70fe99d196
Previously there were mainly two attack vectors:
- for raw keys the owner <-> key mapping wasn't verified at all
- keys were retrieved with refetching allowed
and only the top-level ID was sanitised while
usually keys are but a subobject
This reintroduces public key checks in the user actor,
previously removed in
|
||
|---|---|---|
| .. | ||
| activity_pub | ||
| admin_api | ||
| akkoma_api | ||
| api_spec | ||
| auth | ||
| common_api | ||
| fallback | ||
| federator | ||
| feed | ||
| mailer | ||
| mastodon_api | ||
| media_proxy | ||
| metadata | ||
| mongoose_im | ||
| nodeinfo | ||
| o_auth | ||
| o_status | ||
| pleroma_api | ||
| plugs | ||
| preload/providers | ||
| push | ||
| rich_media | ||
| static_fe | ||
| templates | ||
| twitter_api | ||
| utils | ||
| views | ||
| web_finger | ||
| api_spec.ex | ||
| common_api.ex | ||
| controller_helper.ex | ||
| embed_controller.ex | ||
| endpoint.ex | ||
| federator.ex | ||
| gettext.ex | ||
| instance_document.ex | ||
| manifest_controller.ex | ||
| masto_fe_controller.ex | ||
| media_proxy.ex | ||
| metadata.ex | ||
| o_auth.ex | ||
| pipelines.ex | ||
| plug.ex | ||
| preload.ex | ||
| push.ex | ||
| rel_me.ex | ||
| router.ex | ||
| streamer.ex | ||
| swagger.ex | ||
| telemetry.ex | ||
| translation_helpers.ex | ||
| uploader_controller.ex | ||
| web_finger.ex | ||
| xml.ex | ||