From 44299855d8c2de8625a6a58a2d2ff3db36e50966 Mon Sep 17 00:00:00 2001 From: atsu1125 Date: Tue, 10 Mar 2026 15:55:22 +0900 Subject: [PATCH 1/9] fix(backend): import file ownership check --- src/server/api/endpoints/i/import-blocking.ts | 5 ++++- src/server/api/endpoints/i/import-following.ts | 5 ++++- src/server/api/endpoints/i/import-muting.ts | 5 ++++- src/server/api/endpoints/i/import-user-lists.ts | 5 ++++- 4 files changed, 16 insertions(+), 4 deletions(-) diff --git a/src/server/api/endpoints/i/import-blocking.ts b/src/server/api/endpoints/i/import-blocking.ts index f3d48d9fe9..f0f4047eaa 100644 --- a/src/server/api/endpoints/i/import-blocking.ts +++ b/src/server/api/endpoints/i/import-blocking.ts @@ -49,7 +49,10 @@ export const meta = { }; export default define(meta, async (ps, user) => { - const file = await DriveFiles.findOne(ps.fileId); + const file = await DriveFiles.findOne({ + id: ps.fileId, + userId: user.id + }); if (file == null) throw new ApiError(meta.errors.noSuchFile); //if (!file.type.endsWith('/csv')) throw new ApiError(meta.errors.unexpectedFileType); diff --git a/src/server/api/endpoints/i/import-following.ts b/src/server/api/endpoints/i/import-following.ts index c8a539cda3..49dd21ba00 100644 --- a/src/server/api/endpoints/i/import-following.ts +++ b/src/server/api/endpoints/i/import-following.ts @@ -48,7 +48,10 @@ export const meta = { }; export default define(meta, async (ps, user) => { - const file = await DriveFiles.findOne(ps.fileId); + const file = await DriveFiles.findOne({ + id: ps.fileId, + userId: user.id + }); if (file == null) throw new ApiError(meta.errors.noSuchFile); //if (!file.type.endsWith('/csv')) throw new ApiError(meta.errors.unexpectedFileType); diff --git a/src/server/api/endpoints/i/import-muting.ts b/src/server/api/endpoints/i/import-muting.ts index e967d832f2..345ccf4675 100644 --- a/src/server/api/endpoints/i/import-muting.ts +++ b/src/server/api/endpoints/i/import-muting.ts @@ -49,7 +49,10 @@ export const meta = { }; export default define(meta, async (ps, user) => { - const file = await DriveFiles.findOne(ps.fileId); + const file = await DriveFiles.findOne({ + id: ps.fileId, + userId: user.id + }); if (file == null) throw new ApiError(meta.errors.noSuchFile); //if (!file.type.endsWith('/csv')) throw new ApiError(meta.errors.unexpectedFileType); diff --git a/src/server/api/endpoints/i/import-user-lists.ts b/src/server/api/endpoints/i/import-user-lists.ts index e360a54681..ef512f6f3a 100644 --- a/src/server/api/endpoints/i/import-user-lists.ts +++ b/src/server/api/endpoints/i/import-user-lists.ts @@ -48,7 +48,10 @@ export const meta = { }; export default define(meta, async (ps, user) => { - const file = await DriveFiles.findOne(ps.fileId); + const file = await DriveFiles.findOne({ + id: ps.fileId, + userId: user.id + }); if (file == null) throw new ApiError(meta.errors.noSuchFile); //if (!file.type.endsWith('/csv')) throw new ApiError(meta.errors.unexpectedFileType); From 6a0a0c3a97b44774d6ae7a1a1307a9e57d1db4eb Mon Sep 17 00:00:00 2001 From: atsu1125 Date: Tue, 10 Mar 2026 16:01:56 +0900 Subject: [PATCH 2/9] fix(backend): subscribe note ownership check --- src/server/api/stream/index.ts | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/server/api/stream/index.ts b/src/server/api/stream/index.ts index b2ceb578e0..dc3ca59c6c 100644 --- a/src/server/api/stream/index.ts +++ b/src/server/api/stream/index.ts @@ -8,7 +8,7 @@ import channels from './channels'; import { EventEmitter } from 'events'; import { User } from '../../../models/entities/user'; import { Channel as ChannelModel } from '../../../models/entities/channel'; -import { Users, Followings, Mutings, UserProfiles, ChannelFollowings } from '../../../models'; +import { Users, Followings, Mutings, UserProfiles, ChannelFollowings, Notes } from '../../../models'; import { ApiError } from '../error'; import { AccessToken } from '../../../models/entities/access-token'; import { UserProfile } from '../../../models/entities/user-profile'; @@ -147,9 +147,17 @@ export class Connection { * 投稿購読要求時 */ @autobind - private onSubscribeNote(payload: any, read: boolean) { + private async onSubscribeNote(payload: any, read: boolean) { if (!payload.id) return; + const packed = await Notes.pack(payload.id, this.user, { + detail: true, + }); + + if (packed?.isHidden) { + return; + } + if (this.subscribingNotes[payload.id] == null) { this.subscribingNotes[payload.id] = 0; } From 27a361df678e3c157d0e251fdf1504fdcf0cc088 Mon Sep 17 00:00:00 2001 From: atsu1125 Date: Tue, 10 Mar 2026 16:02:34 +0900 Subject: [PATCH 3/9] fix(backend): note ownership check for hashtag channels --- src/server/api/stream/channels/hashtag.ts | 1 + 1 file changed, 1 insertion(+) diff --git a/src/server/api/stream/channels/hashtag.ts b/src/server/api/stream/channels/hashtag.ts index 61b80e0935..3a9378c497 100644 --- a/src/server/api/stream/channels/hashtag.ts +++ b/src/server/api/stream/channels/hashtag.ts @@ -23,6 +23,7 @@ export default class extends Channel { @autobind private async onNote(note: PackedNote) { + if (note.isHidden) return; const noteTags = note.tags ? note.tags.map((t: string) => t.toLowerCase()) : []; const matched = this.q.some(tags => tags.every(tag => noteTags.includes(normalizeForSearch(tag)))); if (!matched) return; From e28af768fd8aff2305f9e0fee64d6868bd6597b3 Mon Sep 17 00:00:00 2001 From: atsu1125 Date: Tue, 10 Mar 2026 16:03:42 +0900 Subject: [PATCH 4/9] fix(backend): antenna ownership check for antenna channels --- src/server/api/stream/channels/antenna.ts | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/src/server/api/stream/channels/antenna.ts b/src/server/api/stream/channels/antenna.ts index a63fee78bd..57592571fa 100644 --- a/src/server/api/stream/channels/antenna.ts +++ b/src/server/api/stream/channels/antenna.ts @@ -1,18 +1,28 @@ import autobind from 'autobind-decorator'; import Channel from '../channel'; -import { Notes } from '../../../../models'; +import { Notes, Antennas } from '../../../../models'; import { isMutedUserRelated } from '../../../../misc/is-muted-user-related'; export default class extends Channel { public readonly chName = 'antenna'; public static shouldShare = false; - public static requireCredential = false; + public static requireCredential = true; private antennaId: string; @autobind public async init(params: any) { + if (typeof params.antennaId !== 'string') return false; + if (!this.user) return false; + this.antennaId = params.antennaId as string; + const antennaExists = await Antennas.findOne({ + id: this.antennaId, + userId: this.user.id, + }); + + if (!antennaExists) return false; + // Subscribe stream this.subscriber.on(`antennaStream:${this.antennaId}`, this.onEvent); } @@ -26,7 +36,7 @@ export default class extends Channel { // 流れてきたNoteがミュートしているユーザーが関わるものだったら無視する if (isMutedUserRelated(note, this.muting, false)) return; - + this.send('note', note); } else { this.send(type, body); From daa7cbf4c722db66d2818817668b87b390837642 Mon Sep 17 00:00:00 2001 From: atsu1125 Date: Wed, 18 Mar 2026 13:59:55 +0900 Subject: [PATCH 5/9] fix(backend): Not to sign AP Objects with Accept header --- src/remote/activitypub/ap-request.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/remote/activitypub/ap-request.ts b/src/remote/activitypub/ap-request.ts index aa44971db7..451f360a82 100644 --- a/src/remote/activitypub/ap-request.ts +++ b/src/remote/activitypub/ap-request.ts @@ -50,7 +50,7 @@ export function createSignedGet(args: { key: PrivateKey, url: string, additional }, args.additionalHeaders), }; - const result = signToRequest(request, args.key, ['(request-target)', 'date', 'host', 'accept']); + const result = signToRequest(request, args.key, ['(request-target)', 'date', 'host']); return { request, From 8fb482778cf45aa793311fad537d7e7fea9d9c52 Mon Sep 17 00:00:00 2001 From: atsu1125 Date: Wed, 18 Mar 2026 14:02:34 +0900 Subject: [PATCH 6/9] bump node from 20.20.0 to 20.20.1 --- .node-version | 2 +- Dockerfile | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.node-version b/.node-version index 586e275eb9..f010c133af 100644 --- a/.node-version +++ b/.node-version @@ -1 +1 @@ -20.20.0 +20.20.1 diff --git a/Dockerfile b/Dockerfile index 29d9710d0c..58d5953ca0 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM node:20.20.0-bookworm AS builder +FROM node:20.20.1-bookworm AS builder ENV NODE_ENV=production WORKDIR /misskey @@ -12,7 +12,7 @@ COPY . ./ RUN yarn build -FROM node:20.20.0-bookworm-slim AS runner +FROM node:20.20.1-bookworm-slim AS runner WORKDIR /misskey From 713cd63e6e96615cad0a411a696cdd666ba0ff30 Mon Sep 17 00:00:00 2001 From: atsu1125 Date: Wed, 18 Mar 2026 14:07:54 +0900 Subject: [PATCH 7/9] bump koa from 2.16.3 to 2.16.4 --- package.json | 2 +- yarn.lock | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package.json b/package.json index 9b338acbff..2ff1322b9c 100644 --- a/package.json +++ b/package.json @@ -173,7 +173,7 @@ "jsonld": "8.3.3", "jsrsasign": "10.5.27", "katex": "0.12.0", - "koa": "2.16.3", + "koa": "2.16.4", "koa-bodyparser": "4.3.0", "koa-favicon": "2.1.0", "koa-json-body": "5.3.0", diff --git a/yarn.lock b/yarn.lock index fcb4f357d6..900e46d606 100644 --- a/yarn.lock +++ b/yarn.lock @@ -7729,10 +7729,10 @@ koa-views@*, koa-views@8.0.0: pretty "^2.0.0" resolve-path "^1.4.0" -koa@2.16.3: - version "2.16.3" - resolved "https://registry.yarnpkg.com/koa/-/koa-2.16.3.tgz#dd3a250472862cf7a3ef6e25bf325cc9db620ab5" - integrity sha512-zPPuIt+ku1iCpFBRwseMcPYQ1cJL8l60rSmKeOuGfOXyE6YnTBmf2aEFNL2HQGrD0cPcLO/t+v9RTgC+fwEh/g== +koa@2.16.4: + version "2.16.4" + resolved "https://registry.yarnpkg.com/koa/-/koa-2.16.4.tgz#303b996f5c3f2a3bb771c7db5e4303ee05f2265f" + integrity sha512-3An0GCLDSR34tsCO4H8Tef8Pp2ngtaZDAZnsWJYelqXUK5wyiHvGItgK/xcSkmHLSTn1Jcho1mRQs2ehRzvKKw== dependencies: accepts "^1.3.5" cache-content-type "^1.0.0" From faa44fc9c1bb4270abf59d830dc13faddc4f1357 Mon Sep 17 00:00:00 2001 From: atsu1125 Date: Tue, 31 Mar 2026 14:11:08 +0900 Subject: [PATCH 8/9] bump node from 20.20.1 to 20.20.2 --- .node-version | 2 +- Dockerfile | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.node-version b/.node-version index f010c133af..ccc4c6c7f8 100644 --- a/.node-version +++ b/.node-version @@ -1 +1 @@ -20.20.1 +20.20.2 diff --git a/Dockerfile b/Dockerfile index 58d5953ca0..f6f982a804 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM node:20.20.1-bookworm AS builder +FROM node:20.20.2-bookworm AS builder ENV NODE_ENV=production WORKDIR /misskey @@ -12,7 +12,7 @@ COPY . ./ RUN yarn build -FROM node:20.20.1-bookworm-slim AS runner +FROM node:20.20.2-bookworm-slim AS runner WORKDIR /misskey From f24eea56decfa5250f9dc492266c363309e2f3cf Mon Sep 17 00:00:00 2001 From: atsu1125 Date: Tue, 31 Mar 2026 14:13:03 +0900 Subject: [PATCH 9/9] 2022.07.03-milkey-3.7 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 2ff1322b9c..c8b98454f0 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "groundpolis-milkey", - "version": "2022.07.03-milkey-3.6", + "version": "2022.07.03-milkey-3.7", "private": true, "author": "Xeltica , Minemu , Azuki⪥ , Remito , atsu1125 ", "contributors": [