SuperSeriousBusiness/GoToSocial
1
1
Fork 0
mirror of https://github.com/superseriousbusiness/gotosocial synced 2025-06-05 21:59:39 +02:00
Code Issues Projects Releases Wiki Activity

[bugfix] Fix unpinning statuses not working (#1582)

Browse Source 
And also fix unpinning/pinning potentially leaking the ID of followers-only statuses through returning 422 instead of 404.

Also tests!
This commit is contained in:
tobi
2023-03-03 13:35:49 +01:00
committed by GitHub
parent fe6c8b8152
commit 29f8c51ab8
2 changed files with 149 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
internal/processing/status/pin.go
View File

@@ -35,6 +35,7 @@ const allowedPinnedCount = 10
// can pin or unpin it.
//
// It checks:
// - Status is visible to requesting account.
// - Status belongs to requesting account.
// - Status is public, unlisted, or followers-only.
// - Status is not a boost.
@@ -45,6 +46,21 @@ func (p *Processor) getPinnableStatus(ctx context.Context, targetStatusID string
return nil, gtserror.NewErrorNotFound(err)
}
requestingAccount, err := p.state.DB.GetAccountByID(ctx, requestingAccountID)
if err != nil {
return nil, gtserror.NewErrorInternalError(err)
}
visible, err := p.filter.StatusVisible(ctx, targetStatus, requestingAccount)
if err != nil {
return nil, gtserror.NewErrorInternalError(err)
}
if !visible {
err = fmt.Errorf("status %s not visible to account %s", targetStatusID, requestingAccountID)
return nil, gtserror.NewErrorNotFound(err)
}
if targetStatus.AccountID != requestingAccountID {
err = fmt.Errorf("status %s does not belong to account %s", targetStatusID, requestingAccountID)
return nil, gtserror.NewErrorUnprocessableEntity(err, err.Error())
@@ -124,7 +140,7 @@ func (p *Processor) PinRemove(ctx context.Context, requestingAccount *gtsmodel.A
return nil, errWithCode
}
if targetStatus.PinnedAt.IsZero() {
if !targetStatus.PinnedAt.IsZero() {
targetStatus.PinnedAt = time.Time{}
if err := p.state.DB.UpdateStatus(ctx, targetStatus, "pinned_at"); err != nil {
return nil, gtserror.NewErrorInternalError(fmt.Errorf("db error unpinning status: %w", err))