about summary refs log tree commit diff
path: root/app/controllers/api/v1
diff options
context:
space:
mode:
authorJack Jennings <jack@standard-library.com>2017-05-29 09:22:22 -0700
committerEugen Rochko <eugen@zeonfederated.com>2017-05-29 18:22:22 +0200
commit3a2003ba863252f305fb32098bcd3f095b10e2ff (patch)
tree6ff5f4a1cf6c9d042baca1441409afb9ac46775d /app/controllers/api/v1
parent9a81be0d3715eb846d940794f8b34cbbe4ba67a5 (diff)
Extract authorization policy for viewing statuses (#3150)
Diffstat (limited to 'app/controllers/api/v1')
-rw-r--r--app/controllers/api/v1/statuses_controller.rb7
1 files changed, 6 insertions, 1 deletions
diff --git a/app/controllers/api/v1/statuses_controller.rb b/app/controllers/api/v1/statuses_controller.rb
index 852ffc3ab..592540f45 100644
--- a/app/controllers/api/v1/statuses_controller.rb
+++ b/app/controllers/api/v1/statuses_controller.rb
@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class Api::V1::StatusesController < ApiController
+  include Authorization
+
   before_action :authorize_if_got_token, except:            [:create, :destroy, :reblog, :unreblog, :favourite, :unfavourite, :mute, :unmute]
   before_action -> { doorkeeper_authorize! :write }, only:  [:create, :destroy, :reblog, :unreblog, :favourite, :unfavourite, :mute, :unmute]
   before_action :require_user!, except:  [:show, :context, :card, :reblogged_by, :favourited_by]
@@ -130,7 +132,10 @@ class Api::V1::StatusesController < ApiController
 
   def set_status
     @status = Status.find(params[:id])
-    raise ActiveRecord::RecordNotFound unless @status.permitted?(current_account)
+    authorize @status, :show?
+  rescue Mastodon::NotPermittedError
+    # Reraise in order to get a 404 instead of a 403 error code
+    raise ActiveRecord::RecordNotFound
   end
 
   def set_conversation