specter/mastodon
1
0
Fork 1
forked from fedi/mastodon
Code Pull requests Activity

Fix deletes not being signed in authorized fetch mode (#17484)

Browse source 
Fix #17483
This commit is contained in:
Eugen Rochko 2022-02-11 14:52:45 +01:00 committed by GitHub
parent d4e6774a0c
commit c9a52833b6
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 15 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
app/services/concerns/payloadable.rb
View file

@ -1,13 +1,21 @@
# frozen_string_literal: true
module Payloadable
# @param [ActiveModelSerializers::Model] record
# @param [ActiveModelSerializers::Serializer] serializer
# @param [Hash] options
# @option options [Account] :signer
# @option options [String] :sign_with
# @option options [Boolean] :always_sign
# @return [Hash]
def serialize_payload(record, serializer, options = {})
signer = options.delete(:signer)
sign_with = options.delete(:sign_with)
payload = ActiveModelSerializers::SerializableResource.new(record, options.merge(serializer: serializer, adapter: ActivityPub::Adapter)).as_json
object = record.respond_to?(:virtual_object) ? record.virtual_object : record
signer = options.delete(:signer)
sign_with = options.delete(:sign_with)
always_sign = options.delete(:always_sign)
payload = ActiveModelSerializers::SerializableResource.new(record, options.merge(serializer: serializer, adapter: ActivityPub::Adapter)).as_json
object = record.respond_to?(:virtual_object) ? record.virtual_object : record
if (object.respond_to?(:sign?) && object.sign?) && signer && signing_enabled?
if (object.respond_to?(:sign?) && object.sign?) && signer && (always_sign || signing_enabled?)
ActivityPub::LinkedDataSignature.new(payload).sign!(signer, sign_with: sign_with)
else
payload

2
app/services/delete_account_service.rb
View file

@ -265,7 +265,7 @@ class DeleteAccountService < BaseService
end
def delete_actor_json
@delete_actor_json ||= Oj.dump(serialize_payload(@account, ActivityPub::DeleteActorSerializer, signer: @account))
@delete_actor_json ||= Oj.dump(serialize_payload(@account, ActivityPub::DeleteActorSerializer, signer: @account, always_sign: true))
end
def delivery_inboxes

2
app/services/remove_status_service.rb
View file

@ -95,7 +95,7 @@ class RemoveStatusService < BaseService
end
def signed_activity_json
@signed_activity_json ||= Oj.dump(serialize_payload(@status, @status.reblog? ? ActivityPub::UndoAnnounceSerializer : ActivityPub::DeleteSerializer, signer: @account))
@signed_activity_json ||= Oj.dump(serialize_payload(@status, @status.reblog? ? ActivityPub::UndoAnnounceSerializer : ActivityPub::DeleteSerializer, signer: @account, always_sign: true))
end
def remove_reblogs