Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-26 16:46:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: skip notes.assert checks for Announce(Note) if it's a remote object, do our own checks; #12442

Browse Source
This commit is contained in:
Julian Lam
2024-03-26 13:40:18 -04:00
parent 6c1a0fb1dc
commit 4fcd2bb2d9
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/activitypub/inbox.js
View File

@@ -107,6 +107,7 @@ inbox.announce = async (req) => {
let pid;
if (String(object).startsWith(nconf.get('url'))) {
// Local object
const { type, id } = await activitypub.helpers.resolveLocalId(object);
if (type !== 'post' || !(await posts.exists(id))) {
throw new Error('[[error:activitypub.invalid-id]]');
@@ -117,13 +118,21 @@ inbox.announce = async (req) => {
socketHelpers.sendNotificationToPostOwner(pid, actor, 'announce', 'notifications:activitypub.announce');
} else {
// Remote object
const isFollowed = await db.sortedSetCard(`followersRemote:${actor}`);
if (!isFollowed) {
winston.info(`[activitypub/inbox.announce] Rejecting ${object} via ${actor} due to no followers`);
reject('Announce', object, actor);
return;
}
pid = object;
pid = await activitypub.resolveId(0, pid); // in case wrong id is passed-in; unlikely, but still.
if (!pid) {
return;
}
({ tid } = await activitypub.notes.assert(0, pid));
({ tid } = await activitypub.notes.assert(0, pid, { skipChecks: true })); // checks skipped; done above.
if (!tid) {
return;
}