nobigtech
/
pleroma-relay
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge branch 'block_unauth' into 'master' 

reject activities from instance not on relay-list

See merge request pleroma/relay!11
This commit is contained in:
kaniini 2019-05-13 18:39:05 +00:00
parent 9d1c6a3fa2 1065c5ff36
commit d890bdd6ed
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
relay/actor.py
View File

@ -272,10 +272,14 @@ processors = {
async def inbox(request): async def inbox(request):
data = await request.json() data = await request.json()
instance = urlsplit(data['actor']).hostname
if 'actor' not in data or not request['validated']: if 'actor' not in data or not request['validated']:
raise aiohttp.web.HTTPUnauthorized(body='access denied', content_type='text/plain') raise aiohttp.web.HTTPUnauthorized(body='access denied', content_type='text/plain')
if data['type'] != 'Follow' and 'https://{}/inbox'.format(instance) not in DATABASE['relay-list']:
raise aiohttp.web.HTTPUnauthorized(body='access denied', content_type='text/plain')
actor = await fetch_actor(data["actor"]) actor = await fetch_actor(data["actor"])
actor_uri = 'https://{}/actor'.format(request.host) actor_uri = 'https://{}/actor'.format(request.host)