Fix leaking private statuses the admin account follows (mastodon#11300)

Now that the request is signed, it can return private toots. Do not leak them.
ProjectMyosotis · Oct 2, 2019 · aa61165 · aa61165
1 parent 65c58be
commit aa61165
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/app/services/resolve_url_service.rb b/app/services/resolve_url_service.rb
@@ -21,7 +21,9 @@ def process_url
  if equals_or_includes_any?(type, ActivityPub::FetchRemoteAccountService::SUPPORTED_TYPES)
  FetchRemoteAccountService.new.call(resource_url, body, protocol)
  elsif equals_or_includes_any?(type, ActivityPub::Activity::Create::SUPPORTED_TYPES + ActivityPub::Activity::Create::CONVERTED_TYPES)
- FetchRemoteStatusService.new.call(resource_url, body, protocol)
+ status = FetchRemoteStatusService.new.call(resource_url, body, protocol)
+ authorize_with @on_behalf_of, status, :show? unless status.nil?
+ status
  end
  end