hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix url guessing attacks.

Browse source
This commit is contained in:
lain 2018-05-30 20:00:27 +02:00
commit 5e76adb07e
4 changed files with 74 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
lib/pleroma/web/activity_pub/activity_pub_controller.ex
View file

@ -20,10 +20,16 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
def object(conn, %{"uuid" => uuid}) do
with ap_id <- o_status_url(conn, :object, uuid),
%Object{} = object <- Object.get_cached_by_ap_id(ap_id) do
%Object{} = object <- Object.get_cached_by_ap_id(ap_id),
{_, true} <- {:public?, ActivityPub.is_public?(object)} do
conn
|> put_resp_header("content-type", "application/activity+json")
|> json(ObjectView.render("object.json", %{object: object}))
else
{:public?, false} ->
conn
|> put_status(404)
|> json("Not found")
end
end