limepotato/akkoma
1
0
Fork 0
Code Pull requests Activity

Fix ActivityPubController.read_inbox/2

Browse source
This commit is contained in:
Egor Kislitsyn 2019-09-10 01:11:57 +07:00
parent 896ffabe37
commit e0f84d0043
2 changed files with 40 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
lib/pleroma/web/activity_pub/activity_pub_controller.ex
View file

@ -251,22 +251,36 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
def whoami(_conn, _params), do: {:error, :not_found} def whoami(_conn, _params), do: {:error, :not_found}
def read_inbox(%{assigns: %{user: user}} = conn, %{"nickname" => nickname} = params) do def read_inbox(
if nickname == user.nickname do %{assigns: %{user: %{nickname: nickname} = user}} = conn,
%{"nickname" => nickname} = params
) do
conn conn
|> put_resp_content_type("application/activity+json") |> put_resp_content_type("application/activity+json")
|> json(UserView.render("inbox.json", %{user: user, max_id: params["max_id"]})) |> put_view(UserView)
else |> render("inbox.json", user: user, max_id: params["max_id"])
err = end
dgettext("errors", "can't read inbox of %{nickname} as %{as_nickname}",
nickname: nickname, def read_inbox(%{assigns: %{user: nil}} = conn, %{"nickname" => nickname}) do
as_nickname: user.nickname err = dgettext("errors", "can't read inbox of %{nickname}", nickname: nickname)
)
conn conn
|> put_status(:forbidden) |> put_status(:forbidden)
|> json(err) |> json(err)
end end
def read_inbox(%{assigns: %{user: %{nickname: as_nickname}}} = conn, %{
"nickname" => nickname
}) do
err =
dgettext("errors", "can't read inbox of %{nickname} as %{as_nickname}",
nickname: nickname,
as_nickname: as_nickname
)
conn
|> put_status(:forbidden)
|> json(err)
end end
def handle_user_activity(user, %{"type" => "Create"} = params) do def handle_user_activity(user, %{"type" => "Create"} = params) do

11
test/web/activity_pub/activity_pub_controller_test.exs
View file

@ -365,6 +365,17 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
assert json_response(conn, 403) assert json_response(conn, 403)
end end
test "it doesn't crash without an authenticated user", %{conn: conn} do
user = insert(:user)
conn =
conn
|> put_req_header("accept", "application/activity+json")
|> get("/users/#{user.nickname}/inbox")
assert json_response(conn, 403)
end
test "it returns a note activity in a collection", %{conn: conn} do test "it returns a note activity in a collection", %{conn: conn} do
note_activity = insert(:direct_note_activity) note_activity = insert(:direct_note_activity)
note_object = Object.normalize(note_activity) note_object = Object.normalize(note_activity)