From bbb629336f595f8868aff8b6a4538b9569fa4cf9 Mon Sep 17 00:00:00 2001
From: trisua <me@trisua.com>
Date: Wed, 14 May 2025 19:35:29 -0400
Subject: [PATCH] fix: check profile privacy settings when viewing link to post

---
 crates/app/src/image.rs                       | 12 +++++------
 .../public/html/communities/create_post.html  |  1 -
 .../app/src/public/html/profile/settings.html |  2 +-
 crates/app/src/routes/api/v1/auth/profile.rs  |  1 -
 crates/app/src/routes/pages/communities.rs    | 20 ++++++++++++++++++-
 5 files changed, 26 insertions(+), 10 deletions(-)

diff --git a/crates/app/src/image.rs b/crates/app/src/image.rs
index 2182b7b..0ac685f 100644
--- a/crates/app/src/image.rs
+++ b/crates/app/src/image.rs
@@ -126,12 +126,12 @@ where
             let mut out = Vec::new();
 
             while let Ok(Some(field)) = multipart.next_field().await {
-                out.push(field.bytes().await.map_err(|_| {
-                    (
-                        StatusCode::BAD_REQUEST,
-                        "could not read field as bytes".to_string(),
-                    )
-                })?);
+                out.push(
+                    field
+                        .bytes()
+                        .await
+                        .map_err(|e| (StatusCode::BAD_REQUEST, e.to_string()))?,
+                );
             }
 
             out
diff --git a/crates/app/src/public/html/communities/create_post.html b/crates/app/src/public/html/communities/create_post.html
index 6297d60..a12e843 100644
--- a/crates/app/src/public/html/communities/create_post.html
+++ b/crates/app/src/public/html/communities/create_post.html
@@ -55,7 +55,6 @@
                             name="content"
                             id="content"
                             placeholder="content"
-                            required
                             minlength="2"
                             maxlength="4096"
                         ></textarea>
diff --git a/crates/app/src/public/html/profile/settings.html b/crates/app/src/public/html/profile/settings.html
index a8e8e40..832cada 100644
--- a/crates/app/src/public/html/profile/settings.html
+++ b/crates/app/src/public/html/profile/settings.html
@@ -860,7 +860,7 @@
     </div>
 
     <!-- prettier-ignore -->
-    <script type="application/json" id="settings_json">{{ user.settings|json_encode()|safe }}</script>
+    <script type="application/json" id="settings_json">{{ profile.settings|json_encode()|safe }}</script>
 
     <script>
         setTimeout(() => {
diff --git a/crates/app/src/routes/api/v1/auth/profile.rs b/crates/app/src/routes/api/v1/auth/profile.rs
index 28133a0..a18783f 100644
--- a/crates/app/src/routes/api/v1/auth/profile.rs
+++ b/crates/app/src/routes/api/v1/auth/profile.rs
@@ -1,5 +1,4 @@
 use std::time::Duration;
-
 use crate::{
     get_user_from_token,
     model::{ApiReturn, Error},
diff --git a/crates/app/src/routes/pages/communities.rs b/crates/app/src/routes/pages/communities.rs
index d65c47a..1b4c83d 100644
--- a/crates/app/src/routes/pages/communities.rs
+++ b/crates/app/src/routes/pages/communities.rs
@@ -1,5 +1,7 @@
 use super::{render_error, PaginatedQuery, RepostsQuery, SearchedQuery};
-use crate::{assets::initial_context, get_lang, get_user_from_token, State};
+use crate::{
+    assets::initial_context, check_user_blocked_or_private, get_lang, get_user_from_token, State,
+};
 use axum::{
     Extension,
     extract::{Path, Query},
@@ -598,6 +600,14 @@ pub async fn post_request(
         Vec::new()
     };
 
+    // ...
+    let owner = match data.0.get_user_by_id(post.owner).await {
+        Ok(ua) => ua,
+        Err(e) => return Err(Html(render_error(e, &jar, &data, &user).await)),
+    };
+
+    check_user_blocked_or_private!(user, owner, data, jar);
+
     // check repost
     let reposting = data.0.get_post_reposting(&post, &ignore_users).await;
 
@@ -711,6 +721,14 @@ pub async fn reposts_request(
         Vec::new()
     };
 
+    // ...
+    let owner = match data.0.get_user_by_id(post.owner).await {
+        Ok(ua) => ua,
+        Err(e) => return Err(Html(render_error(e, &jar, &data, &user).await)),
+    };
+
+    check_user_blocked_or_private!(user, owner, data, jar);
+
     // check repost
     let reposting = data.0.get_post_reposting(&post, &ignore_users).await;