diff --git a/src/activitypub/inbox.js b/src/activitypub/inbox.js index 754720f208..c1caacd698 100644 --- a/src/activitypub/inbox.js +++ b/src/activitypub/inbox.js @@ -32,11 +32,15 @@ function reject(type, object, target, senderType = 'uid', id = 0) { }).catch(err => winston.error(err.stack)); } +function publiclyAddressed(recipients) { + return activitypub._constants.acceptablePublicAddresses.some(address => recipients.includes(address)); +} + inbox.create = async (req) => { const { object, actor } = req.body; // Alternative logic for non-public objects - const isPublic = [...(object.to || []), ...(object.cc || [])].includes(activitypub._constants.publicAddress); + const isPublic = publiclyAddressed([...(object.to || []), ...(object.cc || [])]); if (!isPublic) { return await activitypub.notes.assertPrivate(object); } @@ -76,7 +80,7 @@ inbox.add = async (req) => { inbox.update = async (req) => { const { actor, object } = req.body; - const isPublic = [...(object.to || []), ...(object.cc || [])].includes(activitypub._constants.publicAddress); + const isPublic = publiclyAddressed([...(object.to || []), ...(object.cc || [])]); // Origin checking const actorHostname = new URL(actor).hostname; diff --git a/src/activitypub/index.js b/src/activitypub/index.js index 11f16322e2..167eb16d15 100644 --- a/src/activitypub/index.js +++ b/src/activitypub/index.js @@ -38,6 +38,7 @@ const ActivityPub = module.exports; ActivityPub._constants = Object.freeze({ uid: -2, publicAddress: 'https://www.w3.org/ns/activitystreams#Public', + acceptablePublicAddresses: ['https://www.w3.org/ns/activitystreams#Public', 'as:Public', 'Public'], acceptableTypes: [ 'application/activity+json', 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"',