This is an automated email from the ASF dual-hosted git repository.

asf-gitbox-commits pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/allura.git

commit c17f5cb0cef71dd6f0773794022bed0c5dd6e99e
Author: Dave Brondsema <[email protected]>
AuthorDate: Wed May 20 18:12:10 2026 -0400

    [#8607] check activity nbhd
---
 ForgeActivity/forgeactivity/main.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/ForgeActivity/forgeactivity/main.py 
b/ForgeActivity/forgeactivity/main.py
index 3cbe91dec..0fb81eb2d 100644
--- a/ForgeActivity/forgeactivity/main.py
+++ b/ForgeActivity/forgeactivity/main.py
@@ -257,6 +257,11 @@ def delete_item(self, activity_id, **kwargs):
         activity = Activity.query.get(_id=ObjectId(activity_id))
         if not activity:
             raise exc.HTTPGone
+        # At least one party of the activity must live under the current 
neighborhood
+        nbhd_prefix = c.project.neighborhood.url_prefix
+        if not any((p.get('activity_url') or '').startswith(nbhd_prefix)
+                   for p in (activity.actor, activity.obj, activity.target) if 
p):
+            raise exc.HTTPForbidden
         # find other copies of this activity on other user/projects timelines
         # but only within a small time window, so we can do efficient searching
         activity_ts = activity._id.generation_time

Reply via email to