Commit 4e44ab1b authored by Zot's avatar Zot

pubcrawl: check all encoded objects to ensure they don't contain any actors or...

pubcrawl: check all encoded objects to ensure they don't contain any actors or objects that originated in another (non-ActivityPub) network before allowing them to appear on the ActivityPub network.
parent 6b96f308
......@@ -91,7 +91,9 @@ function asencode_item_collection($items,$id,$type,$extra = null) {
if($items) {
$x = [];
foreach($items as $i) {
$x[] = asencode_activity($i);
$t = asencode_activity($i);
if($t)
$x[] = $t;
}
if($type === 'OrderedCollection')
$ret['orderedItems'] = $x;
......@@ -213,7 +215,11 @@ function asencode_item($i) {
$ret['content'] = bbcode($i['body']);
}
$ret['actor'] = asencode_person($i['author']);
$actor = asencode_person($i['author']);
if($actor)
$ret['actor'] = $actor;
else
return [];
$t = asencode_taxonomy($i);
if($t) {
......@@ -391,19 +397,34 @@ function asencode_activity($i) {
$reply = true;
}
$ret['actor'] = asencode_person($i['author']);
$actor = asencode_person($i['author']);
if($actor)
$ret['actor'] = $actor;
else
return [];
if($i['obj']) {
$ret['object'] = asencode_object($i['obj']);
$obj = asencode_object($i['obj']);
if($obj)
$ret['object'] = $obj;
else
return [];
}
else {
$ret['object'] = asencode_item($i);
$obj = asencode_object($i['obj']);
if($obj)
$ret['object'] = $obj;
else
return [];
}
if($i['target']) {
$ret['target'] = asencode_object($i['target']);
$tgt = asencode_object($i['target']);
if($tgt)
$ret['target'] = $tgt;
else
return [];
}
if(! $i['item_private']) {
......@@ -502,7 +523,11 @@ function as_map_acl($i,$mentions = false) {
function asencode_person($p) {
if(! $p['xchan_url'])
return [];
$ret = [];
$ret['type'] = 'Person';
$ret['id'] = $p['xchan_url'];
if($p['xchan_addr'] && strpos($p['xchan_addr'],'@'))
......
......@@ -358,11 +358,15 @@ function pubcrawl_channel_mod_init($x) {
if(! get_pconfig($chan['channel_id'],'system','activitypub_allowed'))
http_status_exit(404, 'Not found');
$y = asencode_person($chan);
if(! $y)
http_status_exit(404, 'Not found');
$x = array_merge(['@context' => [
ACTIVITYSTREAMS_JSONLD_REV,
'https://w3id.org/security/v1',
z_root() . ZOT_APSCHEMA_REV
]], asencode_person($chan));
]], $y);
$headers = [];
......@@ -443,6 +447,9 @@ function pubcrawl_notifier_process(&$arr) {
$target_item = $arr['target_item'];
if(! $target_item['mid'])
return;
$prv_recips = $arr['env_recips'];
......@@ -450,11 +457,15 @@ function pubcrawl_notifier_process(&$arr) {
$jmsg = $signed_msg;
}
else {
$ti = asencode_activity($target_item);
if(! $ti)
return;
$msg = array_merge(['@context' => [
ACTIVITYSTREAMS_JSONLD_REV,
'https://w3id.org/security/v1',
z_root() . ZOT_APSCHEMA_REV
]], asencode_activity($target_item));
]], $ti);
$msg['signature'] = \Zotlabs\Lib\LDSignatures::dopplesign($msg,$arr['channel']);
......@@ -603,12 +614,17 @@ function pubcrawl_connection_remove(&$x) {
if(! $channel)
return;
$p = asencode_person($channel);
if(! $p)
return;
// send an unfollow activity to the followee's inbox
$orig_activity = get_abconfig($recip[0]['abook_channel'],$recip[0]['xchan_hash'],'pubcrawl','follow_id');
if($orig_activity && $recip[0]['abook_pending']) {
// was never approved
$msg = array_merge(['@context' => [
......@@ -620,12 +636,12 @@ function pubcrawl_connection_remove(&$x) {
[
'id' => z_root() . '/follow/' . $recip[0]['abook_id'] . '#reject',
'type' => 'Reject',
'actor' => asencode_person($channel),
'actor' => $p,
'object' => [
'type' => 'Follow',
'id' => $orig_activity,
'actor' => $recip[0]['xchan_hash'],
'object' => asencode_person($channel)
'object' => $p
],
'to' => [ $recip[0]['xchan_hash'] ]
]);
......@@ -644,11 +660,11 @@ function pubcrawl_connection_remove(&$x) {
[
'id' => z_root() . '/follow/' . $recip[0]['abook_id'] . '#Undo',
'type' => 'Undo',
'actor' => asencode_person($channel),
'actor' => $p,
'object' => [
'id' => z_root() . '/follow/' . $recip[0]['abook_id'],
'type' => 'Follow',
'actor' => asencode_person($channel),
'actor' => $p,
'object' => $recip[0]['xchan_hash']
],
'to' => [ $recip[0]['xchan_hash'] ]
......@@ -687,6 +703,10 @@ function pubcrawl_permissions_create(&$x) {
return;
}
$p = asencode_person($x['sender']);
if(! $p)
return;
$msg = array_merge(['@context' => [
ACTIVITYSTREAMS_JSONLD_REV,
'https://w3id.org/security/v1',
......@@ -695,7 +715,7 @@ function pubcrawl_permissions_create(&$x) {
[
'id' => z_root() . '/follow/' . $x['recipient']['abook_id'],
'type' => 'Follow',
'actor' => asencode_person($x['sender']),
'actor' => $p,
'object' => $x['recipient']['xchan_url'],
'to' => [ $x['recipient']['xchan_hash'] ]
]);
......@@ -737,6 +757,10 @@ function pubcrawl_permissions_accept(&$x) {
if(! $accept)
return;
$p = asencode_person($x['sender']),
if(! $p)
return;
$msg = array_merge(['@context' => [
ACTIVITYSTREAMS_JSONLD_REV,
'https://w3id.org/security/v1',
......@@ -745,7 +769,7 @@ function pubcrawl_permissions_accept(&$x) {
[
'id' => z_root() . '/follow/' . $x['recipient']['abook_id'],
'type' => 'Accept',
'actor' => asencode_person($x['sender']),
'actor' => $p,
'object' => [
'type' => 'Follow',
'id' => $accept,
......@@ -787,6 +811,9 @@ function pubcrawl_profile_mod_init($x) {
if(! get_pconfig($chan['channel_id'],'system','activitypub_allowed'))
http_status_exit(404, 'Not found');
$p = asencode_person($chan);
if(! $p)
http_status_exit(404, 'Not found');
$x = [
'@context' => [
......@@ -795,7 +822,7 @@ function pubcrawl_profile_mod_init($x) {
z_root() . ZOT_APSCHEMA_REV
],
'type' => 'Profile',
'describes' => asencode_person($chan)
'describes' => $p
];
$headers = [];
......@@ -855,12 +882,16 @@ function pubcrawl_item_mod_init($x) {
if(! perm_is_allowed($chan['channel_id'],get_observer_hash(),'view_stream'))
http_status_exit(403, 'Forbidden');
$i = asencode_item($items[0]);
if(! $i)
http_status_exit(404, 'Not found');
$x = array_merge(['@context' => [
ACTIVITYSTREAMS_JSONLD_REV,
'https://w3id.org/security/v1',
z_root() . ZOT_APSCHEMA_REV
]], asencode_item($items[0]));
]], $i);
$headers = [];
......@@ -994,6 +1025,11 @@ function pubcrawl_follow_mod_init($x) {
if(! $chan)
http_status_exit(404, 'Not found');
$actor = asencode_person($chan);
if(! $actor)
http_status_exit(404, 'Not found');
$x = array_merge(['@context' => [
ACTIVITYSTREAMS_JSONLD_REV,
'https://w3id.org/security/v1',
......@@ -1002,7 +1038,7 @@ function pubcrawl_follow_mod_init($x) {
[
'id' => z_root() . '/follow/' . $r[0]['abook_id'],
'type' => 'Follow',
'actor' => asencode_person($chan),
'actor' => $actor,
'object' => $r[0]['xchan_url']
]);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment