brian/wanderer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

block external profiles for unregistered users

Browse Source
This commit is contained in:
Christian Beutel
2025-10-05 12:42:20 +02:00
parent 8bf4138962
commit 84d9f2483e
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
web/src/routes/api/v1/profile/[handle]/+server.ts
View File

@@ -1,4 +1,6 @@
import { env } from '$env/dynamic/private';
import type { Profile } from '$lib/models/profile'; import type { Profile } from '$lib/models/profile';
import { splitUsername } from '$lib/util/activitypub_util';
import { handleError } from '$lib/util/api_util'; import { handleError } from '$lib/util/api_util';
import { error, json, type RequestEvent } from '@sveltejs/kit'; import { error, json, type RequestEvent } from '@sveltejs/kit';
@@ -8,6 +10,10 @@ export async function GET(event: RequestEvent) {
return error(400, { message: "Bad request" }) return error(400, { message: "Bad request" })
} }
if(splitUsername(handle)[1] !== env.ORIGIN && !event.locals.user) {
return error(401, { message: "Unauthorized" })
}
try { try {
const { actor, error } = await event.locals.pb.send(`/activitypub/actor?resource=acct:${handle}&follows=true`, { method: "GET", fetch: event.fetch, }); const { actor, error } = await event.locals.pb.send(`/activitypub/actor?resource=acct:${handle}&follows=true`, { method: "GET", fetch: event.fetch, });