mirrors/pleroma
1
0
Fork 0
mirror of https://git.pleroma.social/pleroma/pleroma.git synced 2024-12-23 00:26:30 +00:00
Code Issues Projects Releases Wiki Activity

[#1732] Made AP C2S :followers and :following endpoints serve on no auth

Browse source 
(as for related :api pipeline endpoints).
This commit is contained in:
Ivan Tashkinov 2020-05-02 18:28:04 +03:00
parent 9e3ec58280
commit 2d07ed7747
3 changed files with 7 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
lib/pleroma/web/activity_pub/activity_pub_controller.ex
View file

@ -37,9 +37,10 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
[unless_func: &FederatingPlug.federating?/0] when action not in @federating_only_actions
)
# Note: :following and :followers must be served even without authentication (as via :api)
plug(
EnsureAuthenticatedPlug
when action in [:read_inbox, :update_outbox, :whoami, :upload_media, :following, :followers]
when action in [:read_inbox, :update_outbox, :whoami, :upload_media]
)
plug(

1
lib/pleroma/web/router.ex
View file

@ -585,6 +585,7 @@ defmodule Pleroma.Web.Router do
post("/users/:nickname/outbox", ActivityPubController, :update_outbox)
post("/api/ap/upload_media", ActivityPubController, :upload_media)
# The following two are S2S as well, see `ActivityPub.fetch_follow_information_for_user/1`:
get("/users/:nickname/followers", ActivityPubController, :followers)
get("/users/:nickname/following", ActivityPubController, :following)
end

8
test/web/activity_pub/activity_pub_controller_test.exs
View file

@ -1055,12 +1055,12 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
assert result["totalItems"] == 15
end
test "returns 403 if requester is not logged in", %{conn: conn} do
test "does not require authentication", %{conn: conn} do
user = insert(:user)
conn
|> get("/users/#{user.nickname}/followers")
|> json_response(403)
|> json_response(200)
end
end
@ -1152,12 +1152,12 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
assert result["totalItems"] == 15
end
test "returns 403 if requester is not logged in", %{conn: conn} do
test "does not require authentication", %{conn: conn} do
user = insert(:user)
conn
|> get("/users/#{user.nickname}/following")
|> json_response(403)
|> json_response(200)
end
end