Be more strict when serving note objects.

This commit is contained in:
default 2023-08-18 18:21:52 +02:00
parent 8b176292d6
commit 46cfc37f2b

View file

@ -2059,6 +2059,10 @@ int activitypub_get_handler(const xs_dict *req, const char *q_path,
xs *id = xs_fmt("%s/%s", snac.actor, p_path); xs *id = xs_fmt("%s/%s", snac.actor, p_path);
status = object_get(id, &msg); status = object_get(id, &msg);
/* don't return non-public objects */
if (valid_status(status) && !is_msg_public(msg))
status = 404;
} }
else else
status = 404; status = 404;