X-Git-Url: http://git.squeep.com/?a=blobdiff_plain;f=lib%2Fpleroma%2Fobject%2Ffetcher.ex;h=aeaf05986430d6404b9c21d7292a97ca0ec59a1e;hb=a079ec3a3cdfd42d2cbd51c7698c2c87828e5778;hp=cde4e503969e4a07f86e2a048afc4c08c3a449cd;hpb=2144ce5188901c59cd72a0b5620862b23b47544e;p=akkoma

diff --git a/lib/pleroma/object/fetcher.ex b/lib/pleroma/object/fetcher.ex
index cde4e5039..aeaf05986 100644
--- a/lib/pleroma/object/fetcher.ex
+++ b/lib/pleroma/object/fetcher.ex
@@ -116,7 +116,11 @@ defmodule Pleroma.Object.Fetcher do
 
   # Note: will create a Create activity, which we need internally at the moment.
   def fetch_object_from_id(id, options \\ []) do
-    with {_, nil} <- {:fetch_object, Object.get_cached_by_ap_id(id)},
+    with %URI{} = uri <- URI.parse(id),
+         # If we have instance restrictions, apply them here to prevent fetching from unwanted instances
+         {:ok, nil} <- Pleroma.Web.ActivityPub.MRF.SimplePolicy.check_reject(uri),
+         {:ok, _} <- Pleroma.Web.ActivityPub.MRF.SimplePolicy.check_accept(uri),
+         {_, nil} <- {:fetch_object, Object.get_cached_by_ap_id(id)},
          {_, true} <- {:allowed_depth, Federator.allowed_thread_distance?(options[:depth])},
          {_, {:ok, data}} <- {:fetch, fetch_and_contain_remote_object_from_id(id)},
          {_, nil} <- {:normalize, Object.normalize(data, fetch: false)},
@@ -155,6 +159,9 @@ defmodule Pleroma.Object.Fetcher do
       {:fetch, {:error, error}} ->
         {:error, error}
 
+      {:reject, reason} ->
+        {:reject, reason}
+
       e ->
         e
     end
@@ -255,7 +262,7 @@ defmodule Pleroma.Object.Fetcher do
   def fetch_and_contain_remote_object_from_id(_id),
     do: {:error, "id must be a string"}
 
-  defp get_object(id) do
+  def get_object(id) do
     date = Pleroma.Signature.signed_date()
 
     headers =
@@ -275,6 +282,11 @@ defmodule Pleroma.Object.Fetcher do
                %{"profile" => "https://www.w3.org/ns/activitystreams"}} ->
                 {:ok, body}
 
+              # pixelfed sometimes (and only sometimes) responds with http instead of https
+              {:ok, "application", "ld+json",
+               %{"profile" => "http://www.w3.org/ns/activitystreams"}} ->
+                {:ok, body}
+
               _ ->
                 {:error, {:content_type, content_type}}
             end