don't leak note author by redirects

1 files changed, 4 insertions, 4 deletions

diff --git a/routes/note.php b/routes/note.php
index f1d6650..90009d2 100644
--- a/routes/note.php
+++ b/routes/note.php
@@ -36,10 +36,6 @@ Router::getInstance()->mount('/@/:handle/note/:id', function (array $args) {
     if ($note == null || $note->deleted) {
         throw new NotFound("i don't know that note");
     }
-    // change the handle in the url if it's wrong
-    if ($args['handle'] != $note->author->getFullHandle()) {
-        throw new TemporaryRedirect('/@/' . $note->author->getFullHandle() . "/note/$note->id");
-    }
     // check the current user is allowed to see it
     if ($note->privacy->scope != NotePrivacyScope::PUBLIC ) {
         $user = UserAccount::requireByCurrentSession();
@@ -47,5 +43,9 @@ Router::getInstance()->mount('/@/:handle/note/:id', function (array $args) {
             throw new Forbidden();
         }
     }
+    // change the handle in the url if it's wrong
+    if ($args['handle'] != $note->author->getFullHandle()) {
+        throw new TemporaryRedirect('/@/' . $note->author->getFullHandle() . "/note/$note->id");
+    }
     render_template('thread_page', ['note' => $note]);
 });