Security update

2 files changed, 8 insertions, 6 deletions

diff --git a/app/controllers/accounts_controller.rb b/app/controllers/accounts_controller.rb
index 50b5c08e6..72d32baf0 100644
--- a/app/controllers/accounts_controller.rb
+++ b/app/controllers/accounts_controller.rb
@@ -5,10 +5,8 @@ class AccountsController < ApplicationController
   before_action :set_webfinger_header
 
   def show
-    @statuses = @account.statuses.order('id desc').with_includes.with_counters
-
     respond_to do |format|
-      format.html { @statuses = @statuses.paginate(page: params[:page], per_page: 10)}
+      format.html { @statuses = @account.statuses.order('id desc').with_includes.with_counters.paginate(page: params[:page], per_page: 10)}
       format.atom
     end
   end
diff --git a/app/helpers/atom_builder_helper.rb b/app/helpers/atom_builder_helper.rb
index 40d1119c9..da3a1a9b8 100644
--- a/app/helpers/atom_builder_helper.rb
+++ b/app/helpers/atom_builder_helper.rb
@@ -126,9 +126,9 @@ module AtomBuilderHelper
   end
 
   def link_avatar(xml, account)
-    xml.link('rel' => 'avatar', 'type' => account.avatar_content_type, 'media:width' => '300', 'media:height' =>'300', 'href' => asset_url(account.avatar.url(:large, false)))
-    xml.link('rel' => 'avatar', 'type' => account.avatar_content_type, 'media:width' => '96', 'media:height' =>'96', 'href' => asset_url(account.avatar.url(:medium, false)))
-    xml.link('rel' => 'avatar', 'type' => account.avatar_content_type, 'media:width' => '48', 'media:height' =>'48', 'href' => asset_url(account.avatar.url(:small, false)))
+    single_link_avatar(xml, account, :large,  300)
+    single_link_avatar(xml, account, :medium, 96)
+    single_link_avatar(xml, account, :small,  48)
   end
 
   def logo(xml, url)
@@ -207,4 +207,8 @@ module AtomBuilderHelper
   def root_tag(xml, tag, &block)
     xml.send(tag, { :xmlns => 'http://www.w3.org/2005/Atom', 'xmlns:thr' => 'http://purl.org/syndication/thread/1.0', 'xmlns:activity' => 'http://activitystrea.ms/spec/1.0/', 'xmlns:poco' => 'http://portablecontacts.net/spec/1.0', 'xmlns:media' => 'http://purl.org/syndication/atommedia' }, &block)
   end
+
+  def single_link_avatar(xml, account, size, px)
+    xml.link('rel' => 'avatar', 'type' => account.avatar_content_type, 'media:width' => px, 'media:height' =>px, 'href' => asset_url(account.avatar.url(size, false)))
+  end
 end