Add federation to ownership change

[github/Chocobozzz/PeerTube.git] / server / lib / activitypub / process / process-undo.ts

diff --git a/server/lib/activitypub/process/process-undo.ts b/server/lib/activitypub/process/process-undo.ts
index eab9e3d61500241ff499f20e4eb6669e6216ad8b..1c1de8827c9da037708111eb8af73981ab68c11c 100644 (file)
--- a/server/lib/activitypub/process/process-undo.ts
+++ b/server/lib/activitypub/process/process-undo.ts
@@ -104,17 +104,19 @@ function processUndoFollow (actorUrl: string, followActivity: ActivityFollow) {
 
 function processUndoAnnounce (actorUrl: string, announceActivity: ActivityAnnounce) {
   return sequelizeTypescript.transaction(async t => {
-    const byAccount = await AccountModel.loadByUrl(actorUrl, t)
-    if (!byAccount) throw new Error('Unknown account ' + actorUrl)
+    const byActor = await ActorModel.loadByUrl(actorUrl, t)
+    if (!byActor) throw new Error('Unknown actor ' + actorUrl)
 
     const share = await VideoShareModel.loadByUrl(announceActivity.id, t)
-    if (!share) throw new Error(`'Unknown video share ${announceActivity.id}.`)
+    if (!share) throw new Error(`Unknown video share ${announceActivity.id}.`)
+
+    if (share.actorId !== byActor.id) throw new Error(`${share.url} is not shared by ${byActor.url}.`)
 
     await share.destroy({ transaction: t })
 
     if (share.Video.isOwned()) {
       // Don't resend the activity to the sender
-      const exceptions = [ byAccount.Actor ]
+      const exceptions = [ byActor ]
 
       await forwardVideoRelatedActivity(announceActivity, t, exceptions, share.Video)
     }