FediMovies/fedimovies
1
1
Fork 0
Code Issues 3 Pull requests Packages Projects Releases Activity

Verify object ID when processing Update(Person) activity

Browse source
This commit is contained in:
silverpill 2022-01-03 23:45:18 +00:00
parent d045df4232
commit 5dc07c3742
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/activitypub/receiver.rs
View file

@ -581,6 +581,9 @@ pub async fn receive_activity(
let actor_value = activity.object.clone();
let actor: Actor = serde_json::from_value(activity.object)
.map_err(|_| ValidationError("invalid actor data"))?;
if actor.id != activity.actor {
return Err(HttpError::ValidationError("actor ID mismatch".into()));
};
let profile = get_profile_by_actor_id(db_client, &actor.id).await?;
let (avatar, banner) = fetch_avatar_and_banner(&actor, &config.media_dir()).await
.map_err(|_| ValidationError("failed to fetch image"))?;