GNUsocial
/
gnu-social
4
0
Fork 1
Code Issues Releases Wiki Activity

[ActivityPub] Fix security issue concerning remote profile deletes 

Reported by kaniini
This commit is contained in:
Diogo Cordeiro 2019-10-11 17:41:41 +01:00
parent 5fb1e26a4c
commit b12c2d17d5
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
plugins/ActivityPub/lib/inbox_handler.php
View File

@ -224,7 +224,8 @@ class Activitypub_inbox_handler
* Handles a Delete Activity received by our inbox.
*
* @throws NoProfileException
* @author Diogo Cordeiro <diogo@fc.up.pt>
* @throws Exception
* @author Bruno Casteleiro <brunoccast@fc.up.pt>
*/
private function handle_delete()
{
@ -234,8 +235,8 @@ class Activitypub_inbox_handler
}
// profile deletion ?
$aprofile = Activitypub_explorer::get_aprofile_by_url($object);
if ($aprofile instanceof Activitypub_profile) {
if ($this->activity['actor'] == $object) {
$aprofile = Activitypub_profile::from_profile($this->actor);
$this->handle_delete_profile($aprofile);
return;
}
@ -248,7 +249,7 @@ class Activitypub_inbox_handler
}
return;
} catch (Exception $e) {
// either already deleted or not a notice at all
// either already deleted or not an object at all
// nothing to do..
}