Anon/pleroma
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

mastodon api: use bounded AP object graph query to enforce containment of private statuses

Browse Source
This commit is contained in:
William Pitcock 2018-08-29 08:51:51 +00:00
parent 643fae6e36
commit ded9091206
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
View File

@ -850,9 +850,14 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
|> Map.put("type", "Create") |> Map.put("type", "Create")
|> Map.put("blocking_user", user) |> Map.put("blocking_user", user)
# adding title is a hack to not make empty lists function like a public timeline # we must filter the following list for the user to avoid leaking statuses the user
# does not actually have permission to see (for more info, peruse security issue #270).
following_to =
following
|> Enum.filter(fn x -> x in user.following end)
activities = activities =
ActivityPub.fetch_activities([title | following], params) ActivityPub.fetch_activities_bounded(following_to, following, params)
|> Enum.reverse() |> Enum.reverse()
conn conn