don't leak private notes on actor profile page

1 files changed, 10 insertions, 0 deletions

diff --git a/Digitigrade/Model/Note.php b/Digitigrade/Model/Note.php
index 64a2168..f6f492d 100644
--- a/Digitigrade/Model/Note.php
+++ b/Digitigrade/Model/Note.php
@@ -164,6 +164,16 @@ class Note extends PushableModel implements TimelineIncludeable {
         return array_unique(array_filter($instances, fn(?Instance $i) => $i != null));
     }
 
+    public function isViewableBy(?UserAccount $viewer): bool {
+        if ($this->privacy->scope == NotePrivacyScope::PUBLIC ) {
+            return true;
+        }
+        if ($viewer == null) {
+            return false;
+        }
+        return in_array($viewer->actor, $this->getRelevantActors());
+    }
+
     /**
      * Gets this note's formatted content in the given mimetype or null if there isn't one
      * @param string $mimetype content type to return