From 92315d979c3f424d81f8fca3c8831d81e4e2a6d6 Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Fri, 26 Feb 2021 11:50:18 +0100 Subject: More robust channel change federation --- server/lib/activitypub/videos.ts | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) (limited to 'server/lib/activitypub/videos.ts') diff --git a/server/lib/activitypub/videos.ts b/server/lib/activitypub/videos.ts index c38edad56..c29bcc528 100644 --- a/server/lib/activitypub/videos.ts +++ b/server/lib/activitypub/videos.ts @@ -336,10 +336,15 @@ async function updateVideoFromAP (options: { videoFieldsSave = video.toJSON() - // Check actor has the right to update the video - const videoChannel = video.VideoChannel - if (videoChannel.Account.id !== account.id) { - throw new Error('Account ' + account.Actor.url + ' does not own video channel ' + videoChannel.Actor.url) + // Check we can update the channel: we trust the remote server + const oldVideoChannel = video.VideoChannel + + if (!oldVideoChannel.Actor.serverId || !channel.Actor.serverId) { + throw new Error('Cannot check old channel/new channel validity because `serverId` is null') + } + + if (oldVideoChannel.Actor.serverId !== channel.Actor.serverId) { + throw new Error('New channel ' + channel.Actor.url + ' is not on the same server than new channel ' + oldVideoChannel.Actor.url) } const to = overrideTo || videoObject.to -- cgit v1.2.3