From 616f347d767ffbef8e556351bc0fcb3451fde523 Mon Sep 17 00:00:00 2001
From: Ryan Barrett <git@ryanb.org>
Date: Fri, 29 Sep 2023 13:38:50 -0700
Subject: [PATCH] /bridge-user: only allow AP and Web source users

---
 pages.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pages.py b/pages.py
index 8bd4b90..92e696f 100644
--- a/pages.py
+++ b/pages.py
@@ -213,6 +213,11 @@ def bridge_user():
         flash(f"Couldn't determine protocol for {handle}")
         return render_template('bridge_user.html'), 400
 
+    # TODO: put these into a PULL_PROTOCOLS constant?
+    if not proto.LABEL in ('activitypub', 'fake', 'web'):
+        flash(f"{proto.__name__} isn't supported")
+        return render_template('bridge_user.html'), 400
+
     if not id:
         id = proto.handle_to_id(handle)
         if not id: