![]() Previously there were mainly two attack vectors:
- for raw keys the owner <-> key mapping wasn't verified at all
- keys were retrieved with refetching allowed
and only the top-level ID was sanitised while
usually keys are but a subobject
This reintroduces public key checks in the user actor,
previously removed in
|
||
---|---|---|
.. | ||
config | ||
credo/check/consistency | ||
fixtures | ||
instance_static | ||
mix | ||
pleroma | ||
support | ||
test_helper.exs |