Fix url guessing attacks.
[akkoma] / lib / pleroma / web / activity_pub / activity_pub_controller.ex
1 defmodule Pleroma.Web.ActivityPub.ActivityPubController do
2 use Pleroma.Web, :controller
3 alias Pleroma.{User, Object}
4 alias Pleroma.Web.ActivityPub.{ObjectView, UserView}
5 alias Pleroma.Web.ActivityPub.ActivityPub
6 alias Pleroma.Web.Federator
7
8 require Logger
9
10 action_fallback(:errors)
11
12 def user(conn, %{"nickname" => nickname}) do
13 with %User{} = user <- User.get_cached_by_nickname(nickname),
14 {:ok, user} <- Pleroma.Web.WebFinger.ensure_keys_present(user) do
15 conn
16 |> put_resp_header("content-type", "application/activity+json")
17 |> json(UserView.render("user.json", %{user: user}))
18 end
19 end
20
21 def object(conn, %{"uuid" => uuid}) do
22 with ap_id <- o_status_url(conn, :object, uuid),
23 %Object{} = object <- Object.get_cached_by_ap_id(ap_id),
24 {_, true} <- {:public?, ActivityPub.is_public?(object)} do
25 conn
26 |> put_resp_header("content-type", "application/activity+json")
27 |> json(ObjectView.render("object.json", %{object: object}))
28 else
29 {:public?, false} ->
30 conn
31 |> put_status(404)
32 |> json("Not found")
33 end
34 end
35
36 def following(conn, %{"nickname" => nickname, "page" => page}) do
37 with %User{} = user <- User.get_cached_by_nickname(nickname),
38 {:ok, user} <- Pleroma.Web.WebFinger.ensure_keys_present(user) do
39 {page, _} = Integer.parse(page)
40
41 conn
42 |> put_resp_header("content-type", "application/activity+json")
43 |> json(UserView.render("following.json", %{user: user, page: page}))
44 end
45 end
46
47 def following(conn, %{"nickname" => nickname}) do
48 with %User{} = user <- User.get_cached_by_nickname(nickname),
49 {:ok, user} <- Pleroma.Web.WebFinger.ensure_keys_present(user) do
50 conn
51 |> put_resp_header("content-type", "application/activity+json")
52 |> json(UserView.render("following.json", %{user: user}))
53 end
54 end
55
56 def followers(conn, %{"nickname" => nickname, "page" => page}) do
57 with %User{} = user <- User.get_cached_by_nickname(nickname),
58 {:ok, user} <- Pleroma.Web.WebFinger.ensure_keys_present(user) do
59 {page, _} = Integer.parse(page)
60
61 conn
62 |> put_resp_header("content-type", "application/activity+json")
63 |> json(UserView.render("followers.json", %{user: user, page: page}))
64 end
65 end
66
67 def followers(conn, %{"nickname" => nickname}) do
68 with %User{} = user <- User.get_cached_by_nickname(nickname),
69 {:ok, user} <- Pleroma.Web.WebFinger.ensure_keys_present(user) do
70 conn
71 |> put_resp_header("content-type", "application/activity+json")
72 |> json(UserView.render("followers.json", %{user: user}))
73 end
74 end
75
76 def outbox(conn, %{"nickname" => nickname, "max_id" => max_id}) do
77 with %User{} = user <- User.get_cached_by_nickname(nickname),
78 {:ok, user} <- Pleroma.Web.WebFinger.ensure_keys_present(user) do
79 conn
80 |> put_resp_header("content-type", "application/activity+json")
81 |> json(UserView.render("outbox.json", %{user: user, max_id: max_id}))
82 end
83 end
84
85 def outbox(conn, %{"nickname" => nickname}) do
86 outbox(conn, %{"nickname" => nickname, "max_id" => nil})
87 end
88
89 # TODO: Ensure that this inbox is a recipient of the message
90 def inbox(%{assigns: %{valid_signature: true}} = conn, params) do
91 Federator.enqueue(:incoming_ap_doc, params)
92 json(conn, "ok")
93 end
94
95 def inbox(conn, params) do
96 headers = Enum.into(conn.req_headers, %{})
97
98 if !String.contains?(headers["signature"] || "", params["actor"]) do
99 Logger.info("Signature not from author, relayed message, fetching from source")
100 ActivityPub.fetch_object_from_id(params["object"]["id"])
101 else
102 Logger.info("Signature error - make sure you are forwarding the HTTP Host header!")
103 Logger.info("Could not validate #{params["actor"]}")
104 Logger.info(inspect(conn.req_headers))
105 end
106
107 json(conn, "ok")
108 end
109
110 def errors(conn, _e) do
111 conn
112 |> put_status(500)
113 |> json("error")
114 end
115 end