From d9c8abca54326c13810e87352e33a85fa6ca04db Mon Sep 17 00:00:00 2001 From: Fire Demon Date: Sun, 26 Jul 2020 06:37:23 -0500 Subject: [Privacy] Exclude mixed-privacy posts from public collections unless the requesting actor is locally authenticated or follows the author --- app/controllers/activitypub/replies_controller.rb | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'app/controllers/activitypub/replies_controller.rb') diff --git a/app/controllers/activitypub/replies_controller.rb b/app/controllers/activitypub/replies_controller.rb index 43bf4e657..cec571e8a 100644 --- a/app/controllers/activitypub/replies_controller.rb +++ b/app/controllers/activitypub/replies_controller.rb @@ -14,7 +14,7 @@ class ActivityPub::RepliesController < ActivityPub::BaseController def index expires_in 0, public: public_fetch_mode? - render json: replies_collection_presenter, serializer: ActivityPub::CollectionSerializer, adapter: ActivityPub::Adapter, content_type: 'application/activity+json', skip_activities: true + render json: replies_collection_presenter, serializer: ActivityPub::CollectionSerializer, adapter: ActivityPub::Adapter, content_type: 'application/activity+json', skip_activities: true, target_domain: signed_request_account&.domain end private @@ -33,6 +33,7 @@ class ActivityPub::RepliesController < ActivityPub::BaseController def set_replies @replies = only_other_accounts? ? Status.where.not(account_id: @account.id) : @account.statuses @replies = @replies.where(in_reply_to_id: @status.id, visibility: [:public, :unlisted]) + @replies = @replies.without_semiprivate unless known_visitor? @replies = @replies.paginate_by_min_id(DESCENDANTS_LIMIT, params[:min_id]) end @@ -77,4 +78,8 @@ class ActivityPub::RepliesController < ActivityPub::BaseController def page_params params_slice(:only_other_accounts, :min_id).merge(page: true) end + + def known_visitor? + @known_visitor ||= user_signed_in? || (signed_request_account.present? && signed_request_account.following?(@account)) + end end -- cgit