X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=server%2Flib%2Factivitypub%2Fprocess%2Fprocess-undo.ts;h=1c1de8827c9da037708111eb8af73981ab68c11c;hb=5cf84858d49f4231cc4efec5e3132f17f65f6cf6;hp=eab9e3d61500241ff499f20e4eb6669e6216ad8b;hpb=1297eb5db651a230474670c5da1517862fb9cc3e;p=github%2FChocobozzz%2FPeerTube.git

diff --git a/server/lib/activitypub/process/process-undo.ts b/server/lib/activitypub/process/process-undo.ts
index eab9e3d61..1c1de8827 100644
--- a/server/lib/activitypub/process/process-undo.ts
+++ b/server/lib/activitypub/process/process-undo.ts
@@ -104,17 +104,19 @@ function processUndoFollow (actorUrl: string, followActivity: ActivityFollow) {
 
 function processUndoAnnounce (actorUrl: string, announceActivity: ActivityAnnounce) {
   return sequelizeTypescript.transaction(async t => {
-    const byAccount = await AccountModel.loadByUrl(actorUrl, t)
-    if (!byAccount) throw new Error('Unknown account ' + actorUrl)
+    const byActor = await ActorModel.loadByUrl(actorUrl, t)
+    if (!byActor) throw new Error('Unknown actor ' + actorUrl)
 
     const share = await VideoShareModel.loadByUrl(announceActivity.id, t)
-    if (!share) throw new Error(`'Unknown video share ${announceActivity.id}.`)
+    if (!share) throw new Error(`Unknown video share ${announceActivity.id}.`)
+
+    if (share.actorId !== byActor.id) throw new Error(`${share.url} is not shared by ${byActor.url}.`)
 
     await share.destroy({ transaction: t })
 
     if (share.Video.isOwned()) {
       // Don't resend the activity to the sender
-      const exceptions = [ byAccount.Actor ]
+      const exceptions = [ byActor ]
 
       await forwardVideoRelatedActivity(announceActivity, t, exceptions, share.Video)
     }