From 3e150488432bae5f4acd5277b0c143af48c71a11 Mon Sep 17 00:00:00 2001 From: Thomas Citharel Date: Mon, 21 Nov 2022 16:56:20 +0100 Subject: [PATCH] Prevent AP collection page number being < 1 Closes #1184 Signed-off-by: Thomas Citharel --- .../controllers/activity_pub_controller.ex | 1 + .../activity_pub_controller_test.exs | 28 +++++++++++++++++++ 2 files changed, 29 insertions(+) diff --git a/lib/web/controllers/activity_pub_controller.ex b/lib/web/controllers/activity_pub_controller.ex index 296d774d..93f13282 100644 --- a/lib/web/controllers/activity_pub_controller.ex +++ b/lib/web/controllers/activity_pub_controller.ex @@ -191,6 +191,7 @@ defmodule Mobilizon.Web.ActivityPubController do defp actor_collection(conn, collection, %{"name" => name, "page" => page}) do with {page, ""} <- Integer.parse(page), + page <- max(page, 1), %Actor{} = actor <- Actors.get_local_actor_by_name_with_preload(name) do conn |> put_resp_header("content-type", "application/activity+json") diff --git a/test/web/controllers/activity_pub_controller_test.exs b/test/web/controllers/activity_pub_controller_test.exs index 95367865..d44ddeef 100644 --- a/test/web/controllers/activity_pub_controller_test.exs +++ b/test/web/controllers/activity_pub_controller_test.exs @@ -243,6 +243,34 @@ defmodule Mobilizon.Web.ActivityPubControllerTest do assert length(result["orderedItems"]) == 5 end + test "it can't be called for a page < 1", %{conn: conn} do + actor = insert(:actor, visibility: :public) + + Enum.each(1..15, fn _ -> + insert(:event, organizer_actor: actor) + end) + + result = + conn + |> get(Actor.build_url(actor.preferred_username, :outbox)) + |> json_response(200) + + assert length(result["first"]["orderedItems"]) == 10 + assert result["totalItems"] == 15 + + page_0_result = + conn + |> get(Actor.build_url(actor.preferred_username, :outbox, page: 0)) + |> json_response(200) + + page_1_result = + conn + |> get(Actor.build_url(actor.preferred_username, :outbox, page: 1)) + |> json_response(200) + + assert page_0_result == page_1_result + end + test "it returns an empty collection if the actor has private visibility", %{conn: conn} do actor = insert(:actor, visibility: :private) insert(:event, organizer_actor: actor)