Make sure remote Update activities can't affect local actors other than

Groups

Signed-off-by: Thomas Citharel <tcit@tcit.fr>

lib/federation/activity_pub/actions/update.ex

@@ -28,7 +28,7 @@ defmodule Mobilizon.Federation.ActivityPub.Actions.Update do
     Logger.debug("updating an activity")
     Logger.debug(inspect(args))
 
-    case Managable.update(old_entity, args, additional) do
+    case Managable.update(old_entity, args, Map.put(additional, :local, local)) do
       {:ok, entity, update_data} ->
         {:ok, activity} = create_activity(update_data, local)
         maybe_federate(activity)