mirrors/gotosocial
1
0
Fork 0
mirror of https://github.com/superseriousbusiness/gotosocial.git synced 2025-10-29 22:32:25 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

[bugfix] Fix unpinning statuses not working (#1582)

Browse source 
And also fix unpinning/pinning potentially leaking the ID of followers-only statuses through returning 422 instead of 404.

Also tests!
This commit is contained in:
tobi 2023-03-03 13:35:49 +01:00 • committed by GitHub
commit 29f8c51ab8
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 149 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

18
internal/processing/status/pin.go
View file

@ -35,6 +35,7 @@ const allowedPinnedCount = 10
// can pin or unpin it.
//
// It checks:
// - Status is visible to requesting account.
// - Status belongs to requesting account.
// - Status is public, unlisted, or followers-only.
// - Status is not a boost.
@ -45,6 +46,21 @@ func (p *Processor) getPinnableStatus(ctx context.Context, targetStatusID string
return nil, gtserror.NewErrorNotFound(err)
}
requestingAccount, err := p.state.DB.GetAccountByID(ctx, requestingAccountID)
if err != nil {
return nil, gtserror.NewErrorInternalError(err)
}
visible, err := p.filter.StatusVisible(ctx, targetStatus, requestingAccount)
if err != nil {
return nil, gtserror.NewErrorInternalError(err)
}
if !visible {
err = fmt.Errorf("status %s not visible to account %s", targetStatusID, requestingAccountID)
return nil, gtserror.NewErrorNotFound(err)
}
if targetStatus.AccountID != requestingAccountID {
err = fmt.Errorf("status %s does not belong to account %s", targetStatusID, requestingAccountID)
return nil, gtserror.NewErrorUnprocessableEntity(err, err.Error())
@ -124,7 +140,7 @@ func (p *Processor) PinRemove(ctx context.Context, requestingAccount *gtsmodel.A
return nil, errWithCode
}
if targetStatus.PinnedAt.IsZero() {
if !targetStatus.PinnedAt.IsZero() {
targetStatus.PinnedAt = time.Time{}
if err := p.state.DB.UpdateStatus(ctx, targetStatus, "pinned_at"); err != nil {
return nil, gtserror.NewErrorInternalError(fmt.Errorf("db error unpinning status: %w", err))