瀏覽代碼

MastodonAPI.StatusView: Do not use site_name

site_name allow to spoof the origin of the domain and so hacks like:

<!-- served on https://hacktivis.me/tmp/joinmastodon.org.html -->
<meta property="og:image" content="https://hacktivis.me/datalove/img/meme/pleroma/mastodon%2C%20forbidden%20amuse%20yourself.jpeg" />
<meta property="og:title" content="Mastodon: Forbidden Amuse Yourself" />
<meta property="og:site_name" content="joinmastodon.org" />
<meta http-equiv="refresh" content="0; url=http://joinmastodon.org/">
fix/1518-admin-reports-timeout
Haelwenn (lanodan) Monnier 4 年之前
父節點
當前提交
1257331291
沒有發現已知的金鑰在資料庫的簽署中 GPG 金鑰 ID: D5B7A8E43C997DEE
共有 2 個檔案被更改,包括 3 行新增5 行删除
  1. +1
    -3
      lib/pleroma/web/mastodon_api/views/status_view.ex
  2. +2
    -2
      test/web/mastodon_api/views/status_view_test.exs

+ 1
- 3
lib/pleroma/web/mastodon_api/views/status_view.ex 查看文件

@@ -321,11 +321,9 @@ defmodule Pleroma.Web.MastodonAPI.StatusView do
nil
end

site_name = rich_media[:site_name] || page_url_data.host

%{
type: "link",
provider_name: site_name,
provider_name: page_url_data.host,
provider_url: page_url_data.scheme <> "://" <> page_url_data.host,
url: page_url,
image: image_url |> MediaProxy.url(),


+ 2
- 2
test/web/mastodon_api/views/status_view_test.exs 查看文件

@@ -491,7 +491,7 @@ defmodule Pleroma.Web.MastodonAPI.StatusViewTest do
title: "Example website"
}

%{provider_name: "Example site name"} =
%{provider_name: "example.com"} =
StatusView.render("card.json", %{page_url: page_url, rich_media: card})
end

@@ -506,7 +506,7 @@ defmodule Pleroma.Web.MastodonAPI.StatusViewTest do
description: "Example description"
}

%{provider_name: "Example site name"} =
%{provider_name: "example.com"} =
StatusView.render("card.json", %{page_url: page_url, rich_media: card})
end
end


Loading…
取消
儲存