diff --git a/modules/forgefed/actor.go b/modules/forgefed/actor.go index ae1e96e37b..7a8c2e923d 100644 --- a/modules/forgefed/actor.go +++ b/modules/forgefed/actor.go @@ -125,11 +125,18 @@ type RepositoryID struct { } // Factory function for RepositoryID. Created struct is asserted to be valid. -func NewRepositoryID(uri, source string) (RepositoryID, error) { - // ToDo: Here we check if the uri is coming from OUR machine. This fails for any urls pointing to other machines. - if !validation.IsAPIURL(uri) { - return RepositoryID{}, fmt.Errorf("uri %s is not a valid repo url on this host %s", uri, setting.AppURL+"api") +func NewRepositoryID(uri, source string, isFollowing bool) (RepositoryID, error) { + + if isFollowing { + if !validation.IsValidURL(uri) { + return RepositoryID{}, fmt.Errorf("uri %s is not a valid url on their host: %s", uri, setting.AppURL+"api") + } + } else { + if !validation.IsAPIURL(uri) { + return RepositoryID{}, fmt.Errorf("uri %s is not a valid repo url on our host: %s", uri, setting.AppURL+"api") + } } + result, err := newActorID(uri) if err != nil { return RepositoryID{}, err diff --git a/modules/forgefed/actor_test.go b/modules/forgefed/actor_test.go index a3c01eceb0..9f41a359ad 100644 --- a/modules/forgefed/actor_test.go +++ b/modules/forgefed/actor_test.go @@ -52,7 +52,7 @@ func TestNewRepositoryId(t *testing.T) { expected.Host = "localhost" expected.Port = "3000" expected.UnvalidatedInput = "http://localhost:3000/api/activitypub/repository-id/1" - sut, _ := NewRepositoryID("http://localhost:3000/api/activitypub/repository-id/1", "forgejo") + sut, _ := NewRepositoryID("http://localhost:3000/api/activitypub/repository-id/1", "forgejo", false) if sut != expected { t.Errorf("expected: %v\n but was: %v\n", expected, sut) } diff --git a/services/federation/federation_service.go b/services/federation/federation_service.go index a7d9b6ef80..9a54b569ed 100644 --- a/services/federation/federation_service.go +++ b/services/federation/federation_service.go @@ -55,7 +55,7 @@ func ProcessLikeActivity(ctx context.Context, form any, repositoryID int64) (int log.Info("Actor accepted:%v", actorID) // parse objectID (repository) - objectID, err := fm.NewRepositoryID(activity.Object.GetID().String(), string(forgefed.ForgejoSourceType)) + objectID, err := fm.NewRepositoryID(activity.Object.GetID().String(), string(forgefed.ForgejoSourceType), false) if err != nil { return http.StatusNotAcceptable, "Invalid objectId", err } @@ -222,7 +222,7 @@ func StoreFollowingRepoList(ctx context.Context, localRepoID int64, followingRep if err != nil { return http.StatusInternalServerError, "Wrong FederationHost", err } - followingRepoID, err := fm.NewRepositoryID(uri, string(federationHost.NodeInfo.SoftwareName)) + followingRepoID, err := fm.NewRepositoryID(uri, string(federationHost.NodeInfo.SoftwareName), true) if err != nil { return http.StatusNotAcceptable, "Invalid federated repo", err }