From 3bd6cf6cd2eda9aa95c734df58af11bbae57ce04 Mon Sep 17 00:00:00 2001
From: winter
Date: Fri, 17 Jan 2025 17:16:53 +0000
Subject: don't leak private notes on actor profile page

---
 templates/actor_profile_page.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'templates')

diff --git a/templates/actor_profile_page.php b/templates/actor_profile_page.php
index 649069d..eba9d04 100644
--- a/templates/actor_profile_page.php
+++ b/templates/actor_profile_page.php
@@ -1,12 +1,15 @@
 <?php
 
 use Digitigrade\Model\Note;
+use Digitigrade\Model\UserAccount;
 
 call_template('skeleton', [
     'pageTitle' => "$actor->displayName - @" . $actor->getFullHandle(),
     'renderTitleHeading' => false
 ], function () {
     global $actor;
+    $user = UserAccount::findByCurrentSession();
+
     call_template('actor_profile', ['actor' => $actor]);
     echo '<hr>';
     $notes = Note::findAllWithAuthor($actor, 20);
@@ -14,7 +17,8 @@ call_template('skeleton', [
         call_template('placeholder_text', ['message' => __('user.notes.placeholder')]);
     } else {
         foreach ($notes as $n) {
-            call_template('note', ['note' => $n]);
+            if ($n->isViewableBy($user))
+                call_template('note', ['note' => $n]);
         }
         $countNotShown = Note::countWithAuthor($actor) - count($notes);
         if ($countNotShown >= 0) {
-- 
cgit v1.3