techhub/mastodon
2
0
Fork 0
Code Activity

Merge commit from fork

Browse Source 
* Refuse granting quote authorization for reblogs

* Add validation to reject quotes of reblogs

* Do not process quotes of reblogs as potentially valid quotes

* Refuse to serve quoted reblogs over REST API
This commit is contained in:
Claire
2025-10-21 15:00:28 +02:00
committed by GitHub
parent 2b9e4294fe
commit 405a49df44
8 changed files with 146 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
app/models/quote.rb
View File

@@ -39,6 +39,7 @@ class Quote < ApplicationRecord
validates :activity_uri, presence: true, if: -> { account.local? && quoted_account&.remote? }
validates :approval_uri, absence: true, if: -> { quoted_account&.local? }
validate :validate_visibility
validate :validate_original_quoted_status
after_create_commit :increment_counter_caches!
after_destroy_commit :decrement_counter_caches!
@@ -85,6 +86,10 @@ class Quote < ApplicationRecord
errors.add(:quoted_status_id, :visibility_mismatch)
end
def validate_original_quoted_status
errors.add(:quoted_status_id, :reblog_unallowed) if quoted_status&.reblog?
end
def set_activity_uri
self.activity_uri = [ActivityPub::TagManager.instance.uri_for(account), '/quote_requests/', SecureRandom.uuid].join
end