diff options
Diffstat (limited to 'misc/get_remote_object_authenticated.php')
| -rw-r--r-- | misc/get_remote_object_authenticated.php | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/misc/get_remote_object_authenticated.php b/misc/get_remote_object_authenticated.php index ba67473..49aaa59 100644 --- a/misc/get_remote_object_authenticated.php +++ b/misc/get_remote_object_authenticated.php @@ -1,5 +1,6 @@ <?php +use Digitigrade\GlobalConfig; use Digitigrade\Model\Instance; /** @@ -8,13 +9,19 @@ use Digitigrade\Model\Instance; * @param bool $dontLookUpInstance if true, will skip looking up the Instance, and consequently the auth token * @return false|string the response data, or false if it failed */ -function get_remote_object_authenticated(string $uri, bool $dontLookUpInstance = false) { +function get_remote_object_authenticated(string $uri, bool $dontLookUpInstance = false): false|string { if (!str_starts_with($uri, 'https://')) return false; + $remoteHost = hostname_from_uri($uri); + if ($remoteHost == GlobalConfig::getInstance()->getCanonicalHost()) { + // refuse to fetch objects from ourself. that's silly + return false; + } + $instance = null; if (!$dontLookUpInstance) { - $instance = Instance::findByDomain(explode('/', $uri)[2]); + $instance = Instance::findByHostname($remoteHost); } if ($instance?->auth?->outboundToken == null) { |