keith/friendica
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Add item user owner data check in Model\Item::isValid

Browse source 
- Prevents deleted users from posting any item, manually or automatically through mirroring
This commit is contained in:
Hypolite Petovan 2020-12-15 09:41:58 -05:00
parent 8c17a6b4d9
commit 0951a50bcd
1 changed files with 13 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
src/Model/Item.php
View file

@ -1385,6 +1385,19 @@ class Item
return false;
}
if (!empty($item['uid'])) {
$owner = User::getOwnerDataById($item['uid'], false);
if (!$owner) {
Logger::notice('Missing item user owner data', ['uid' => $item['uid']]);
return false;
}
if ($owner['deleted'] || $owner['account_expired'] || $owner['account_removed']) {
Logger::notice('Item user has been deleted/expired/removed', ['uid' => $item['uid'], 'deleted' => $owner['deleted'], 'account_expired' => $owner['account_expired'], 'account_removed' => $owner['account_removed']]);
return false;
}
}
if (!empty($item['author-id']) && Contact::isBlocked($item['author-id'])) {
Logger::notice('Author is blocked node-wide', ['author-link' => $item['author-link'], 'item-uri' => $item['uri']]);
return false;