make sure hidden posts are only visible to their authors

1 files changed, 5 insertions, 0 deletions

diff --git a/app/policies/status_policy.rb b/app/policies/status_policy.rb
index d5dad6350..fad51d13c 100644
--- a/app/policies/status_policy.rb
+++ b/app/policies/status_policy.rb
@@ -12,6 +12,7 @@ class StatusPolicy < ApplicationPolicy
   end
 
   def show?
+    return false if hidden? && !owned?
     return false if local_only? && (current_account.nil? || !current_account.local?)
     return true if owned? || mention_exists?
     return false if direct?
@@ -97,6 +98,10 @@ class StatusPolicy < ApplicationPolicy
     record.local_only?
   end
 
+  def hidden?
+    record.hidden?
+  end
+
   def still_accessible?
     return true unless record.local?
     record.updated_at > record.account.user.max_public_access.days.ago