695dd340deA remote actor could set its inbox or shared inbox to a third-party host, so our signed deliveries went there. It could also claim another actor's followers collection, which the visibility checks trust. Validate fetched actors and incoming actor Updates: inbox, endpoints.sharedInbox, followers, following, featured and the publicKey id must be on the same host as the actor id. Based on Akkoma f07eb4cb5. The Bridgy fixture gets the key id that current Bridgy Fed serves.
1 line
122 B
Text
1 line
122 B
Text
Reject remote actors whose inbox, shared inbox, followers, following or featured collection, or key id is on another host
|