Merge pull request #313 from nextcloud/bugfix/noid/check-instance-during-webfinger

check address of the account

2 files changed, 9 insertions, 2 deletions

diff --git a/.drone.yml b/.drone.yml
index 6f6ec4a8..5f866581 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -97,4 +97,4 @@ matrix:
     - TESTS: vue-build
 
 
-branches: [ master, stable* ]
+branches: [ master, stable*, alpha1 ]
diff --git a/lib/webfinger.php b/lib/webfinger.php
index 70a6f0fc..7d8f1fe0 100644
--- a/lib/webfinger.php
+++ b/lib/webfinger.php
@@ -31,6 +31,7 @@ namespace OCA\Social;
 
 use Exception;
 use OCA\Social\Service\CacheActorService;
+use OCA\Social\Service\ConfigService;
 
 require_once(__DIR__ . '/../appinfo/autoload.php');
 
@@ -51,10 +52,16 @@ if ($type !== 'acct') {
 }
 
 
-$username = substr($account, 0, strrpos($account, '@'));
+list($username, $instance) = explode('@', $account);
 
 try {
 	$cacheActorService = \OC::$server->query(CacheActorService::class);
+	$configService = \OC::$server->query(ConfigService::class);
+
+	if ($configService->getCloudAddress(true) !== $instance) {
+		throw new Exception();
+	}
+
 	$cacheActorService->getFromLocalAccount($username);
 } catch (Exception $e) {
 	http_response_code(404);