Merge pull request #4929 from pixelfed/staging

Staging

CHANGELOG.md

@@ -6,6 +6,7 @@
 
 - Update ApiV1Controller, fix network timeline ([0faf59e3](https://github.com/pixelfed/pixelfed/commit/0faf59e3))
 - Update public/network timelines, fix non-redis response and fix reblogs in home feed ([8b4ac5cc](https://github.com/pixelfed/pixelfed/commit/8b4ac5cc))
+- Update Federation, use proper Content-Type headers for following/follower collections ([fb0bb9a3](https://github.com/pixelfed/pixelfed/commit/fb0bb9a3))
 -  ([](https://github.com/pixelfed/pixelfed/commit/))
 
 ## [v0.11.11 (2024-02-09)](https://github.com/pixelfed/pixelfed/compare/v0.11.10...v0.11.11)

app/Http/Controllers/FederationController.php

@@ -253,7 +253,7 @@ class FederationController extends Controller
             'type'     => 'OrderedCollection',
             'totalItems' => $account['following_count'] ?? 0,
         ];
-        return response()->json($obj);
+        return response()->json($obj)->header('Content-Type', 'application/activity+json');
     }
 
     public function userFollowers(Request $request, $username)
@@ -269,6 +269,6 @@ class FederationController extends Controller
             'type'     => 'OrderedCollection',
             'totalItems' => $account['followers_count'] ?? 0,
         ];
-        return response()->json($obj);
+        return response()->json($obj)->header('Content-Type', 'application/activity+json');
     }
 }

app/Util/ActivityPub/Helpers.php

@@ -372,6 +372,10 @@ class Helpers {
         $idDomain = parse_url($id, PHP_URL_HOST);
         $urlDomain = parse_url($url, PHP_URL_HOST);
 
+        if($idDomain && $urlDomain && strtolower($idDomain) !== strtolower($urlDomain)) {
+            return;
+        }
+
         if(!self::validateUrl($id)) {
             return;
         }
@@ -455,14 +459,21 @@ class Helpers {
 
     public static function storeStatus($url, $profile, $activity)
     {
+        $originalUrl = $url;
         $id = isset($activity['id']) ? self::pluckval($activity['id']) : self::pluckval($activity['url']);
         $url = isset($activity['url']) && is_string($activity['url']) ? self::pluckval($activity['url']) : self::pluckval($id);
         $idDomain = parse_url($id, PHP_URL_HOST);
         $urlDomain = parse_url($url, PHP_URL_HOST);
+        $originalUrlDomain = parse_url($originalUrl, PHP_URL_HOST);
         if(!self::validateUrl($id) || !self::validateUrl($url)) {
             return;
         }
 
+        if( strtolower($originalUrlDomain) !== strtolower($idDomain) ||
+            strtolower($originalUrlDomain) !== strtolower($urlDomain) ) {
+            return;
+        }
+
         $reply_to = self::getReplyTo($activity);
 
         $ts = self::pluckval($activity['published']);
@@ -763,7 +774,11 @@ class Helpers {
         if(!$res || isset($res['id']) == false) {
             return;
         }
+        $urlDomain = parse_url($url, PHP_URL_HOST);
         $domain = parse_url($res['id'], PHP_URL_HOST);
+        if(strtolower($urlDomain) !== strtolower($domain)) {
+            return;
+        }
         if(!isset($res['preferredUsername']) && !isset($res['nickname'])) {
             return;
         }
@@ -831,6 +846,9 @@ class Helpers {
 
     public static function sendSignedObject($profile, $url, $body)
     {
+        if(app()->environment() !== 'production') {
+            return;
+        }
         ActivityPubDeliveryService::queue()
             ->from($profile)
             ->to($url)