mirrors/lemmy
1
0
Fork 0
mirror of https://github.com/LemmyNet/lemmy.git synced 2024-06-02 10:41:52 +00:00
Code Issues Projects Releases Wiki Activity

Dont allow federation to overwrite local objects

Browse source
This commit is contained in:
Felix Ableitner 2024-04-09 13:01:33 +02:00
parent 8e54a4a6cc
commit 29ebf648c7
6 changed files with 28 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
crates/apub/src/objects/comment.rs
View file

@ -158,6 +158,11 @@ impl Object for ApubComment {
/// If the parent community, post and comment(s) are not known locally, these are also fetched.
#[tracing::instrument(skip_all)]
async fn from_json(note: Note, context: &Data<LemmyContext>) -> Result<ApubComment, LemmyError> {
// Dont allow overwriting local object
if note.id.inner().domain() == Some(context.domain()) {
return note.id.dereference_local(context).await;
}
let creator = note.attributed_to.dereference(context).await?;
let (post, parent_comment) = note.get_parents(context).await?;

5
crates/apub/src/objects/community.rs
View file

@ -138,6 +138,11 @@ impl Object for ApubCommunity {
group: Group,
context: &Data<Self::DataType>,
) -> Result<ApubCommunity, LemmyError> {
// Dont allow overwriting local object
if group.id.inner().domain() == Some(context.domain()) {
return group.id.dereference_local(context).await;
}
let instance_id = fetch_instance_actor_for_object(&group.id, context).await?;
let local_site = LocalSite::read(&mut context.pool()).await.ok();

4
crates/apub/src/objects/instance.rs
View file

@ -138,6 +138,10 @@ impl Object for ApubSite {
#[tracing::instrument(skip_all)]
async fn from_json(apub: Self::Kind, context: &Data<Self::DataType>) -> Result<Self, LemmyError> {
// Dont allow overwriting local object
if apub.id.inner().domain() == Some(context.domain()) {
return apub.id.dereference_local(context).await;
}
let domain = apub.id.inner().domain().expect("group id has domain");
let instance = DbInstance::read_or_create(&mut context.pool(), domain.to_string()).await?;

4
crates/apub/src/objects/person.rs
View file

@ -149,6 +149,10 @@ impl Object for ApubPerson {
person: Person,
context: &Data<Self::DataType>,
) -> Result<ApubPerson, LemmyError> {
// Dont allow overwriting local object
if person.id.inner().domain() == Some(context.domain()) {
return person.id.dereference_local(context).await;
}
let instance_id = fetch_instance_actor_for_object(&person.id, context).await?;
let local_site = LocalSite::read(&mut context.pool()).await.ok();

5
crates/apub/src/objects/post.rs
View file

@ -182,6 +182,11 @@ impl Object for ApubPost {
#[tracing::instrument(skip_all)]
async fn from_json(page: Page, context: &Data<Self::DataType>) -> Result<ApubPost, LemmyError> {
// Dont allow overwriting local object
if page.id.inner().domain() == Some(context.domain()) {
return page.id.dereference_local(context).await;
}
let creator = page.creator()?.dereference(context).await?;
let community = page.community(context).await?;
if community.posting_restricted_to_mods {

5
crates/apub/src/objects/private_message.rs
View file

@ -121,6 +121,11 @@ impl Object for ApubPrivateMessage {
note: ChatMessage,
context: &Data<Self::DataType>,
) -> Result<ApubPrivateMessage, LemmyError> {
// Dont allow overwriting local object
if note.id.inner().domain() == Some(context.domain()) {
return note.id.dereference_local(context).await;
}
let creator = note.attributed_to.dereference(context).await?;
let recipient = note.to[0].dereference(context).await?;
check_person_block(creator.id, recipient.id, &mut context.pool()).await?;