Merge pull request 'Federation: do not federate Undo Block when outgoing_blocks is off' (#8044) from lambadalambda/pleroma:fix/undo-block-outgoing-blocks into develop

Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/8044

changelog.d/undo-block-outgoing-blocks.security

@@ -0,0 +1 @@
+Do not federate the Undo of a block when `outgoing_blocks` is disabled

lib/pleroma/web/activity_pub/object_validator.ex

@@ -78,10 +78,16 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidator do
            |> Ecto.Changeset.apply_action(:insert) do
       object = stringify_keys(object)
       undone_object = Activity.get_by_ap_id(object["object"])
+      outgoing_blocks = Pleroma.Config.get([:activitypub, :outgoing_blocks])
+      # if we're undoing a block, and do not permit federating that:
+      do_not_federate =
+        Keyword.get(meta, :do_not_federate) ||
+          (Map.get(undone_object.data, "type") == "Block" && !outgoing_blocks)
 
       meta =
         meta
         |> Keyword.put(:object_data, undone_object.data)
+        |> Keyword.put(:do_not_federate, do_not_federate)
 
       {:ok, object, meta}
     end

test/pleroma/web/common_api_test.exs

@@ -338,6 +338,26 @@ defmodule Pleroma.Web.CommonAPITest do
       assert {:ok, :no_activity} == CommonAPI.unblock(blocked, blocker)
       refute User.blocks?(blocker, blocked)
     end
+
+    test "it unblocks and does not federate if outgoing blocks are disabled" do
+      clear_config([:instance, :federating], true)
+      clear_config([:activitypub, :outgoing_blocks], false)
+
+      blocked = insert(:user)
+      blocker = insert(:user)
+
+      with_mock Pleroma.Web.Federator,
+        publish: fn _ -> nil end do
+        assert {:ok, block} = CommonAPI.block(blocked, blocker)
+        assert block.local
+        assert User.blocks?(blocker, blocked)
+
+        assert {:ok, unblock} = CommonAPI.unblock(blocked, blocker)
+        assert unblock.local
+        refute User.blocks?(blocker, blocked)
+        assert_not_called(Pleroma.Web.Federator.publish(:_))
+      end
+    end
   end
 
   describe "deletion" do