Commit 56f022f2 authored by cmrd Senya's avatar cmrd Senya Committed by Dennis Schubert

Fix a few issues with public receiver which include:

* Make Retraction be allowed to be received publicly (probably just never used before anywhere)
* Since public receiver bypasses @object.receive in some cases add the author signature verification for relayables to protect from relayables forgery
* xml_author was wrong in some cases for RelayableRetraction
parent e54f87b7
......@@ -24,7 +24,7 @@ class Postzord::Receiver::Public < Postzord::Receiver
parse_and_receive(@salmon.parsed_data) "received a #{@object.inspect}"
if @object.is_a?(SignedRetraction) # feels like a hack
if @object.is_a?(SignedRetraction) || @object.is_a?(Retraction) # feels like a hack
self.recipient_user_ids.each do |user_id|
user = User.where(id: user_id).first
@object.perform user if user
......@@ -44,6 +44,11 @@ class Postzord::Receiver::Public < Postzord::Receiver
# receive relayable object only for the owner of the parent object
@object.receive(@object.parent_author.owner, @author)
unless @object.signature_valid?
logger.warn "event=receive status=abort reason='object signature not valid' "
# notify everyone who can see the parent object
receiver =, self.recipient_user_ids)
......@@ -74,7 +79,11 @@ class Postzord::Receiver::Public < Postzord::Receiver
def xml_author
if @object.respond_to?(:relayable?)
if @object.is_a?(RelayableRetraction)
if [@object.parent_diaspora_handle,].include?(@author.diaspora_handle)
elsif @object.respond_to?(:relayable?)
#this is public, so it would only be owners sending us other people comments etc
@object.parent_author.local? ? @object.diaspora_handle : @object.parent_diaspora_handle
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment