hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix(activitypub): do not require the personal inbox owner to be addressed

Browse source 
Bridgy Fed delivers Follow and Accept to the personal inbox addressed
only to Public. Any server can already address a local user directly,
so the check gave no protection. Ported from Akkoma 2b885288f.

Co-authored-by: Oneric <oneric@oneric.stub>
This commit is contained in:
Lain Soykaf 2026-10-31 15:37:41 +04:00
commit e0546f188d
No known key found for this signature in database
5 changed files with 25 additions and 85 deletions
Download patch file Download diff file Expand all files Collapse all files

1
lib/pleroma/web/activity_pub/activity_pub_controller.ex
View file

@ -341,7 +341,6 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
{:sender_exists, User.get_or_fetch_by_ap_id(params["actor"])},
{:recipient_active, true} <- {:recipient_active, recipient.is_active},
{:sender_active, true} <- {:sender_active, actor.is_active},
true <- Utils.recipient_in_message(recipient, actor, params),
params <- Utils.maybe_splice_recipient(recipient.ap_id, params) do
Federator.incoming_ap_doc(params)
json(conn, "ok")

16
lib/pleroma/web/activity_pub/utils.ex
View file

@ -78,22 +78,6 @@ defmodule Pleroma.Web.ActivityPub.Utils do
[params["to"], params["cc"], params["bto"], params["bcc"]]
|> Enum.any?(&label_in_collection?(label, &1))
@spec unaddressed_message?(map()) :: boolean()
def unaddressed_message?(params),
do:
[params["to"], params["cc"], params["bto"], params["bcc"]]
|> Enum.all?(fn
nil -> true
[] -> true
_ -> false
end)
@spec recipient_in_message(User.t(), User.t(), map()) :: boolean()
def recipient_in_message(%User{ap_id: ap_id} = recipient, %User{} = actor, params),
do:
label_in_message?(ap_id, params) || unaddressed_message?(params) ||
User.following?(recipient, actor)
defp extract_list(target) when is_binary(target), do: [target]
defp extract_list(lst) when is_list(lst), do: lst
defp extract_list(_), do: []