activitypub: fetch_object_from_id(): prefer `actor` over `attributedTo` to avoid spoofing

2018-11-17 18:17:17 +00:00 · 2018-11-17 18:17:17 +00:00 · 603fccf175
parent 9c8adfb6ef
commit 603fccf175
1 changed files with 1 additions and 1 deletions
--- a/lib/pleroma/web/activity_pub/activity_pub.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub.ex
@ -747,7 +747,7 @@ def fetch_object_from_id(id) do
             "type" => "Create",
             "to" => data["to"],
             "cc" => data["cc"],
-             "actor" => data["attributedTo"],
+             "actor" => data["actor"] || data["attributedTo"],
             "object" => data
           },
           :ok <- Transmogrifier.contain_origin(id, params),