4 files changed, 13 insertions, 5 deletions

diff --git a/server/helpers/activitypub.ts b/server/helpers/activitypub.ts
index 8b56d2d50..fe721cbac 100644
--- a/server/helpers/activitypub.ts
+++ b/server/helpers/activitypub.ts
@@ -187,10 +187,10 @@ function buildSignedActivity <T> (byActor: MActor, data: T, contextType?: Contex
   return signJsonLDObject(byActor, activity)
 }
 
-function getAPId (activity: string | { id: string }) {
-  if (typeof activity === 'string') return activity
+function getAPId (object: string | { id: string }) {
+  if (typeof object === 'string') return object
 
-  return activity.id
+  return object.id
 }
 
 function checkUrlsSameHost (url1: string, url2: string) {
diff --git a/server/helpers/custom-validators/activitypub/actor.ts b/server/helpers/custom-validators/activitypub/actor.ts
index 675a7b663..a4b152722 100644
--- a/server/helpers/custom-validators/activitypub/actor.ts
+++ b/server/helpers/custom-validators/activitypub/actor.ts
@@ -60,11 +60,12 @@ function isActorDeleteActivityValid (activity: any) {
 }
 
 function sanitizeAndCheckActorObject (actor: any) {
+  if (!isActorTypeValid(actor.type)) return false
+
   normalizeActor(actor)
 
   return exists(actor) &&
     isActivityPubUrlValid(actor.id) &&
-    isActorTypeValid(actor.type) &&
     isActivityPubUrlValid(actor.inbox) &&
     isActorPreferredUsernameValid(actor.preferredUsername) &&
     isActivityPubUrlValid(actor.url) &&
diff --git a/server/lib/activitypub/process/process-announce.ts b/server/lib/activitypub/process/process-announce.ts
index ec23c705e..2619d9754 100644
--- a/server/lib/activitypub/process/process-announce.ts
+++ b/server/lib/activitypub/process/process-announce.ts
@@ -8,12 +8,16 @@ import { Notifier } from '../../notifier'
 import { logger } from '../../../helpers/logger'
 import { APProcessorOptions } from '../../../types/activitypub-processor.model'
 import { MActorSignature, MVideoAccountLightBlacklistAllFiles } from '../../../types/models'
+import { getAPId } from '@server/helpers/activitypub'
 
 async function processAnnounceActivity (options: APProcessorOptions<ActivityAnnounce>) {
   const { activity, byActor: actorAnnouncer } = options
   // Only notify if it is not from a fetcher job
   const notify = options.fromFetch !== true
 
+  // Announces on accounts are not supported
+  if (actorAnnouncer.type !== 'Application' && actorAnnouncer.type !== 'Group') return
+
   return retryTransactionWrapper(processVideoShare, actorAnnouncer, activity, notify)
 }
 
@@ -26,7 +30,7 @@ export {
 // ---------------------------------------------------------------------------
 
 async function processVideoShare (actorAnnouncer: MActorSignature, activity: ActivityAnnounce, notify: boolean) {
-  const objectUri = typeof activity.object === 'string' ? activity.object : activity.object.id
+  const objectUri = getAPId(activity.object)
 
   let video: MVideoAccountLightBlacklistAllFiles
   let videoCreated: boolean
diff --git a/server/lib/activitypub/process/process-create.ts b/server/lib/activitypub/process/process-create.ts
index 70e048d6e..93f1d1c59 100644
--- a/server/lib/activitypub/process/process-create.ts
+++ b/server/lib/activitypub/process/process-create.ts
@@ -28,6 +28,9 @@ async function processCreateActivity (options: APProcessorOptions<ActivityCreate
   }
 
   if (activityType === 'Note') {
+    // Comments will be fetched from videos
+    if (options.fromFetch) return
+
     return retryTransactionWrapper(processCreateVideoComment, activity, byActor, notify)
   }