don't list pages the user can't view

1 files changed, 2 insertions, 5 deletions

diff --git a/routes/pages.php b/routes/pages.php
index 418436f..f57d10d 100644
--- a/routes/pages.php
+++ b/routes/pages.php
@@ -58,11 +58,8 @@ Router::getInstance()->mount('/@/:handle/page/:id', function (array $args) {
         throw new NotFound("i don't know that note");
     }
     // check the current user is allowed to see it
-    if ($note->privacy->scope != NotePrivacyScope::PUBLIC ) {
-        $user = UserAccount::requireByCurrentSession();
-        if (!in_array($user->actor, $note->getRelevantActors())) {
-            throw new Forbidden();
-        }
+    if (!$note->isViewableBy(UserAccount::findByCurrentSession())) {
+        throw new Forbidden();
     }
     // go back to the note if it's not a page
     if (!$note->hasPage()) {