Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2026-02-28 09:31:17 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: regression on remote deletes, received object is not always a simple id

Browse Source
This commit is contained in:
Julian Lam
2024-11-27 12:47:24 -05:00
parent c6726113ac
commit 3780fdc6ff
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/activitypub/inbox.js
View File

@@ -203,9 +203,15 @@ inbox.delete = async (req) => {
// probably 410/404 // probably 410/404
} }
// Origin checking // Deletions must be made by an actor of the same origin
const actorHostname = new URL(actor).hostname; const actorHostname = new URL(actor).hostname;
const objectHostname = new URL(object).hostname; if (typeof object !== 'string') {
const { id } = object;
if (!id) {
throw new Error('[[error:activitypub.origin-mismatch]]');
}
}
const objectHostname = new URL(object.id || object).hostname;
if (actorHostname !== objectHostname) { if (actorHostname !== objectHostname) {
throw new Error('[[error:activitypub.origin-mismatch]]'); throw new Error('[[error:activitypub.origin-mismatch]]');
} }
@@ -229,7 +235,7 @@ inbox.delete = async (req) => {
// } // }
default: { default: {
activitypub.helpers.log(`[activitypub/inbox.delete] Object (${object}) does not exist locally. Doing nothing.`); activitypub.helpers.log(`[activitypub/inbox.delete] Object (${object.id || object}) does not exist locally. Doing nothing.`);
break; break;
} }
} }