chris/pixelfed
1
0
Fork 0
forked from mirror/pixelfed
Code Pull requests Activity

Update FederationController, return 404 for invalid webfinger addresses. Fixes #2647

Browse source
This commit is contained in:
Daniel Supernault 2021-02-12 21:44:06 -07:00
parent 723eb00039
commit deb6f1153f
No known key found for this signature in database
GPG key ID: 0DEF1C662C9033F7
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
app/Http/Controllers/FederationController.php
View file

@ -53,8 +53,8 @@ class FederationController extends Controller
$resource = $request->input('resource'); $resource = $request->input('resource');
$parsed = Nickname::normalizeProfileUrl($resource); $parsed = Nickname::normalizeProfileUrl($resource);
if($parsed['domain'] !== config('pixelfed.domain.app')) { if(empty($parsed) || $parsed['domain'] !== config('pixelfed.domain.app')) {
abort(400); abort(404);
} }
$username = $parsed['username']; $username = $parsed['username'];
$profile = Profile::whereNull('domain')->whereUsername($username)->firstOrFail(); $profile = Profile::whereNull('domain')->whereUsername($username)->firstOrFail();