Don't accept private answers to public parents

diff --git a/src/Protocol/ActivityPub/Processor.php b/src/Protocol/ActivityPub/Processor.php
index 057457ef3aa193e8d4b7d545f853a24d653b4767..d3c616a7e0d9bbd6f1abb3cc1334b6551cad1d40 100644 (file)
--- a/src/Protocol/ActivityPub/Processor.php
+++ b/src/Protocol/ActivityPub/Processor.php
@@ -264,6 +264,19 @@ class Processor
                }
 
                $item['uri'] = $activity['id'];
+
+               if (($item['parent-uri'] != $item['uri']) && ($item['gravity'] == GRAVITY_COMMENT)) {
+                       $item_private = !in_array(0, $activity['item_receiver']);
+                       $parent = Item::selectFirst(['private'], ['uri' => $item['parent-uri']]);
+                       if (!DBA::isResult($parent)) {
+                               return;
+                       }
+                       if ($item_private && !$parent['private']) {
+                               Logger::log('Item ' . $item['uri'] . ' is private but the parent ' . $item['parent-uri'] . ' is not. So we drop it.');
+                               return;
+                       }
+               }
+
                $item['created'] = $activity['published'];
                $item['edited'] = $activity['updated'];
                $item['guid'] = $activity['diaspora:guid'];

diff --git a/src/Protocol/ActivityPub/Receiver.php b/src/Protocol/ActivityPub/Receiver.php
index 7fe1f128f496b746efbed1bd24ccf854964913d6..5459bca346b8ded56f753c1454fcd7c11512d55e 100644 (file)
--- a/src/Protocol/ActivityPub/Receiver.php
+++ b/src/Protocol/ActivityPub/Receiver.php
@@ -233,6 +233,7 @@ class Receiver
 
                $object_data['type'] = $type;
                $object_data['actor'] = $actor;
+               $object_data['item_receiver'] = $receivers;
                $object_data['receiver'] = array_merge(defaults($object_data, 'receiver', []), $receivers);
 
                Logger::log('Processing ' . $object_data['type'] . ' ' . $object_data['object_type'] . ' ' . $object_data['id'], Logger::DEBUG);