hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

ActivityPubController: require validated host header

Browse source
This commit is contained in:
Phantasm 2026-05-13 00:32:16 +02:00
commit 95b15190de
No known key found for this signature in database
GPG key ID: 2669E588BCC634C8
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
lib/pleroma/web/activity_pub/activity_pub_controller.ex
View file

@ -303,7 +303,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
end end
end end
def inbox(%{assigns: %{valid_signature: true}} = conn, %{"nickname" => nickname} = params) do def inbox(%{assigns: %{valid_signature: true, valid_host_header: true}} = conn, %{"nickname" => nickname} = params) do
with {:recipient_exists, %User{} = recipient} <- with {:recipient_exists, %User{} = recipient} <-
{:recipient_exists, User.get_cached_by_nickname(nickname)}, {:recipient_exists, User.get_cached_by_nickname(nickname)},
{:sender_exists, {:ok, %User{} = actor}} <- {:sender_exists, {:ok, %User{} = actor}} <-
@ -342,7 +342,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
end end
end end
def inbox(%{assigns: %{valid_signature: true}} = conn, params) do def inbox(%{assigns: %{valid_signature: true, valid_host_header: true}} = conn, params) do
Federator.incoming_ap_doc(params) Federator.incoming_ap_doc(params)
json(conn, "ok") json(conn, "ok")
end end