Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-11-01 19:46:01 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: only serve local posts via S2S when queried

Browse Source
This commit is contained in:
Julian Lam
2024-03-08 20:45:51 -05:00
parent 6423d514ff
commit 00101d9e29
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/controllers/activitypub/actors.js
View File

@@ -8,6 +8,7 @@ const posts = require('../../posts');
const topics = require('../../topics');
const categories = require('../../categories');
const activitypub = require('../../activitypub');
const utils = require('../../utils');
const Actors = module.exports;
@@ -51,7 +52,7 @@ Actors.userBySlug = async function (req, res) {
Actors.note = async function (req, res) {
// technically a note isn't an actor, but it is here purely for organizational purposes.
// but also, wouldn't it be wild if you could follow a note? lol.
const allowed = await privileges.posts.can('topics:read', req.params.pid, activitypub._constants.uid);
const allowed = utils.isNumber(req.params.pid) && await privileges.posts.can('topics:read', req.params.pid, activitypub._constants.uid);
const post = (await posts.getPostSummaryByPids([req.params.pid], req.uid, { stripTags: false })).pop();
if (!allowed || !post) {
return res.sendStatus(404);
@@ -63,7 +64,7 @@ Actors.note = async function (req, res) {
Actors.topic = async function (req, res) {
// When queried, a topic more or less returns the main pid's note representation
const allowed = await privileges.topics.can('topics:read', req.params.tid, activitypub._constants.uid);
const allowed = utils.isNumber(req.params.pid) && await privileges.topics.can('topics:read', req.params.tid, activitypub._constants.uid);
const { mainPid, slug } = await topics.getTopicFields(req.params.tid, ['mainPid', 'slug']);
const post = (await posts.getPostSummaryByPids([mainPid], req.uid, { stripTags: false })).pop();
if (!allowed || !post) {