Make sure private toots remain private and do not end up in HTTP caches (#6175)

1 files changed, 2 insertions, 1 deletions

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index e17d1f26e..f59f2725b 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -124,6 +124,7 @@ class ApplicationController < ActionController::Base
 
   def render_cached_json(cache_key, **options)
     options[:expires_in] ||= 3.minutes
+    options[:public]     ||= true
     cache_key              = cache_key.join(':') if cache_key.is_a?(Enumerable)
     content_type           = options.delete(:content_type) || 'application/json'
 
@@ -131,7 +132,7 @@ class ApplicationController < ActionController::Base
       yield.to_json
     end
 
-    expires_in options[:expires_in], public: true
+    expires_in options[:expires_in], public: options[:public]
     render json: data, content_type: content_type
   end