When a pump client tries to GET the outbox of another user, the API always returns the outbox of the requesting user. The below patch addresses this issue.

From c5f40d03a2ae6dd5f5c8ea67e441d4711e052c35 Mon Sep 17 00:00:00 2001
From: ayleph <ayleph@thisshitistemp.com>
Date: Sat, 31 Oct 2015 04:18:44 -0400
Subject: [PATCH 2/2] Allow API client to GET another user's outbox

---
 mediagoblin/api/views.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/mediagoblin/api/views.py b/mediagoblin/api/views.py
index 671c3b3..dcd04cd 100644
--- a/mediagoblin/api/views.py
+++ b/mediagoblin/api/views.py
@@ -565,9 +565,9 @@ def feed_endpoint(request, outbox=None):
 
     # Create outbox
     if outbox is None:
-        outbox = Activity.query.filter_by(actor=request.user.id)
+        outbox = Activity.query.filter_by(actor=requested_user.id)
     else:
-        outbox = outbox.filter_by(actor=request.user.id)
+        outbox = outbox.filter_by(actor=requested_user.id)
 
     # We want the newest things at the top (issue: #1055)
     outbox = outbox.order_by(Activity.published.desc())
-- 
2.6.2

I think this change is safe to make because:

• There is already code to check that the requesting user and the requested user match for PUT/POST requests.

421                 # Check that the person trying to update the comment is
422                 # the author of the comment.
423                 if image.actor != request.user.id:
424                     return json_error(
425                         "Only uploader of image is able to update image.",
426                         status=403
427                     )

• There is code which throws an error if a request other than PUT, POST, or GET is made.

548     elif request.method != "GET":
549         return json_error(
550             "Unsupported HTTP method {0}".format(request.method),
551             status=501
552         

So theoretically only a GET request should be able to pass through with the requested user not the same as the requesting user.

Related to #5354, entries in core_graveyard don't return a serializable actor. Instead, I get something like below in server logs when trying to pull from the inbox.

TypeError: <LocalUser #5 verified user "machalus"> is not JSON serializable

As a temporary hack, I hardcoded the graveyard actor as shown below. After doing so, pumpa finally was able to pull my inbox and load media and comments.

diff --git a/mediagoblin/db/models.py b/mediagoblin/db/models.py
index 0de14b4..8af520d 100644
--- a/mediagoblin/db/models.py
+++ b/mediagoblin/db/models.py
@@ -1566,7 +1566,8 @@ class Graveyard(Base):
         return {
             "id": self.public_id,
             "objectType": self.object_type,
-            "actor": self.actor(),
+            "actor": "bob",
             "published": deleted.isoformat(),
             "updated": deleted.isoformat(),
             "deleted": deleted.isoformat()

Entries in core__graveyard don't return a serializable JSON timestamp, resulting in failures of pump clients. The below patch addresses this issue.

From 7782960e044b9a366ac46cfaf687af4fceb17c3e Mon Sep 17 00:00:00 2001
From: ayleph <ayleph@thisshitistemp.com>
Date: Sat, 31 Oct 2015 03:04:06 -0400
Subject: [PATCH] Return deleted time in serializable format

---
 mediagoblin/db/models.py | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/mediagoblin/db/models.py b/mediagoblin/db/models.py
index 6765955..0de14b4 100644
--- a/mediagoblin/db/models.py
+++ b/mediagoblin/db/models.py
@@ -1562,13 +1562,14 @@ class Graveyard(Base):
         )   
 
     def serialize(self, request):
+        deleted = UTC.localize(self.deleted)
         return {
             "id": self.public_id,
             "objectType": self.object_type,
             "actor": self.actor(),
-            "published": self.deleted,
-            "updated": self.deleted,
-            "deleted": self.deleted
+            "published": deleted.isoformat(),
+            "updated": deleted.isoformat(),
+            "deleted": deleted.isoformat()
         }   
 
 MODELS = [ 
-- 
2.6.2