don't list pages the user can't view

1 files changed, 2 insertions, 5 deletions

diff --git a/routes/note.php b/routes/note.php
index 6dd0025..1967a2d 100644
--- a/routes/note.php
+++ b/routes/note.php
@@ -40,11 +40,8 @@ Router::getInstance()->mount('/@/:handle/note/:id', function (array $args) {
         throw new NotFound("i don't know that note");
     }
     // check the current user is allowed to see it
-    if ($note->privacy->scope != NotePrivacyScope::PUBLIC ) {
-        $user = UserAccount::requireByCurrentSession();
-        if (!in_array($user->actor, $note->getRelevantActors())) {
-            throw new Forbidden();
-        }
+    if (!$note->isViewableBy(UserAccount::findByCurrentSession())) {
+        throw new Forbidden();
     }
     // change the handle in the url if it's wrong
     if ($args['handle'] != $note->author->getFullHandle()) {