notfire/Iceshrimp.NET
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[backend/api] Prevent users from biting notes they can't see

Browse source
This commit is contained in:
pancakes 2024-10-19 15:27:26 +10:00 • committed by Iceshrimp development
parent 30ff0d77b2
commit 82ed8b583b
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
Iceshrimp.Backend/Controllers/Web/NoteController.cs
View file

@ -162,7 +162,11 @@ public class NoteController(
if (user.Id == id)
throw GracefulException.BadRequest("You cannot bite your own note");
var target = await db.Notes.Where(p => p.Id == id).IncludeCommonProperties().FirstOrDefaultAsync() ??
var target = await db.Notes
.Where(p => p.Id == id)
.IncludeCommonProperties()
.EnsureVisibleFor(user)
.FirstOrDefaultAsync() ??
throw GracefulException.NotFound("Note not found");
await biteSvc.BiteAsync(user, target);