From 3bd6cf6cd2eda9aa95c734df58af11bbae57ce04 Mon Sep 17 00:00:00 2001
From: winter
Date: Fri, 17 Jan 2025 17:16:53 +0000
Subject: don't leak private notes on actor profile page

---
 Digitigrade/Model/Note.php | 10 ++++++++++
 1 file changed, 10 insertions(+)

(limited to 'Digitigrade/Model')

diff --git a/Digitigrade/Model/Note.php b/Digitigrade/Model/Note.php
index 64a2168..f6f492d 100644
--- a/Digitigrade/Model/Note.php
+++ b/Digitigrade/Model/Note.php
@@ -164,6 +164,16 @@ class Note extends PushableModel implements TimelineIncludeable {
         return array_unique(array_filter($instances, fn(?Instance $i) => $i != null));
     }
 
+    public function isViewableBy(?UserAccount $viewer): bool {
+        if ($this->privacy->scope == NotePrivacyScope::PUBLIC ) {
+            return true;
+        }
+        if ($viewer == null) {
+            return false;
+        }
+        return in_array($viewer->actor, $this->getRelevantActors());
+    }
+
     /**
      * Gets this note's formatted content in the given mimetype or null if there isn't one
      * @param string $mimetype content type to return
-- 
cgit v1.3