yetangitu/funkwhale
1
0
Fork 0
mirror of https://code.eliotberriot.com/funkwhale/funkwhale.git synced 2025-10-03 23:59:15 +02:00
Code Issues Releases Wiki Activity

Use our instance policies to discard fetched and inbox objects

Browse source
This commit is contained in:
Eliot Berriot 2019-01-09 17:52:14 +01:00
parent 9151a185e0
commit 1c55f2c9a6
No known key found for this signature in database
GPG key ID: DD6965E2476E5C27
15 changed files with 317 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

26
api/funkwhale_api/federation/authentication.py
View file

@ -1,8 +1,14 @@
import cryptography
import logging
from django.contrib.auth.models import AnonymousUser
from rest_framework import authentication, exceptions
from . import actors, keys, signing, utils
from funkwhale_api.moderation import models as moderation_models
from . import actors, exceptions, keys, signing, utils
logger = logging.getLogger(__name__)
class SignatureAuthentication(authentication.BaseAuthentication):
@ -17,8 +23,24 @@ class SignatureAuthentication(authentication.BaseAuthentication):
raise exceptions.AuthenticationFailed(str(e))
try:
actor = actors.get_actor(key_id.split("#")[0])
actor_url = key_id.split("#")[0]
except (TypeError, IndexError, AttributeError):
raise exceptions.AuthenticationFailed("Invalid key id")
policies = (
moderation_models.InstancePolicy.objects.active()
.filter(block_all=True)
.matching_url(actor_url)
)
if policies.exists():
raise exceptions.BlockedActorOrDomain()
try:
actor = actors.get_actor(actor_url)
except Exception as e:
logger.info(
"Discarding HTTP request from blocked actor/domain %s", actor_url
)
raise exceptions.AuthenticationFailed(str(e))
if not actor.public_key: