or shared inbox to a third-party host, so our signed deliveries went there. It could also claim another actor's followers collection, which the visibility checks trust. Validate fetched actors and incoming actor Updates: inbox, endpoints.sharedInbox, followers, following, featured and the publicKey id must be on the same host as the actor id. Based on Akkoma f07eb4cb5. The Bridgy fixture gets the key id that current Bridgy Fed serves.

2026-10-27 21:37:20 +04:00

Reject remote actors whose inbox, shared inbox, followers, following or featured collection, or key id is on another host