media panel bypasses restrict unauthenticated
Environment
- Installation type (OTP or From Source): OTP
- Pleroma version (could be found in the "Version" tab of settings in Pleroma-FE): 2.3.0-1-gb221d77a
- Elixir version (
elixir -v
for from source installations, N/A for OTP): N/A - Operating system: Debian 10
- PostgreSQL version (
psql -V
): psql (PostgreSQL) 11.11 (Debian 11.11-0+deb10u1)
Bug description
With public set to false, and restrict unauthenticated local profile explicitly set to false (and nothing else). user's post can be accessed via the media panel on their profile, but clicking on the link to that post and refresh shows nothing (access denied)