hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix(activitypub): check OAuth scopes on C2S endpoints

Browse source 
The C2S routes and the outbox/followers/following/replies collections
accepted a token with any scope. Requests with an OAuth token now need
the matching scope; HTTP signatures and Basic auth are not changed.
This commit is contained in:
Lain Soykaf 2026-10-26 12:46:59 +04:00
commit da7e75ca73
No known key found for this signature in database
3 changed files with 147 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
changelog.d/ap-c2s-oauth-scopes.security Normal file
View file

@ -0,0 +1 @@
Check OAuth token scopes on the ActivityPub C2S endpoints; posting to the outbox with a token now needs the `write` scope