Commit d890bdd6 authored by kaniini's avatar kaniini

Merge branch 'block_unauth' into 'master'

reject activities from instance not on relay-list

See merge request !11
parents 9d1c6a3f 1065c5ff
......@@ -272,10 +272,14 @@ processors = {
async def inbox(request):
data = await request.json()
instance = urlsplit(data['actor']).hostname
if 'actor' not in data or not request['validated']:
raise aiohttp.web.HTTPUnauthorized(body='access denied', content_type='text/plain')
if data['type'] != 'Follow' and 'https://{}/inbox'.format(instance) not in DATABASE['relay-list']:
raise aiohttp.web.HTTPUnauthorized(body='access denied', content_type='text/plain')
actor = await fetch_actor(data["actor"])
actor_uri = 'https://{}/actor'.format(request.host)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment