Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Multisite: ensure that user_ids only work for users of this site #158

Merged
merged 1 commit into from
Jul 30, 2024

Conversation

mattwiebe
Copy link
Contributor

@mattwiebe mattwiebe commented Jun 26, 2024

When browsing Followers, they can have a user_id on their own instance that Mastodon clients then try to retrieve from their own instance. Eg say that a user is followed by my mattwiebe@mastodon.onlinne account. When the client queries the mastodon.online instance, it gets this:

{
  "id": "110770996307846062",
  "username": "mattwiebe",
  "acct": "mattwiebe",
  "display_name": "mw.social"
  // snip
}

But when browsing profiles, some clients (Ivory in my case) tries to query that ID against the current instance, doing api/v1/accounts/110770996307846062 against EMA. For wpcom, that particular ID is above our highest user_id, but many will produce a false positive for a user in the network who isn't even a member of the blog.

This doesn't fix for user ID collisions where the user ID from a remote user is the same as one that is also a member of the blog, but it's a good start.

@akirk akirk merged commit 8ec5893 into akirk:main Jul 30, 2024
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants