Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ensure blocked user unfollows blocker if Block/Undo Block are processed out of order #9687

Merged

Conversation

ClearlyClaire
Copy link
Contributor

Block + Undo Block have been used for a while to remove followers (even though Mastodon now also handles the cleaner Undo Accept + Reject Follow, but that flow is not explicitly defined in the AP spec).

However, such activities are processed in (and even sent from) sidekiq queues and could therefore be processed out-of-order, in which case the current code skips the Block entirely, which could cause the Block + Undo Block routine to fail from removing the follow relationship on the receiving end, meaning the temporarily blocked user would still receive private toots if there is another follower on the same instance.

This commit fixes that.

@ClearlyClaire ClearlyClaire force-pushed the fixes/block-unblock-race-unfollow branch 2 times, most recently from b6e6153 to 7c0ad87 Compare January 1, 2019 16:15
@ClearlyClaire ClearlyClaire force-pushed the fixes/block-unblock-race-unfollow branch from 7c0ad87 to af6ad4d Compare January 1, 2019 16:21
@ClearlyClaire ClearlyClaire added the security Security issues and fixes, vulnerabilities label Jan 1, 2019
@Gargron Gargron merged commit 70be301 into mastodon:master Jan 2, 2019
@ClearlyClaire ClearlyClaire deleted the fixes/block-unblock-race-unfollow branch March 14, 2019 15:44
hiyuki2578 pushed a commit to ProjectMyosotis/mastodon that referenced this pull request Oct 2, 2019
…ed out of order (mastodon#9687)

* Ensure blocked user unfollows blocker if Block/Undo Block are processed out of order

* Add specs for Block causing unfollow and for out-of-order Block + Undo
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security Security issues and fixes, vulnerabilities
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants