Dereference object URIs in Create and Update messages #14359
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Fixes mastodon#14353 Signed-off-by: Thibaut Girka <thib@sitedethib.com>
ClearlyClaire
commented
Jul 19, 2020
Gargron
approved these changes
Jul 22, 2020
ClearlyClaire
added a commit
to ClearlyClaire/mastodon
that referenced
this pull request
Aug 24, 2020
Follow-up to mastodon#14359 In the case of limited toots, the receiver may not be explicitly part of the audience. If a specific user's inbox URI was specified, it makes sense to dereference the toot from the corresponding user, instead of trying to find someone in the explicit audience.
Gargron
pushed a commit
that referenced
this pull request
Aug 24, 2020
Follow-up to #14359 In the case of limited toots, the receiver may not be explicitly part of the audience. If a specific user's inbox URI was specified, it makes sense to dereference the toot from the corresponding user, instead of trying to find someone in the explicit audience.
thenameisnigel-old
pushed a commit
to ChatterlyOSE/Chatterly
that referenced
this pull request
Sep 6, 2020
…odon#14656) Follow-up to mastodon#14359 In the case of limited toots, the receiver may not be explicitly part of the audience. If a specific user's inbox URI was specified, it makes sense to dereference the toot from the corresponding user, instead of trying to find someone in the explicit audience.
thenameisnigel-old
pushed a commit
to ChatterlyOSE/Chatterly
that referenced
this pull request
Sep 7, 2020
…odon#14656) Follow-up to mastodon#14359 In the case of limited toots, the receiver may not be explicitly part of the audience. If a specific user's inbox URI was specified, it makes sense to dereference the toot from the corresponding user, instead of trying to find someone in the explicit audience.
Gargron
pushed a commit
that referenced
this pull request
Oct 19, 2020
Follow-up to #14359 In the case of limited toots, the receiver may not be explicitly part of the audience. If a specific user's inbox URI was specified, it makes sense to dereference the toot from the corresponding user, instead of trying to find someone in the explicit audience.
shouo1987
pushed a commit
to CrossGate-Pawoo/mastodon
that referenced
this pull request
Dec 7, 2022
* Dereference object URIs in Create and Update messages Fixes mastodon#14353 Signed-off-by: Thibaut Girka <thib@sitedethib.com> * Refactor, and perform origin check *before* attempting to fetch object Co-authored-by: Fire Demon <firedemon@creature.cafe>
shouo1987
pushed a commit
to CrossGate-Pawoo/mastodon
that referenced
this pull request
Dec 7, 2022
…odon#14656) Follow-up to mastodon#14359 In the case of limited toots, the receiver may not be explicitly part of the audience. If a specific user's inbox URI was specified, it makes sense to dereference the toot from the corresponding user, instead of trying to find someone in the explicit audience.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #14353
This is directly a commit cherry-picked from Monsterpit, as I figured it should be enough.
To my understanding, their scheme does not provide any benefit right now, but it provides an opportunity for the sending server to check the receiving actor's key has not changed and is still controlled by that person, among other things: https://the.monsterpit.net/@firedemon/104541374145521914
I am not sure this is a trade-off that makes sense to Mastodon itself, as that's an added round-trip for each
Create/Updateactivity, but supportingCreateandUpdateactivities which object is not inlined is probably fine, and falls within the AP spec.The code does duplicate a few bits from the ActivityPub resource fetching code, so maybe it could be refactored a bit, but otherwise it seems fine to me.