From 085762ec174eae1c519ec14db632f5ba197ed3c7 Mon Sep 17 00:00:00 2001
From: winter
Date: Tue, 17 Dec 2024 18:39:18 +0000
Subject: hopefully implement push!

again i can't really test this yet because i don't have two https instances that can talk to each other.
soon i will set that up and test all these recent commits
---
 misc/get_remote_object_authenticated.php | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

(limited to 'misc/get_remote_object_authenticated.php')

diff --git a/misc/get_remote_object_authenticated.php b/misc/get_remote_object_authenticated.php
index ba67473..49aaa59 100644
--- a/misc/get_remote_object_authenticated.php
+++ b/misc/get_remote_object_authenticated.php
@@ -1,5 +1,6 @@
 <?php
 
+use Digitigrade\GlobalConfig;
 use Digitigrade\Model\Instance;
 
 /**
@@ -8,13 +9,19 @@ use Digitigrade\Model\Instance;
  * @param bool $dontLookUpInstance if true, will skip looking up the Instance, and consequently the auth token
  * @return false|string the response data, or false if it failed
  */
-function get_remote_object_authenticated(string $uri, bool $dontLookUpInstance = false) {
+function get_remote_object_authenticated(string $uri, bool $dontLookUpInstance = false): false|string {
     if (!str_starts_with($uri, 'https://'))
         return false;
 
+    $remoteHost = hostname_from_uri($uri);
+    if ($remoteHost == GlobalConfig::getInstance()->getCanonicalHost()) {
+        // refuse to fetch objects from ourself. that's silly
+        return false;
+    }
+
     $instance = null;
     if (!$dontLookUpInstance) {
-        $instance = Instance::findByDomain(explode('/', $uri)[2]);
+        $instance = Instance::findByHostname($remoteHost);
     }
 
     if ($instance?->auth?->outboundToken == null) {
-- 
cgit v1.3