gitea/nas
1
0
Fork 2
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Fix: フレンドサーバー申請時、ドメインを偽装して無関係のInboxを指定できる脆弱性 (#932)

Browse source
This commit is contained in:
KMY（雪あすか） 2024-12-04 12:03:18 +09:00 • committed by GitHub
parent 4a3c2d7ed7
commit 43819a8c02
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 20 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

14
app/lib/activitypub/activity/follow.rb
View file

@ -60,19 +60,13 @@ class ActivityPub::Activity::Follow < ActivityPub::Activity
already_accepted = friend.accepted?
friend.update!(passive_state: :pending, active_state: :idle, passive_follow_activity_id: @json['id'])
else
@friend = FriendDomain.new(domain: @account.domain, passive_state: :pending, passive_follow_activity_id: @json['id'])
@friend.inbox_url = @json['inboxUrl'].presence || @friend.default_inbox_url
@friend.save!
@friend = FriendDomain.create!(domain: @account.domain, passive_state: :pending, passive_follow_activity_id: @json['id'], inbox_url: @account.preferred_inbox_url)
end
if already_accepted || Setting.unlocked_friend
friend.accept!
friend.accept! if already_accepted || Setting.unlocked_friend
# Notify for admin even if unlocked
notify_staff_about_pending_friend_server! unless already_accepted
else
notify_staff_about_pending_friend_server!
end
# Notify for admin
notify_staff_about_pending_friend_server! unless already_accepted
end
def friend