t/tetratto
1
0
Fork 0
Code Issues Pull requests Projects Releases 8 Packages Wiki Activity Actions

fix: don't allow private profiles to be exposed via mentions

Browse source
This commit is contained in:
trisua 2025-08-15 19:36:50 -04:00
parent eec81f5718
commit 5cc137a0ca
3 changed files with 27 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
crates/core/src/database/messages.rs
View file

@ -148,6 +148,17 @@ impl DataManager {
return Err(Error::NotAllowed);
}
// check private status
if user.settings.private_profile {
if self
.get_userfollow_by_initiator_receiver(user.id, data.owner)
.await
.is_err()
{
return Err(Error::NotAllowed);
}
}
// check if the user can read the channel
let membership = self
.get_membership_by_owner_community(user.id, channel.community)

11
crates/core/src/database/posts.rs
View file

@ -2067,6 +2067,17 @@ impl DataManager {
return Err(Error::NotAllowed);
}
// check private status
if user.settings.private_profile {
if self
.get_userfollow_by_initiator_receiver(user.id, data.owner)
.await
.is_err()
{
return Err(Error::NotAllowed);
}
}
// send notif
self.create_notification(Notification::new(
"You've been mentioned in a post!".to_string(),

5
crates/core/src/model/auth.rs
View file

@ -525,6 +525,11 @@ impl User {
out.push(buffer);
}
if out.len() > 5 {
// if we're trying to mention more than 5 people, mention nobody (we're a spammer)
return Vec::new();
}
// return
out
}