aboutsummaryrefslogtreecommitdiffhomepage
diff options
context:
space:
mode:
authorChocobozzz <me@florianbigard.com>2018-09-19 15:47:55 +0200
committerChocobozzz <me@florianbigard.com>2018-09-19 15:47:55 +0200
commit12ba460e9ebf4951f9c1caee8822a8ca1523563f (patch)
tree5dd2815c92ef54ed315dbd30c027ce7e92dad008
parente587e0ecee5bec43a225995948faaa4bc97f080a (diff)
downloadPeerTube-12ba460e9ebf4951f9c1caee8822a8ca1523563f.tar.gz
PeerTube-12ba460e9ebf4951f9c1caee8822a8ca1523563f.tar.zst
PeerTube-12ba460e9ebf4951f9c1caee8822a8ca1523563f.zip
Improve AP actor checks
-rw-r--r--server/lib/activitypub/cache-file.ts4
-rw-r--r--server/lib/activitypub/process/process-delete.ts4
-rw-r--r--server/lib/activitypub/process/process-reject.ts6
-rw-r--r--server/lib/activitypub/process/process-undo.ts32
-rw-r--r--server/lib/activitypub/process/process.ts5
5 files changed, 30 insertions, 21 deletions
diff --git a/server/lib/activitypub/cache-file.ts b/server/lib/activitypub/cache-file.ts
index 20558daf9..87f8a4162 100644
--- a/server/lib/activitypub/cache-file.ts
+++ b/server/lib/activitypub/cache-file.ts
@@ -31,6 +31,10 @@ function createCacheFile (cacheFileObject: CacheFileObject, video: VideoModel, b
31} 31}
32 32
33function updateCacheFile (cacheFileObject: CacheFileObject, redundancyModel: VideoRedundancyModel, byActor: { id?: number }) { 33function updateCacheFile (cacheFileObject: CacheFileObject, redundancyModel: VideoRedundancyModel, byActor: { id?: number }) {
34 if (redundancyModel.actorId !== byActor.id) {
35 throw new Error('Cannot update redundancy ' + redundancyModel.url + ' of another actor.')
36 }
37
34 const attributes = cacheFileActivityObjectToDBAttributes(cacheFileObject, redundancyModel.VideoFile.Video, byActor) 38 const attributes = cacheFileActivityObjectToDBAttributes(cacheFileObject, redundancyModel.VideoFile.Video, byActor)
35 39
36 redundancyModel.set('expires', attributes.expiresOn) 40 redundancyModel.set('expires', attributes.expiresOn)
diff --git a/server/lib/activitypub/process/process-delete.ts b/server/lib/activitypub/process/process-delete.ts
index bf2a4d114..038d8c4d3 100644
--- a/server/lib/activitypub/process/process-delete.ts
+++ b/server/lib/activitypub/process/process-delete.ts
@@ -94,6 +94,10 @@ function processDeleteVideoComment (byActor: ActorModel, videoComment: VideoComm
94 logger.debug('Removing remote video comment "%s".', videoComment.url) 94 logger.debug('Removing remote video comment "%s".', videoComment.url)
95 95
96 return sequelizeTypescript.transaction(async t => { 96 return sequelizeTypescript.transaction(async t => {
97 if (videoComment.Account.id !== byActor.Account.id) {
98 throw new Error('Account ' + byActor.url + ' does not own video comment ' + videoComment.url)
99 }
100
97 await videoComment.destroy({ transaction: t }) 101 await videoComment.destroy({ transaction: t })
98 102
99 if (videoComment.Video.isOwned()) { 103 if (videoComment.Video.isOwned()) {
diff --git a/server/lib/activitypub/process/process-reject.ts b/server/lib/activitypub/process/process-reject.ts
index b0e678316..709a65096 100644
--- a/server/lib/activitypub/process/process-reject.ts
+++ b/server/lib/activitypub/process/process-reject.ts
@@ -17,11 +17,11 @@ export {
17 17
18// --------------------------------------------------------------------------- 18// ---------------------------------------------------------------------------
19 19
20async function processReject (actor: ActorModel, targetActor: ActorModel) { 20async function processReject (follower: ActorModel, targetActor: ActorModel) {
21 return sequelizeTypescript.transaction(async t => { 21 return sequelizeTypescript.transaction(async t => {
22 const actorFollow = await ActorFollowModel.loadByActorAndTarget(actor.id, targetActor.id, t) 22 const actorFollow = await ActorFollowModel.loadByActorAndTarget(follower.id, targetActor.id, t)
23 23
24 if (!actorFollow) throw new Error(`'Unknown actor follow ${actor.id} -> ${targetActor.id}.`) 24 if (!actorFollow) throw new Error(`'Unknown actor follow ${follower.id} -> ${targetActor.id}.`)
25 25
26 await actorFollow.destroy({ transaction: t }) 26 await actorFollow.destroy({ transaction: t })
27 27
diff --git a/server/lib/activitypub/process/process-undo.ts b/server/lib/activitypub/process/process-undo.ts
index c091d9678..73ca0a17c 100644
--- a/server/lib/activitypub/process/process-undo.ts
+++ b/server/lib/activitypub/process/process-undo.ts
@@ -1,10 +1,8 @@
1import { ActivityAnnounce, ActivityFollow, ActivityLike, ActivityUndo, CacheFileObject } from '../../../../shared/models/activitypub' 1import { ActivityAnnounce, ActivityFollow, ActivityLike, ActivityUndo, CacheFileObject } from '../../../../shared/models/activitypub'
2import { DislikeObject } from '../../../../shared/models/activitypub/objects' 2import { DislikeObject } from '../../../../shared/models/activitypub/objects'
3import { getActorUrl } from '../../../helpers/activitypub'
4import { retryTransactionWrapper } from '../../../helpers/database-utils' 3import { retryTransactionWrapper } from '../../../helpers/database-utils'
5import { logger } from '../../../helpers/logger' 4import { logger } from '../../../helpers/logger'
6import { sequelizeTypescript } from '../../../initializers' 5import { sequelizeTypescript } from '../../../initializers'
7import { AccountModel } from '../../../models/account/account'
8import { AccountVideoRateModel } from '../../../models/account/account-video-rate' 6import { AccountVideoRateModel } from '../../../models/account/account-video-rate'
9import { ActorModel } from '../../../models/activitypub/actor' 7import { ActorModel } from '../../../models/activitypub/actor'
10import { ActorFollowModel } from '../../../models/activitypub/actor-follow' 8import { ActorFollowModel } from '../../../models/activitypub/actor-follow'
@@ -16,15 +14,13 @@ import { VideoRedundancyModel } from '../../../models/redundancy/video-redundanc
16async function processUndoActivity (activity: ActivityUndo, byActor: ActorModel) { 14async function processUndoActivity (activity: ActivityUndo, byActor: ActorModel) {
17 const activityToUndo = activity.object 15 const activityToUndo = activity.object
18 16
19 const actorUrl = getActorUrl(activity.actor)
20
21 if (activityToUndo.type === 'Like') { 17 if (activityToUndo.type === 'Like') {
22 return retryTransactionWrapper(processUndoLike, actorUrl, activity) 18 return retryTransactionWrapper(processUndoLike, byActor, activity)
23 } 19 }
24 20
25 if (activityToUndo.type === 'Create') { 21 if (activityToUndo.type === 'Create') {
26 if (activityToUndo.object.type === 'Dislike') { 22 if (activityToUndo.object.type === 'Dislike') {
27 return retryTransactionWrapper(processUndoDislike, actorUrl, activity) 23 return retryTransactionWrapper(processUndoDislike, byActor, activity)
28 } else if (activityToUndo.object.type === 'CacheFile') { 24 } else if (activityToUndo.object.type === 'CacheFile') {
29 return retryTransactionWrapper(processUndoCacheFile, byActor, activity) 25 return retryTransactionWrapper(processUndoCacheFile, byActor, activity)
30 } 26 }
@@ -51,48 +47,46 @@ export {
51 47
52// --------------------------------------------------------------------------- 48// ---------------------------------------------------------------------------
53 49
54async function processUndoLike (actorUrl: string, activity: ActivityUndo) { 50async function processUndoLike (byActor: ActorModel, activity: ActivityUndo) {
55 const likeActivity = activity.object as ActivityLike 51 const likeActivity = activity.object as ActivityLike
56 52
57 const { video } = await getOrCreateVideoAndAccountAndChannel({ videoObject: likeActivity.object }) 53 const { video } = await getOrCreateVideoAndAccountAndChannel({ videoObject: likeActivity.object })
58 54
59 return sequelizeTypescript.transaction(async t => { 55 return sequelizeTypescript.transaction(async t => {
60 const byAccount = await AccountModel.loadByUrl(actorUrl, t) 56 if (!byActor.Account) throw new Error('Unknown account ' + byActor.url)
61 if (!byAccount) throw new Error('Unknown account ' + actorUrl)
62 57
63 const rate = await AccountVideoRateModel.load(byAccount.id, video.id, t) 58 const rate = await AccountVideoRateModel.load(byActor.Account.id, video.id, t)
64 if (!rate) throw new Error(`Unknown rate by account ${byAccount.id} for video ${video.id}.`) 59 if (!rate) throw new Error(`Unknown rate by account ${byActor.Account.id} for video ${video.id}.`)
65 60
66 await rate.destroy({ transaction: t }) 61 await rate.destroy({ transaction: t })
67 await video.decrement('likes', { transaction: t }) 62 await video.decrement('likes', { transaction: t })
68 63
69 if (video.isOwned()) { 64 if (video.isOwned()) {
70 // Don't resend the activity to the sender 65 // Don't resend the activity to the sender
71 const exceptions = [ byAccount.Actor ] 66 const exceptions = [ byActor ]
72 67
73 await forwardVideoRelatedActivity(activity, t, exceptions, video) 68 await forwardVideoRelatedActivity(activity, t, exceptions, video)
74 } 69 }
75 }) 70 })
76} 71}
77 72
78async function processUndoDislike (actorUrl: string, activity: ActivityUndo) { 73async function processUndoDislike (byActor: ActorModel, activity: ActivityUndo) {
79 const dislike = activity.object.object as DislikeObject 74 const dislike = activity.object.object as DislikeObject
80 75
81 const { video } = await getOrCreateVideoAndAccountAndChannel({ videoObject: dislike.object }) 76 const { video } = await getOrCreateVideoAndAccountAndChannel({ videoObject: dislike.object })
82 77
83 return sequelizeTypescript.transaction(async t => { 78 return sequelizeTypescript.transaction(async t => {
84 const byAccount = await AccountModel.loadByUrl(actorUrl, t) 79 if (!byActor.Account) throw new Error('Unknown account ' + byActor.url)
85 if (!byAccount) throw new Error('Unknown account ' + actorUrl)
86 80
87 const rate = await AccountVideoRateModel.load(byAccount.id, video.id, t) 81 const rate = await AccountVideoRateModel.load(byActor.Account.id, video.id, t)
88 if (!rate) throw new Error(`Unknown rate by account ${byAccount.id} for video ${video.id}.`) 82 if (!rate) throw new Error(`Unknown rate by account ${byActor.Account.id} for video ${video.id}.`)
89 83
90 await rate.destroy({ transaction: t }) 84 await rate.destroy({ transaction: t })
91 await video.decrement('dislikes', { transaction: t }) 85 await video.decrement('dislikes', { transaction: t })
92 86
93 if (video.isOwned()) { 87 if (video.isOwned()) {
94 // Don't resend the activity to the sender 88 // Don't resend the activity to the sender
95 const exceptions = [ byAccount.Actor ] 89 const exceptions = [ byActor ]
96 90
97 await forwardVideoRelatedActivity(activity, t, exceptions, video) 91 await forwardVideoRelatedActivity(activity, t, exceptions, video)
98 } 92 }
@@ -108,6 +102,8 @@ async function processUndoCacheFile (byActor: ActorModel, activity: ActivityUndo
108 const cacheFile = await VideoRedundancyModel.loadByUrl(cacheFileObject.id) 102 const cacheFile = await VideoRedundancyModel.loadByUrl(cacheFileObject.id)
109 if (!cacheFile) throw new Error('Unknown video cache ' + cacheFile.url) 103 if (!cacheFile) throw new Error('Unknown video cache ' + cacheFile.url)
110 104
105 if (cacheFile.actorId !== byActor.id) throw new Error('Cannot delete redundancy ' + cacheFile.url + ' of another actor.')
106
111 await cacheFile.destroy() 107 await cacheFile.destroy()
112 108
113 if (video.isOwned()) { 109 if (video.isOwned()) {
diff --git a/server/lib/activitypub/process/process.ts b/server/lib/activitypub/process/process.ts
index 35ad1696a..b263f1ea2 100644
--- a/server/lib/activitypub/process/process.ts
+++ b/server/lib/activitypub/process/process.ts
@@ -29,6 +29,11 @@ async function processActivities (activities: Activity[], signatureActor?: Actor
29 const actorsCache: { [ url: string ]: ActorModel } = {} 29 const actorsCache: { [ url: string ]: ActorModel } = {}
30 30
31 for (const activity of activities) { 31 for (const activity of activities) {
32 if (!signatureActor && [ 'Create', 'Announce', 'Like' ].indexOf(activity.type) === -1) {
33 logger.error('Cannot process activity %s (type: %s) without the actor signature.', activity.id, activity.type)
34 continue
35 }
36
32 const actorUrl = getActorUrl(activity.actor) 37 const actorUrl = getActorUrl(activity.actor)
33 38
34 // When we fetch remote data, we don't have signature 39 // When we fetch remote data, we don't have signature