Update Federation, use proper Content-Type headers for following/foll…

…ower collections
pixelfed · Feb 16, 2024 · fb0bb9a · fb0bb9a
1 parent 221fe43
commit fb0bb9a
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 2 deletions.
diff --git a/app/Http/Controllers/FederationController.php b/app/Http/Controllers/FederationController.php
@@ -253,7 +253,7 @@ public function userFollowing(Request $request, $username)
             'type'     => 'OrderedCollection',
             'totalItems' => $account['following_count'] ?? 0,
         ];
-        return response()->json($obj);
+        return response()->json($obj)->header('Content-Type', 'application/activity+json');
     }
 
     public function userFollowers(Request $request, $username)
@@ -269,6 +269,6 @@ public function userFollowers(Request $request, $username)
             'type'     => 'OrderedCollection',
             'totalItems' => $account['followers_count'] ?? 0,
         ];
-        return response()->json($obj);
+        return response()->json($obj)->header('Content-Type', 'application/activity+json');
     }
 }
diff --git a/app/Util/ActivityPub/Helpers.php b/app/Util/ActivityPub/Helpers.php
@@ -372,6 +372,10 @@ public static function statusFirstOrFetch($url, $replyTo = false)
         $idDomain = parse_url($id, PHP_URL_HOST);
         $urlDomain = parse_url($url, PHP_URL_HOST);
 
+        if($idDomain && $urlDomain && strtolower($idDomain) !== strtolower($urlDomain)) {
+            return;
+        }
+
         if(!self::validateUrl($id)) {
             return;
         }
@@ -455,14 +459,21 @@ public static function statusFirstOrFetch($url, $replyTo = false)
 
     public static function storeStatus($url, $profile, $activity)
     {
+        $originalUrl = $url;
         $id = isset($activity['id']) ? self::pluckval($activity['id']) : self::pluckval($activity['url']);
         $url = isset($activity['url']) && is_string($activity['url']) ? self::pluckval($activity['url']) : self::pluckval($id);
         $idDomain = parse_url($id, PHP_URL_HOST);
         $urlDomain = parse_url($url, PHP_URL_HOST);
+        $originalUrlDomain = parse_url($originalUrl, PHP_URL_HOST);
         if(!self::validateUrl($id) || !self::validateUrl($url)) {
             return;
         }
 
+        if( strtolower($originalUrlDomain) !== strtolower($idDomain) ||
+            strtolower($originalUrlDomain) !== strtolower($urlDomain) ) {
+            return;
+        }
+
         $reply_to = self::getReplyTo($activity);
 
         $ts = self::pluckval($activity['published']);
@@ -763,7 +774,11 @@ public static function profileUpdateOrCreate($url)
         if(!$res || isset($res['id']) == false) {
             return;
         }
+        $urlDomain = parse_url($url, PHP_URL_HOST);
         $domain = parse_url($res['id'], PHP_URL_HOST);
+        if(strtolower($urlDomain) !== strtolower($domain)) {
+            return;
+        }
         if(!isset($res['preferredUsername']) && !isset($res['nickname'])) {
             return;
         }
@@ -831,6 +846,9 @@ public static function profileFetch($url)
 
     public static function sendSignedObject($profile, $url, $body)
     {
+        if(app()->environment() !== 'production') {
+            return;
+        }
         ActivityPubDeliveryService::queue()
             ->from($profile)
             ->to($url)