Currently, if that signature is ok, a post will be published and visible in the local timeline, even if the user does not follow the user.

Let's decide what to do with this, maybe with a setting, so we don't save any useless activities. This is for the individual inbox.

Issue fork activitypub-3573448

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

swentel created an issue. See original summary.

swentel’s picture

swentel commented
Assigned: Unassigned » swentel

nickolaj made their first commit to this issue’s fork.

nickolaj opened merge request !41

nickolaj’s picture

nickolaj
Primary language Ukrainian
commented
Status: Active » Needs review

Added a configurable setting "Only accept timeline activities from followed actors" in the Inbox settings. When enabled, incoming timeline activities (Create, Like, Announce) with a valid signature will also check the follow relationship, and only save/publish them if the local user actually follows the remote actor. The setting is disabled by default for backwards compatibility.

swentel’s picture

swentel commented

Very cool, thanks! I think it's probably safe to also add an upgrade path to explicitly set that new config setting in FALSE, but that's a minor.

Since we don't sign in the test, it's probably hard to write a test for this, but I'll have a look if we can start doing this.

But I'm going to finish #3572269: Introduce new entity to store one to many information (e.g. posts, follows, etc) first, that's close for a first commit and merge this one after that!

swentel’s picture

swentel commented
Title: Decide what todo with an incoming activity from an actor which is not followed by anyone » Add option to not save timeline activities if the actor is not followed by anyone

  • swentel committed 7080bd00 on 1.0.x authored by nickolaj 
    Issue #3573448: Add option to not save timeline activities if the actor...
swentel’s picture

swentel commented
Status: Needs review » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.