From 47c3b54d1d0b276fb87d1b4b71a584e0e0c7b43d Mon Sep 17 00:00:00 2001 From: Vika Shleina Date: Mon, 19 Jul 2021 10:32:42 +0300 Subject: Relaxed anti-takeover URL check to simply not place redirects at foreign URLs --- src/micropub/post.rs | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) (limited to 'src/micropub') diff --git a/src/micropub/post.rs b/src/micropub/post.rs index 639346b..eaa603a 100644 --- a/src/micropub/post.rs +++ b/src/micropub/post.rs @@ -171,12 +171,7 @@ pub async fn new_post( // This software might also be used in a multi-user setting // where several users or identities share one Micropub server // (maybe a family website or a shitpost sideblog?) - if post["properties"]["url"] - .as_array() - .unwrap() - .iter() - .any(|url| !url.as_str().unwrap().starts_with(user.me.as_str())) - || !post["properties"]["uid"][0] + if !post["properties"]["uid"][0] .as_str() .unwrap() .starts_with(user.me.as_str()) @@ -209,7 +204,7 @@ pub async fn new_post( Err(err) => return Ok(err.into()), } - if let Err(err) = storage.put_post(&post).await { + if let Err(err) = storage.put_post(&post, user.me.as_str()).await { return error_json!(500, "database_error", format!("{}", err)); } @@ -303,7 +298,7 @@ async fn create_feed( }), &user, ); - storage.put_post(&feed).await + storage.put_post(&feed, user.me.as_str()).await } async fn post_process_new_post( -- cgit 1.4.1