[pfefferle]

Fixes #

Proposed changes:

• Activities for inboxes on this site are delivered through an internal REST request, with signature verification deferred for that request. The route was taken from the inbox URL as stored for the recipient, without checking that it is an inbox.
• Dispatcher::send_to_local_inbox() now only dispatches the shared inbox and the actor inboxes (/inbox, /actors/<id>/inbox, /users/<id>/inbox). Any other route returns an activitypub_invalid_inbox error, which is not retried.

Other information:

• Have you written new tests for your changes, if applicable?

Real local deliveries already go to these routes, and inboxes on other hosts are still delivered over HTTP, so nothing changes for them.

Testing instructions:

• vendor/bin/phpunit --filter test_local_delivery_only_reaches_inbox_routes
• Follow the blog with another user of the same site, and check that the follow is still accepted.

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message