diff --git a/CHANGELOG.md b/CHANGELOG.md index d3331d10d..d01a049fb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ - Update ApiV1Controller, fix network timeline ([0faf59e3](https://github.com/pixelfed/pixelfed/commit/0faf59e3)) - Update public/network timelines, fix non-redis response and fix reblogs in home feed ([8b4ac5cc](https://github.com/pixelfed/pixelfed/commit/8b4ac5cc)) +- Update Federation, use proper Content-Type headers for following/follower collections ([fb0bb9a3](https://github.com/pixelfed/pixelfed/commit/fb0bb9a3)) - ([](https://github.com/pixelfed/pixelfed/commit/)) ## [v0.11.11 (2024-02-09)](https://github.com/pixelfed/pixelfed/compare/v0.11.10...v0.11.11) diff --git a/app/Http/Controllers/FederationController.php b/app/Http/Controllers/FederationController.php index 6faea7050..55c7b4393 100644 --- a/app/Http/Controllers/FederationController.php +++ b/app/Http/Controllers/FederationController.php @@ -253,7 +253,7 @@ class FederationController extends Controller 'type' => 'OrderedCollection', 'totalItems' => $account['following_count'] ?? 0, ]; - return response()->json($obj); + return response()->json($obj)->header('Content-Type', 'application/activity+json'); } public function userFollowers(Request $request, $username) @@ -269,6 +269,6 @@ class FederationController extends Controller 'type' => 'OrderedCollection', 'totalItems' => $account['followers_count'] ?? 0, ]; - return response()->json($obj); + return response()->json($obj)->header('Content-Type', 'application/activity+json'); } } diff --git a/app/Util/ActivityPub/Helpers.php b/app/Util/ActivityPub/Helpers.php index 5819dc0bc..6f5b8ae11 100644 --- a/app/Util/ActivityPub/Helpers.php +++ b/app/Util/ActivityPub/Helpers.php @@ -372,6 +372,10 @@ class Helpers { $idDomain = parse_url($id, PHP_URL_HOST); $urlDomain = parse_url($url, PHP_URL_HOST); + if($idDomain && $urlDomain && strtolower($idDomain) !== strtolower($urlDomain)) { + return; + } + if(!self::validateUrl($id)) { return; } @@ -455,14 +459,21 @@ class Helpers { public static function storeStatus($url, $profile, $activity) { + $originalUrl = $url; $id = isset($activity['id']) ? self::pluckval($activity['id']) : self::pluckval($activity['url']); $url = isset($activity['url']) && is_string($activity['url']) ? self::pluckval($activity['url']) : self::pluckval($id); $idDomain = parse_url($id, PHP_URL_HOST); $urlDomain = parse_url($url, PHP_URL_HOST); + $originalUrlDomain = parse_url($originalUrl, PHP_URL_HOST); if(!self::validateUrl($id) || !self::validateUrl($url)) { return; } + if( strtolower($originalUrlDomain) !== strtolower($idDomain) || + strtolower($originalUrlDomain) !== strtolower($urlDomain) ) { + return; + } + $reply_to = self::getReplyTo($activity); $ts = self::pluckval($activity['published']); @@ -763,7 +774,11 @@ class Helpers { if(!$res || isset($res['id']) == false) { return; } + $urlDomain = parse_url($url, PHP_URL_HOST); $domain = parse_url($res['id'], PHP_URL_HOST); + if(strtolower($urlDomain) !== strtolower($domain)) { + return; + } if(!isset($res['preferredUsername']) && !isset($res['nickname'])) { return; } @@ -831,6 +846,9 @@ class Helpers { public static function sendSignedObject($profile, $url, $body) { + if(app()->environment() !== 'production') { + return; + } ActivityPubDeliveryService::queue() ->from($profile) ->to($url)