Skip to content

Mastodon API: Fix lists leaking private posts

rinpatch requested to merge hotfix/leaking-lists into develop

Our previous list visibility resolver grabbed posts if either follower collection of the user in a list who is followed is in to or if follower collection of the user in a list was in cc. This not only missed unlisted posts but also lead to leaking private posts when fix_explicit_addressing mistakingly started putting follower collections to cc (also fixed in this MR).

Reported by @kurisu@iscute.moe via a DM

Merge request reports