nocebo/diaspora
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix a few issues with public receiver which include:

Browse source 
* Make Retraction be allowed to be received publicly (probably just never used before anywhere)
* Since public receiver bypasses @object.receive in some cases add the author signature verification for relayables to protect from relayables forgery
* xml_author was wrong in some cases for RelayableRetraction
This commit is contained in:
cmrd Senya 2015-12-22 17:10:07 +03:00 committed by Dennis Schubert
parent e54f87b7a6
commit 56f022f28c
1 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
lib/postzord/receiver/public.rb
View file

@ -24,7 +24,7 @@ class Postzord::Receiver::Public < Postzord::Receiver
parse_and_receive(@salmon.parsed_data) parse_and_receive(@salmon.parsed_data)
logger.info "received a #{@object.inspect}" logger.info "received a #{@object.inspect}"
if @object.is_a?(SignedRetraction) # feels like a hack if @object.is_a?(SignedRetraction) || @object.is_a?(Retraction) # feels like a hack
self.recipient_user_ids.each do |user_id| self.recipient_user_ids.each do |user_id|
user = User.where(id: user_id).first user = User.where(id: user_id).first
@object.perform user if user @object.perform user if user
@ -44,6 +44,11 @@ class Postzord::Receiver::Public < Postzord::Receiver
# receive relayable object only for the owner of the parent object # receive relayable object only for the owner of the parent object
@object.receive(@object.parent_author.owner, @author) @object.receive(@object.parent_author.owner, @author)
end end
unless @object.signature_valid?
@object.destroy
logger.warn "event=receive status=abort reason='object signature not valid' "
return
end
# notify everyone who can see the parent object # notify everyone who can see the parent object
receiver = Postzord::Receiver::LocalBatch.new(@object, self.recipient_user_ids) receiver = Postzord::Receiver::LocalBatch.new(@object, self.recipient_user_ids)
receiver.notify_users receiver.notify_users
@ -74,7 +79,11 @@ class Postzord::Receiver::Public < Postzord::Receiver
end end
def xml_author def xml_author
if @object.respond_to?(:relayable?) if @object.is_a?(RelayableRetraction)
if [@object.parent_diaspora_handle, @object.target.parent.diaspora_handle].include?(@author.diaspora_handle)
@author.diaspora_handle
end
elsif @object.respond_to?(:relayable?)
#this is public, so it would only be owners sending us other people comments etc #this is public, so it would only be owners sending us other people comments etc
@object.parent_author.local? ? @object.diaspora_handle : @object.parent_diaspora_handle @object.parent_author.local? ? @object.diaspora_handle : @object.parent_diaspora_handle
else else