diff --git a/CHANGELOG.md b/CHANGELOG.md index b8f6c1572..f6115fca3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -40,6 +40,9 @@ - Update StatusEntityLexer, stop saving entities ([a91a5e48](https://github.com/pixelfed/pixelfed/commit/a91a5e48)) - Update UserCreate command, fix is_admin flag ([ad25ed67](https://github.com/pixelfed/pixelfed/commit/ad25ed67)) - Update Bouncer, adjust advanced Autospam logic ([18cddd43](https://github.com/pixelfed/pixelfed/commit/18cddd43)) +- Update atom view, fix atom feed bug ([63b72c42](https://github.com/pixelfed/pixelfed/commit/63b72c42)) +- Update StatusController, disable post embeds from spam accounts ([c167af43](https://github.com/pixelfed/pixelfed/commit/c167af43)) +- Update ProfileController, require login to view spam accounts, and disable profile embeds and atom feeds for spam accounts ([dd2f5bb9](https://github.com/pixelfed/pixelfed/commit/dd2f5bb9)) - ([](https://github.com/pixelfed/pixelfed/commit/)) ## [v0.11.6 (2023-05-03)](https://github.com/pixelfed/pixelfed/compare/v0.11.5...v0.11.6) diff --git a/app/Http/Controllers/ProfileController.php b/app/Http/Controllers/ProfileController.php index d092d349b..408c5be32 100644 --- a/app/Http/Controllers/ProfileController.php +++ b/app/Http/Controllers/ProfileController.php @@ -7,6 +7,7 @@ use Auth; use Cache; use DB; use View; +use App\AccountInterstitial; use App\Follower; use App\FollowRequest; use App\Profile; @@ -42,9 +43,22 @@ class ProfileController extends Controller ->whereUsername($username) ->firstOrFail(); + if($request->wantsJson() && config_cache('federation.activitypub.enabled')) { return $this->showActivityPub($request, $user); } + + $aiCheck = Cache::remember('profile:ai-check:spam-login:' . $user->id, 86400, function() use($user) { + $exists = AccountInterstitial::whereUserId($user->user_id)->where('is_spam', 1)->count(); + if($exists) { + return true; + } + + return false; + }); + if($aiCheck) { + return redirect('/login'); + } return $this->buildProfile($request, $user); } @@ -207,7 +221,22 @@ class ProfileController extends Controller abort_if(!$profile || $profile['locked'] || !$profile['local'], 404); - $data = Cache::remember('pf:atom:user-feed:by-id:' . $profile['id'], 43200, function() use($pid, $profile) { + $aiCheck = Cache::remember('profile:ai-check:spam-login:' . $profile['id'], 86400, function() use($profile) { + $uid = User::whereProfileId($profile['id'])->first(); + if(!$uid) { + return true; + } + $exists = AccountInterstitial::whereUserId($uid->id)->where('is_spam', 1)->count(); + if($exists) { + return true; + } + + return false; + }); + + abort_if($aiCheck, 404); + + $data = Cache::remember('pf:atom:user-feed:by-id:' . $profile['id'], 900, function() use($pid, $profile) { $items = DB::table('statuses') ->whereProfileId($pid) ->whereVisibility('public') @@ -234,7 +263,7 @@ class ProfileController extends Controller return compact('items', 'permalink', 'headers'); }); - abort_if(!$data, 404); + abort_if(!$data || !isset($data['items']) || !isset($data['permalink']), 404); return response() ->view('atom.user', [ @@ -274,6 +303,19 @@ class ProfileController extends Controller return response($res)->withHeaders(['X-Frame-Options' => 'ALLOWALL']); } + $aiCheck = Cache::remember('profile:ai-check:spam-login:' . $profile->id, 86400, function() use($profile) { + $exists = AccountInterstitial::whereUserId($profile->user_id)->where('is_spam', 1)->count(); + if($exists) { + return true; + } + + return false; + }); + + if($aiCheck) { + return response($res)->withHeaders(['X-Frame-Options' => 'ALLOWALL']); + } + if(AccountService::canEmbed($profile->user_id) == false) { return response($res)->withHeaders(['X-Frame-Options' => 'ALLOWALL']); } diff --git a/app/Http/Controllers/StatusController.php b/app/Http/Controllers/StatusController.php index 4762c3f84..43ac03263 100644 --- a/app/Http/Controllers/StatusController.php +++ b/app/Http/Controllers/StatusController.php @@ -115,10 +115,25 @@ class StatusController extends Controller ->whereIsPrivate(false) ->whereUsername($username) ->first(); + if(!$profile) { $content = view('status.embed-removed'); return response($content)->header('X-Frame-Options', 'ALLOWALL'); } + + $aiCheck = Cache::remember('profile:ai-check:spam-login:' . $profile->id, 86400, function() use($profile) { + $exists = AccountInterstitial::whereUserId($profile->user_id)->where('is_spam', 1)->count(); + if($exists) { + return true; + } + + return false; + }); + + if($aiCheck) { + $res = view('status.embed-removed'); + return response($res)->withHeaders(['X-Frame-Options' => 'ALLOWALL']); + } $status = Status::whereProfileId($profile->id) ->whereNull('uri') ->whereScope('public') diff --git a/resources/views/atom/user.blade.php b/resources/views/atom/user.blade.php index 0b7595ddf..b0c2ee073 100644 --- a/resources/views/atom/user.blade.php +++ b/resources/views/atom/user.blade.php @@ -6,13 +6,18 @@ {{$permalink}} {{$profile['username']}} on Pixelfed {{$profile['note']}} - {{$items[0]['created_at']}} + @if($items && count($items)) +{{$items[0]['created_at']}} + @endif + {{$profile['username']}} {{$profile['url']}} + + @if($items && count($items)) @foreach($items as $item) {{ $item['url'] }} @@ -35,4 +40,7 @@ @endforeach + +@endif +