public option not working

The public timeline is stil accessible when public is set to false. This is true to both pleroma-fe and curling /api/v1/timelines/public

added bug label

assigned to @aptinio

Hi @tutti! I'm new here so I have a couple of questions.

1. Are you referring to Pleroma.Config.get([:instance, :public])?
2. What's the expected behavior if public is set to false? Should GET /api/v1/timelines/public return a 404? Or should it return an error message that says the public option of this instance is set to false?

Hey @aptinio, so am I!

1. yes
2. I would expect a 403 like the other API calls

Note that there are a few more endpoints that should not be accessible if public is false.

Thanks @tutti!

mentioned in merge request !1143 (merged)

You are welcome. I tried to look into the issue, but am just starting out with elixir myself. So thanks for doing it! (enough OT I guess :D)

I've had some code for this sitting in a branch for several weeks now, but it's not ready to merge because of the many places where changes need to be made, and because I'm terrible at naming. Please see this branch, starting with commit #e1c9f20c17931f5bd3dd7dfead37e17b75beadc1. The code needs a rewrite and is incomplete.

Essentially, it's trivial to bypass :public false if you hit the Mastodon API instead of the Pleroma FE endpoints. Probably with the OStatus endpoints as well.

mentioned in commit 62516be9

closed via merge request !1143 (merged)