This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/allura.git
commit c17f5cb0cef71dd6f0773794022bed0c5dd6e99e Author: Dave Brondsema <[email protected]> AuthorDate: Wed May 20 18:12:10 2026 -0400 [#8607] check activity nbhd --- ForgeActivity/forgeactivity/main.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ForgeActivity/forgeactivity/main.py b/ForgeActivity/forgeactivity/main.py index 3cbe91dec..0fb81eb2d 100644 --- a/ForgeActivity/forgeactivity/main.py +++ b/ForgeActivity/forgeactivity/main.py @@ -257,6 +257,11 @@ def delete_item(self, activity_id, **kwargs): activity = Activity.query.get(_id=ObjectId(activity_id)) if not activity: raise exc.HTTPGone + # At least one party of the activity must live under the current neighborhood + nbhd_prefix = c.project.neighborhood.url_prefix + if not any((p.get('activity_url') or '').startswith(nbhd_prefix) + for p in (activity.actor, activity.obj, activity.target) if p): + raise exc.HTTPForbidden # find other copies of this activity on other user/projects timelines # but only within a small time window, so we can do efficient searching activity_ts = activity._id.generation_time
