diff --git a/packages/frontend/src/scripts/api.ts b/packages/frontend/src/scripts/api.ts index 080977e5e4..78be5c8954 100644 --- a/packages/frontend/src/scripts/api.ts +++ b/packages/frontend/src/scripts/api.ts @@ -54,6 +54,8 @@ export function api(hostUrl: string, endpoint: E, data: P = {} as any, token?: string | null | undefined, signal?: AbortSignal): Promise { if (!/^https?:\/\//.test(hostUrl)) throw new Error('invalid host name'); if (endpoint.includes('://')) throw new Error('invalid endpoint'); + const knownUrls = (await api('federation/instances', { blocked: false })).map(v => v.host); + if (!knownUrls.includes(URL(hostUrl).host)) throw new Error(hostname + 'is blocked by or not known to this server.'); pendingApiRequestsCount.value++; const onFinally = () => {