From 651c569c3fe7bd3ab12578396ec5934285f02188 Mon Sep 17 00:00:00 2001
From: multiple creatures <dev@multiple-creature.party>
Date: Sun, 12 Jan 2020 23:44:35 -0600
Subject: allow sharekeys to be used with the api status controller

---
 app/controllers/api/v1/statuses_controller.rb | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

(limited to 'app/controllers')

diff --git a/app/controllers/api/v1/statuses_controller.rb b/app/controllers/api/v1/statuses_controller.rb
index ca92cf882..c3f2422ce 100644
--- a/app/controllers/api/v1/statuses_controller.rb
+++ b/app/controllers/api/v1/statuses_controller.rb
@@ -79,7 +79,13 @@ class Api::V1::StatusesController < Api::BaseController
 
   def set_status
     @status = Status.find(params[:id])
-    authorize @status, :show?
+    @sharekey = params[:key]
+
+    if @status.sharekey.present? && @sharekey == @status.sharekey.key
+      skip_authorization
+    else
+      authorize @status, :show?
+    end
   rescue Mastodon::NotPermittedError
     raise ActiveRecord::RecordNotFound
   end
-- 
cgit