mirror of https://akkoma.dev/AkkomaGang/akkoma
70fe99d196
Previously there were mainly two attack vectors:
- for raw keys the owner <-> key mapping wasn't verified at all
- keys were retrieved with refetching allowed
and only the top-level ID was sanitised while
usually keys are but a subobject
This reintroduces public key checks in the user actor,
previously removed in
|
||
|---|---|---|
| .. | ||
| containment.ex | ||
| fetcher.ex | ||
| pruner.ex | ||
| updater.ex | ||