![]() Previously there were mainly two attack vectors:
- for raw keys the owner <-> key mapping wasn't verified at all
- keys were retrieved with refetching allowed
and only the top-level ID was sanitised while
usually keys are but a subobject
This reintroduces public key checks in the user actor,
previously removed in
|
||
---|---|---|
.. | ||
mix | ||
phoenix/transports/web_socket | ||
pleroma |