commit fbc30d1

Added more checks for 'Delete' and 'Update'.

 1@@ -3086,6 +3086,16 @@ int process_input_message(snac *snac, const xs_dict *msg, const xs_dict *req)
 2                 snac_log(snac, xs_fmt("malformed message: no 'id' field"));
 3             else
 4             if (object_here(id)) {
 5+                const char *atto = get_atto(object);
 6+
 7+                if (atto == NULL)
 8+                    snac_log(snac, xs_fmt("ignored post 'Update' with no attributedTo %s", id));
 9+                else
10+                if (strcmp(atto, key_id) != 0) {
11+                    snac_log(snac, xs_fmt("Update: mismatched attributedTo '%s' and key '%s'", atto, key_id));
12+                    srv_archive_error("update_post_key_mismatch", "bad keyId", atto, key_id);
13+                }
14+                else
15                 if (xs_startswith(id, srv_baseurl) && !xs_startswith(id, actor))
16                     snac_log(snac, xs_fmt("ignored incorrect 'Update' %s %s", actor, id));
17                 else {
18@@ -3126,10 +3136,22 @@ int process_input_message(snac *snac, const xs_dict *msg, const xs_dict *req)
19         if (xs_type(object) == XSTYPE_DICT)
20             object = xs_dict_get(object, "id");
21 
22+        xs *obj_data = NULL;
23+
24         if (xs_is_null(object))
25             snac_log(snac, xs_fmt("malformed message: no 'id' field"));
26         else
27-        if (object_here(object)) {
28+        if (valid_status(object_get(object, &obj_data))) {
29+            const char *atto = get_atto(obj_data);
30+
31+            if (atto == NULL)
32+                snac_log(snac, xs_fmt("ignored 'Delete' for object with attributedTo %s", object));
33+            else
34+            if (strcmp(atto, key_id) != 0) {
35+                snac_log(snac, xs_fmt("Delete: mismatched attributedTo '%s' and key '%s'", atto, key_id));
36+                srv_archive_error("delete_post_key_mismatch", "bad keyId", atto, key_id);
37+            }
38+            else
39             if (xs_startswith(object, srv_baseurl) && !is_msg_mine(snac, object))
40                 snac_log(snac, xs_fmt("ignored incorrect 'Delete' %s %s", actor, object));
41             else {