From a0a86c3a98a6af158ecd2f1923feb752c82907db Mon Sep 17 00:00:00 2001
From: winter
Date: Sat, 15 Mar 2025 22:36:13 +0000
Subject: don't list pages the user can't view

---
 routes/pages.php | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

(limited to 'routes/pages.php')

diff --git a/routes/pages.php b/routes/pages.php
index 418436f..f57d10d 100644
--- a/routes/pages.php
+++ b/routes/pages.php
@@ -58,11 +58,8 @@ Router::getInstance()->mount('/@/:handle/page/:id', function (array $args) {
         throw new NotFound("i don't know that note");
     }
     // check the current user is allowed to see it
-    if ($note->privacy->scope != NotePrivacyScope::PUBLIC ) {
-        $user = UserAccount::requireByCurrentSession();
-        if (!in_array($user->actor, $note->getRelevantActors())) {
-            throw new Forbidden();
-        }
+    if (!$note->isViewableBy(UserAccount::findByCurrentSession())) {
+        throw new Forbidden();
     }
     // go back to the note if it's not a page
     if (!$note->hasPage()) {
-- 
cgit v1.3