prevent deleting remote notes

1 files changed, 3 insertions, 0 deletions

diff --git a/routes/note_fragment.php b/routes/note_fragment.php
index 143697f..9d3b9bb 100644
--- a/routes/note_fragment.php
+++ b/routes/note_fragment.php
@@ -20,6 +20,9 @@ Router::getInstance()->mount('/fragment/note/:id', function (array $args) {
     if ($note->author != $user->actor && !$user->isAdmin) {
         throw new Forbidden('you may not delete that note!');
     }
+    if (!$note->author->isLocal) {
+        throw new BadRequest("can't delete a non-local note");
+    }
 
     $note->markDeleted();
     // no need to return any template because it's just gone