From 92315d979c3f424d81f8fca3c8831d81e4e2a6d6 Mon Sep 17 00:00:00 2001
From: Chocobozzz <me@florianbigard.com>
Date: Fri, 26 Feb 2021 11:50:18 +0100
Subject: More robust channel change federation

---
 server/lib/activitypub/process/process-update.ts | 10 +++++++++-
 server/lib/activitypub/videos.ts                 | 13 +++++++++----
 2 files changed, 18 insertions(+), 5 deletions(-)

(limited to 'server')

diff --git a/server/lib/activitypub/process/process-update.ts b/server/lib/activitypub/process/process-update.ts
index 6d2fff3fe..849f70b94 100644
--- a/server/lib/activitypub/process/process-update.ts
+++ b/server/lib/activitypub/process/process-update.ts
@@ -62,7 +62,15 @@ async function processUpdateVideo (actor: MActorSignature, activity: ActivityUpd
     return undefined
   }
 
-  const { video } = await getOrCreateVideoAndAccountAndChannel({ videoObject: videoObject.id, allowRefresh: false, fetchType: 'all' })
+  const { video, created } = await getOrCreateVideoAndAccountAndChannel({
+    videoObject: videoObject.id,
+    allowRefresh: false,
+    fetchType: 'all'
+  })
+  // We did not have this video, it has been created so no need to update
+  if (created) return
+
+  // Load new channel
   const channelActor = await getOrCreateVideoChannelFromVideoObject(videoObject)
 
   const account = actor.Account as MAccountIdActor
diff --git a/server/lib/activitypub/videos.ts b/server/lib/activitypub/videos.ts
index c38edad56..c29bcc528 100644
--- a/server/lib/activitypub/videos.ts
+++ b/server/lib/activitypub/videos.ts
@@ -336,10 +336,15 @@ async function updateVideoFromAP (options: {
 
       videoFieldsSave = video.toJSON()
 
-      // Check actor has the right to update the video
-      const videoChannel = video.VideoChannel
-      if (videoChannel.Account.id !== account.id) {
-        throw new Error('Account ' + account.Actor.url + ' does not own video channel ' + videoChannel.Actor.url)
+      // Check we can update the channel: we trust the remote server
+      const oldVideoChannel = video.VideoChannel
+
+      if (!oldVideoChannel.Actor.serverId || !channel.Actor.serverId) {
+        throw new Error('Cannot check old channel/new channel validity because `serverId` is null')
+      }
+
+      if (oldVideoChannel.Actor.serverId !== channel.Actor.serverId) {
+        throw new Error('New channel ' + channel.Actor.url + ' is not on the same server than new channel ' + oldVideoChannel.Actor.url)
       }
 
       const to = overrideTo || videoObject.to
-- 
cgit v1.2.3