From a5a354a36e144c19ce3f9e79cb898227fc7ef723 Mon Sep 17 00:00:00 2001 From: Sean King Date: Wed, 21 Jun 2023 23:10:56 -0600 Subject: [PATCH] Prevent bypassing authorized fetch mode with a json file --- lib/pleroma/web/plugs/http_signature_plug.ex | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/pleroma/web/plugs/http_signature_plug.ex b/lib/pleroma/web/plugs/http_signature_plug.ex index 4bf325218..e814efc2c 100644 --- a/lib/pleroma/web/plugs/http_signature_plug.ex +++ b/lib/pleroma/web/plugs/http_signature_plug.ex @@ -16,7 +16,7 @@ defmodule Pleroma.Web.Plugs.HTTPSignaturePlug do end def call(conn, _opts) do - if get_format(conn) == "activity+json" do + if get_format(conn) in ["json", "activity+json"] do conn |> maybe_assign_valid_signature() |> maybe_require_signature()