Prevent posting toots with media attachments from someone else (masto…

…don#9921)
Origin-Creative · Jan 26, 2019 · 54fc6f8 · 54fc6f8
1 parent 1113823
commit 54fc6f8
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 2 deletions.
diff --git a/app/services/post_status_service.rb b/app/services/post_status_service.rb
@@ -93,7 +93,7 @@ def validate_media!
 
  raise Mastodon::ValidationError, I18n.t('media_attachments.validations.too_many') if @options[:media_ids].size > 4
 
- @media = MediaAttachment.where(status_id: nil).where(id: @options[:media_ids].take(4).map(&:to_i))
+ @media = @account.media_attachments.where(status_id: nil).where(id: @options[:media_ids].take(4).map(&:to_i))
 
  raise Mastodon::ValidationError, I18n.t('media_attachments.validations.images_and_video') if @media.size > 1 && @media.find(&:video?)
  end

diff --git a/spec/services/post_status_service_spec.rb b/spec/services/post_status_service_spec.rb
@@ -167,7 +167,7 @@
 
  it 'attaches the given media to the created status' do
  account = Fabricate(:account)
- media = Fabricate(:media_attachment)
+ media = Fabricate(:media_attachment, account: account)
 
  status = subject.call(
  account,
@@ -178,6 +178,19 @@
  expect(media.reload.status).to eq status
  end
 
+ it 'does not attach media from another account to the created status' do
+ account = Fabricate(:account)
+ media = Fabricate(:media_attachment, account: Fabricate(:account))
+
+ status = subject.call(
+ account,
+ text: "test status update",
+ media_ids: [media.id],
+ )
+
+ expect(media.reload.status).to eq nil
+ end
+
  it 'does not allow attaching more than 4 files' do
  account = Fabricate(:account)