activitypub: only send accept back automatically if the account is not locked

lib/pleroma/user.ex

@@ -252,6 +252,10 @@ def following?(%User{} = follower, %User{} = followed) do
     Enum.member?(follower.following, followed.follower_address)
   end
 
+  def locked?(%User{} = user) do
+    user.info["locked"] || false
+  end
+
   def get_by_ap_id(ap_id) do
     Repo.get_by(User, ap_id: ap_id)
   end

lib/pleroma/web/activity_pub/transmogrifier.ex

@@ -137,9 +137,11 @@ def handle_incoming(
     with %User{local: true} = followed <- User.get_cached_by_ap_id(followed),
          %User{} = follower <- User.get_or_fetch_by_ap_id(follower),
          {:ok, activity} <- ActivityPub.follow(follower, followed, id, false) do
-      ActivityPub.accept(%{to: [follower.ap_id], actor: followed.ap_id, object: data, local: true})
+      if not User.locked?(followed) do
+        ActivityPub.accept(%{to: [follower.ap_id], actor: followed.ap_id, object: data, local: true})
+        User.follow(follower, followed)
+      end
 
-      User.follow(follower, followed)
       {:ok, activity}
     else
       _e -> :error