2 files changed, 28 insertions, 2 deletions
diff --git a/misc/get_remote_object_authenticated.php b/misc/get_remote_object_authenticated.php
index ba67473..49aaa59 100644
--- a/misc/get_remote_object_authenticated.php
+++ b/misc/get_remote_object_authenticated.php
@@ -1,5 +1,6 @@
 <?php
 
+use Digitigrade\GlobalConfig;
 use Digitigrade\Model\Instance;
 
 /**
@@ -8,13 +9,19 @@ use Digitigrade\Model\Instance;
  * @param bool $dontLookUpInstance if true, will skip looking up the Instance, and consequently the auth token
  * @return false|string the response data, or false if it failed
  */
-function get_remote_object_authenticated(string $uri, bool $dontLookUpInstance = false) {
+function get_remote_object_authenticated(string $uri, bool $dontLookUpInstance = false): false|string {
     if (!str_starts_with($uri, 'https://'))
         return false;
 
+    $remoteHost = hostname_from_uri($uri);
+    if ($remoteHost == GlobalConfig::getInstance()->getCanonicalHost()) {
+        // refuse to fetch objects from ourself. that's silly
+        return false;
+    }
+
     $instance = null;
     if (!$dontLookUpInstance) {
-        $instance = Instance::findByDomain(explode('/', $uri)[2]);
+        $instance = Instance::findByHostname($remoteHost);
     }
 
     if ($instance?->auth?->outboundToken == null) {
diff --git a/misc/hostname_from_uri.php b/misc/hostname_from_uri.php
new file mode 100644
index 0000000..0ee6b05
--- /dev/null
+++ b/misc/hostname_from_uri.php
@@ -0,0 +1,19 @@
+<?php
+
+/**
+ * Extracts the hostname (and port) from the given URI, assuming it is of a known scheme and can have one
+ * @param string $uri
+ * @return ?string the host:port pair if there is one or null otherwise
+ */
+function hostname_from_uri(string $uri): ?string {
+    if (!(
+        str_starts_with($uri, 'https://') ||
+        str_starts_with($uri, 'http://') ||
+        str_starts_with($uri, 'gopher://') ||
+        str_starts_with($uri, 'gemini://') ||
+        str_starts_with($uri, 'mumble://')
+    )) {
+        return null;
+    }
+    return explode('/', $uri, 4)[2];
+}
+\ No newline at end of file