From 6a4e2db661f47a318bbf93a07ba9f16f7bac3ee0 Mon Sep 17 00:00:00 2001
From: unarist <m.unarist@gmail.com>
Date: Sun, 3 Sep 2017 00:42:47 +0900
Subject: Raise an error for remote url in StatusFinder (#4776)

* Raise an error for remote url in StatusFinder

Previous implementation had allowed remote url with status id which also exists on local.

Then that bug leads /api/web/embed to return wrong embed url.

* Fix oembed_controller_spec
---
 app/lib/status_finder.rb | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'app/lib')

diff --git a/app/lib/status_finder.rb b/app/lib/status_finder.rb
index bd910f12b..4d1aed297 100644
--- a/app/lib/status_finder.rb
+++ b/app/lib/status_finder.rb
@@ -10,6 +10,8 @@ class StatusFinder
   def status
     verify_action!
 
+    raise ActiveRecord::RecordNotFound unless TagManager.instance.local_url?(url)
+
     case recognized_params[:controller]
     when 'stream_entries'
       StreamEntry.find(recognized_params[:id]).status
-- 
cgit