From 3a2003ba863252f305fb32098bcd3f095b10e2ff Mon Sep 17 00:00:00 2001 From: Jack Jennings Date: Mon, 29 May 2017 09:22:22 -0700 Subject: Extract authorization policy for viewing statuses (#3150) --- app/controllers/api/v1/statuses_controller.rb | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'app/controllers/api/v1') diff --git a/app/controllers/api/v1/statuses_controller.rb b/app/controllers/api/v1/statuses_controller.rb index 852ffc3ab..592540f45 100644 --- a/app/controllers/api/v1/statuses_controller.rb +++ b/app/controllers/api/v1/statuses_controller.rb @@ -1,6 +1,8 @@ # frozen_string_literal: true class Api::V1::StatusesController < ApiController + include Authorization + before_action :authorize_if_got_token, except: [:create, :destroy, :reblog, :unreblog, :favourite, :unfavourite, :mute, :unmute] before_action -> { doorkeeper_authorize! :write }, only: [:create, :destroy, :reblog, :unreblog, :favourite, :unfavourite, :mute, :unmute] before_action :require_user!, except: [:show, :context, :card, :reblogged_by, :favourited_by] @@ -130,7 +132,10 @@ class Api::V1::StatusesController < ApiController def set_status @status = Status.find(params[:id]) - raise ActiveRecord::RecordNotFound unless @status.permitted?(current_account) + authorize @status, :show? + rescue Mastodon::NotPermittedError + # Reraise in order to get a 404 instead of a 403 error code + raise ActiveRecord::RecordNotFound end def set_conversation -- cgit