From 8fc56f62bad41a30060b527ee2707c07946e0edf Mon Sep 17 00:00:00 2001
From: winter
Date: Mon, 27 Jan 2025 21:28:29 +0000
Subject: prevent deleting remote notes

---
 routes/note_fragment.php | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'routes')

diff --git a/routes/note_fragment.php b/routes/note_fragment.php
index 143697f..9d3b9bb 100644
--- a/routes/note_fragment.php
+++ b/routes/note_fragment.php
@@ -20,6 +20,9 @@ Router::getInstance()->mount('/fragment/note/:id', function (array $args) {
     if ($note->author != $user->actor && !$user->isAdmin) {
         throw new Forbidden('you may not delete that note!');
     }
+    if (!$note->author->isLocal) {
+        throw new BadRequest("can't delete a non-local note");
+    }
 
     $note->markDeleted();
     // no need to return any template because it's just gone
-- 
cgit v1.3