Commit b640cf0c authored by lain's avatar lain
Browse files

Merge branch 'scarlett/pleroma-search-visibility-check' into 'develop'

Scarlett/pleroma search visibility check

See merge request !635
parents b0e8e521 7dcafb48
Pipeline #6055 passed with stages
in 5 minutes and 54 seconds
......@@ -725,11 +725,14 @@ def unblock_domain(%{assigns: %{user: blocker}} = conn, %{"domain" => domain}) d
json(conn, %{})
end
def status_search(query) do
def status_search(user, query) do
fetched =
if Regex.match?(~r/https?:/, query) do
with {:ok, object} <- ActivityPub.fetch_object_from_id(query) do
[Activity.get_create_activity_by_object_ap_id(object.data["id"])]
with {:ok, object} <- ActivityPub.fetch_object_from_id(query),
%Activity{} = activity <-
Activity.get_create_activity_by_object_ap_id(object.data["id"]),
true <- ActivityPub.visible_for_user?(activity, user) do
[activity]
else
_e -> []
end
......@@ -756,7 +759,7 @@ def status_search(query) do
def search2(%{assigns: %{user: user}} = conn, %{"q" => query} = params) do
accounts = User.search(query, params["resolve"] == "true")
statuses = status_search(query)
statuses = status_search(user, query)
tags_path = Web.base_url() <> "/tag/"
......@@ -780,7 +783,7 @@ def search2(%{assigns: %{user: user}} = conn, %{"q" => query} = params) do
def search(%{assigns: %{user: user}} = conn, %{"q" => query} = params) do
accounts = User.search(query, params["resolve"] == "true")
statuses = status_search(query)
statuses = status_search(user, query)
tags =
String.split(query)
......
......@@ -1312,6 +1312,24 @@ test "search fetches remote statuses", %{conn: conn} do
end)
end
test "search doesn't show statuses that it shouldn't", %{conn: conn} do
{:ok, activity} =
CommonAPI.post(insert(:user), %{
"status" => "This is about 2hu, but private",
"visibility" => "private"
})
capture_log(fn ->
conn =
conn
|> get("/api/v1/search", %{"q" => activity.data["object"]["id"]})
assert results = json_response(conn, 200)
[] = results["statuses"]
end)
end
test "search fetches remote accounts", %{conn: conn} do
conn =
conn
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment