From: William Pitcock <nenolod@dereferenced.org>
Date: Sat, 17 Nov 2018 18:17:17 +0000 (+0000)
Subject: activitypub: fetch_object_from_id(): prefer `actor` over `attributedTo` to avoid... 
X-Git-Url: http://git.squeep.com/?a=commitdiff_plain;h=603fccf175bd6f0d80cc52d0766b0208d2309790;p=akkoma

activitypub: fetch_object_from_id(): prefer `actor` over `attributedTo` to avoid spoofing
---

diff --git a/lib/pleroma/web/activity_pub/activity_pub.ex b/lib/pleroma/web/activity_pub/activity_pub.ex
index c6733e487..51b787272 100644
--- a/lib/pleroma/web/activity_pub/activity_pub.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub.ex
@@ -747,7 +747,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
              "type" => "Create",
              "to" => data["to"],
              "cc" => data["cc"],
-             "actor" => data["attributedTo"],
+             "actor" => data["actor"] || data["attributedTo"],
              "object" => data
            },
            :ok <- Transmogrifier.contain_origin(id, params),