don't leak private notes on actor profile page

1 files changed, 5 insertions, 1 deletions

diff --git a/templates/actor_profile_page.php b/templates/actor_profile_page.php
index 649069d..eba9d04 100644
--- a/templates/actor_profile_page.php
+++ b/templates/actor_profile_page.php
@@ -1,12 +1,15 @@
 <?php
 
 use Digitigrade\Model\Note;
+use Digitigrade\Model\UserAccount;
 
 call_template('skeleton', [
     'pageTitle' => "$actor->displayName - @" . $actor->getFullHandle(),
     'renderTitleHeading' => false
 ], function () {
     global $actor;
+    $user = UserAccount::findByCurrentSession();
+
     call_template('actor_profile', ['actor' => $actor]);
     echo '<hr>';
     $notes = Note::findAllWithAuthor($actor, 20);
@@ -14,7 +17,8 @@ call_template('skeleton', [
         call_template('placeholder_text', ['message' => __('user.notes.placeholder')]);
     } else {
         foreach ($notes as $n) {
-            call_template('note', ['note' => $n]);
+            if ($n->isViewableBy($user))
+                call_template('note', ['note' => $n]);
         }
         $countNotShown = Note::countWithAuthor($actor) - count($notes);
         if ($countNotShown >= 0) {