Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2026-01-05 07:10:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: regression on remote deletes, received object is not always a simple id

Browse Source
This commit is contained in:
Julian Lam
2024-11-27 12:47:24 -05:00
parent c6726113ac
commit 3780fdc6ff
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/activitypub/inbox.js
View File

@@ -203,9 +203,15 @@ inbox.delete = async (req) => {
// probably 410/404
}
// Origin checking
// Deletions must be made by an actor of the same origin
const actorHostname = new URL(actor).hostname;
const objectHostname = new URL(object).hostname;
if (typeof object !== 'string') {
const { id } = object;
if (!id) {
throw new Error('[[error:activitypub.origin-mismatch]]');
}
}
const objectHostname = new URL(object.id || object).hostname;
if (actorHostname !== objectHostname) {
throw new Error('[[error:activitypub.origin-mismatch]]');
}
@@ -229,7 +235,7 @@ inbox.delete = async (req) => {
// }
default: {
activitypub.helpers.log(`[activitypub/inbox.delete] Object (${object}) does not exist locally. Doing nothing.`);
activitypub.helpers.log(`[activitypub/inbox.delete] Object (${object.id || object}) does not exist locally. Doing nothing.`);
break;
}
}