Fix bug

2 files changed, 14 insertions, 4 deletions

diff --git a/src/remote/activitypub/act/delete/index.ts b/src/remote/activitypub/act/delete/index.ts
index 42272433de..8163ffc32e 100644
--- a/src/remote/activitypub/act/delete/index.ts
+++ b/src/remote/activitypub/act/delete/index.ts
@@ -18,13 +18,13 @@ export default async (actor, activity): Promise<void> => {
 
 	switch (object.type) {
 	case 'Note':
-		deleteNote(uri);
+		deleteNote(actor, uri);
 		break;
 
 	case 'Tombstone':
 		const post = await Post.findOne({ uri });
 		if (post != null) {
-			deleteNote(uri);
+			deleteNote(actor, uri);
 		}
 		break;
 
diff --git a/src/remote/activitypub/act/delete/note.ts b/src/remote/activitypub/act/delete/note.ts
index 75534250e6..5306b705e4 100644
--- a/src/remote/activitypub/act/delete/note.ts
+++ b/src/remote/activitypub/act/delete/note.ts
@@ -5,10 +5,20 @@ import { createDb } from '../../../../queue';
 
 const log = debug('misskey:activitypub');
 
-export default async function(uri: string) {
+export default async function(actor, uri: string) {
 	log(`Deleting the Note: ${uri}`);
 
-	const post = await Post.findOneAndDelete({ uri });
+	const post = await Post.findOne({ uri });
+
+	if (post == null) {
+		throw new Error('post not found');
+	}
+
+	if (post.userId !== actor._id) {
+		throw new Error('投稿を削除しようとしているユーザーは投稿の作成者ではありません');
+	}
+
+	Post.remove({ _id: post._id });
 
 	createDb({
 		type: 'deletePostDependents',