Lemmy: Community bans not federating.

[dessalines]

They're still able to make federated comments even after being banned. Thought we'd checked for this but apparently not.

[Nutomic]

Not a big mystery here, we arent sending out any activity about community bans, meaning remote instances wont know that the user is banned in the community.

So to explain it based on the example of @[email protected] who was banned from [email protected]:

• they were only banned from that community, so they could still interact with eg [email protected]
• @[email protected] can still create new posts in the version of [email protected] shown on lemmy.ml, because there is no activity that would tell about the ban

So what we need to do is implement a Block/User, sent by the community to its followers.

[Nutomic]

1205 is also related to this. If we had that implemented, then @[email protected] could still submit a post to [email protected] after being banned, but that post wouldnt be visible on lemmy.ml.

[dessalines]

I'll need to test this again, probably between ds9 and fanonwave, but user1 was banned from fullcommunism, and then was able to make another comment after that ban (and that comment even showed up on lemmygrad) : https://lemmygrad.ml/post/9593/comment/16119

[Nutomic]

Hmm you're right, made 10 minutes after the ban. This is the activity for that comment which lemmy.ml sent out.

{
"cc": [
"https://lemmygrad.ml/c/fullcommunism",
"https://lemmygrad.ml/u/muad_dibber"
],
"id": "https://lemmy.ml/activities/create/2169b8f8-f976-4e0b-a0a1-cd9c91bf5fe9",
"to": "https://www.w3.org/ns/activitystreams#Public",
"tag": [],
"type": "Create",
"actor": "https://lemmy.ml/u/user1",
"object": {
"id": "https://lemmy.ml/comment/21808",
"to": "https://lemmygrad.ml/c/fullcommunism",
"type": "Note",
"content": "There's not a single sentence in that article that is able to describe any aspect of anarchism without trying to caste it in a negative light. It comes across as incredibly arrogant to someone with some anarchistic beliefs.\n\nIf you want to include Marxist critique of anarchism, then you should put it in a section titled \"Marxist Critiqueof Anarchism,\" not in the fucking opening paragraph.",
"@context": "https://www.w3.org/ns/activitystreams",
"inReplyTo": [
"https://lemmygrad.ml/post/9593",
"https://lemmygrad.ml/comment/16047"
],
"published": "2020-11-28T04:34:06.539528+00:00",
"attributedTo": "https://lemmy.ml/u/user1"
},
"@context": "https://www.w3.org/ns/activitystreams"
}

[dessalines]

Lets say for this ticket, just to fix that ability to comment issue.

[Nutomic]

Okay I opened #1298 to track the implementation of Block/User. As for this issue, I figured out a way to reproduce it:

• start with an admin/mod M on instance alpha, with community C, and two users U1 and U2 on instance beta
• U1 makes a post or comment in C
• M bans U1 from the community
• U1 makes another post/comment in C (this is possible because instance beta doesnt know about the ban, #1298)
• at this point everything is fine, the activity gets sent to alpha but rejected in the inbox
• now U2 upvotes or downvotes the post/comment

Result: U2 is not banned, so the activity is accepted by the inbox. Instance alpha notices that the post/comment referenced by the vote is missing, and fetches it. But in this case there is no check against community bans, only site bans are checked.

So to solve this, we need to add a check for community bans in fetcher.rs, probably in get_or_fetch_and_insert_post() and get_or_fetch_and_insert_comment(). Search will also require the same check.

[dessalines]

Nice, that was probably pretty tricky to figure out. Who knew a third party doing an action to a banned user would let it pass through.

[Nutomic]

Actually I just suddenly had the idea when looking at this thread again in the morning, then tested and confirmed it :D