diff --git a/CHANGELOG.md b/CHANGELOG.md index e6216ecf43..c0e6362257 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,7 @@ +## 2025.2.0-yumechinokuni.1 + +- Security: Revert #14897 + ## 2025.2.0 ### General @@ -208,12 +212,6 @@ PgroongaのCWサーチ (github.com/paricafe/misskey#d30db97b59d264450901c1dd8680 (Cherry-picked from https://activitypub.software/TransFem-org/Sharkey/-/merge_requests/712) - Fix: FTT無効時にユーザーリストタイムラインが使用できない問題を修正 (Cherry-picked from https://activitypub.software/TransFem-org/Sharkey/-/merge_requests/709) -- Fix: User Webhookテスト機能のMock Payloadを修正 -- Fix: アカウント削除のモデレーションログが動作していないのを修正 (#14996) -- Fix: リノートミュートが新規投稿通知に対して作用していなかった問題を修正 -- Fix: Inboxの処理で生じるエラーを誤ってActivityとして処理することがある問題を修正 - (Cherry-picked from https://activitypub.software/TransFem-org/Sharkey/-/merge_requests/730) -- Fix: セキュリティに関する修正 ### Misskey.js - Fix: Stream初期化時、別途WebSocketを指定する場合の型定義を修正 diff --git a/packages/backend/src/server/ActivityPubServerService.ts b/packages/backend/src/server/ActivityPubServerService.ts index 8c4b13a40a..71a69d4c33 100644 --- a/packages/backend/src/server/ActivityPubServerService.ts +++ b/packages/backend/src/server/ActivityPubServerService.ts @@ -29,7 +29,6 @@ import { UserEntityService } from '@/core/entities/UserEntityService.js'; import { bindThis } from '@/decorators.js'; import { IActivity } from '@/core/activitypub/type.js'; import { isQuote, isRenote } from '@/misc/is-renote.js'; -import * as Acct from '@/misc/acct.js'; import type { FastifyInstance, FastifyRequest, FastifyReply, FastifyPluginOptions, FastifyBodyParser } from 'fastify'; import type { FindOptionsWhere } from 'typeorm'; @@ -487,16 +486,6 @@ export class ActivityPubServerService { return; } - // リモートだったらリダイレクト - if (user.host != null) { - if (user.uri == null || this.utilityService.isSelfHost(user.host)) { - reply.code(500); - return; - } - reply.redirect(user.uri, 301); - return; - } - reply.header('Cache-Control', 'public, max-age=180'); this.setResponseType(request, reply); return (this.apRendererService.addContext(await this.apRendererService.renderPerson(user as MiLocalUser))); @@ -665,20 +654,19 @@ export class ActivityPubServerService { const user = await this.usersRepository.findOneBy({ id: userId, + host: IsNull(), isSuspended: false, }); return await this.userInfo(request, reply, user); }); - fastify.get<{ Params: { acct: string; } }>('/@:acct', { constraints: { apOrHtml: 'ap' } }, async (request, reply) => { + fastify.get<{ Params: { user: string; } }>('/@:user', { constraints: { apOrHtml: 'ap' } }, async (request, reply) => { vary(reply.raw, 'Accept'); - const acct = Acct.parse(request.params.acct); - const user = await this.usersRepository.findOneBy({ - usernameLower: acct.username, - host: acct.host ?? IsNull(), + usernameLower: request.params.user.toLowerCase(), + host: IsNull(), isSuspended: false, }); diff --git a/packages/backend/test/e2e/fetch-resource.ts b/packages/backend/test/e2e/fetch-resource.ts index 8ea4cb9800..7efd688ec2 100644 --- a/packages/backend/test/e2e/fetch-resource.ts +++ b/packages/backend/test/e2e/fetch-resource.ts @@ -230,7 +230,6 @@ describe('Webリソース', () => { path: path('xxxxxxxxxx'), type: HTML, })); - test.todo('HTMLとしてGETできる。(リモートユーザーでもリダイレクトせず)'); }); describe.each([ @@ -250,7 +249,6 @@ describe('Webリソース', () => { path: path('xxxxxxxxxx'), accept, })); - test.todo('はオリジナルにリダイレクトされる。(リモートユーザー)'); }); });