amechama/sharkey
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: primitive 19 & 20: respect blocks and hide more

Browse Source 
Ideally, the user property should also be hidden (as leaving it in leaks
information slightly), but given the schema of the note endpoint, I
don't think that would be possible without introducing some kind of
"ghost" user, who is attributed for posts by users who have you blocked.
This commit is contained in:
Julia Johannesen 2024-11-14 21:38:17 -05:00
parent cbf8cc376e
commit 408e782507
No known key found for this signature in database
GPG Key ID: 4A1377AF3E7FBC46
1 changed files with 41 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
packages/backend/src/core/entities/NoteEntityService.ts
View File

@ -11,7 +11,7 @@ import type { Packed } from '@/misc/json-schema.js';
import { awaitAll } from '@/misc/prelude/await-all.js'; import { awaitAll } from '@/misc/prelude/await-all.js';
import type { MiUser } from '@/models/User.js'; import type { MiUser } from '@/models/User.js';
import type { MiNote } from '@/models/Note.js'; import type { MiNote } from '@/models/Note.js';
import type { UsersRepository, NotesRepository, FollowingsRepository, PollsRepository, PollVotesRepository, NoteReactionsRepository, ChannelsRepository, MiMeta } from '@/models/_.js'; import type { BlockingsRepository, UsersRepository, NotesRepository, FollowingsRepository, PollsRepository, PollVotesRepository, NoteReactionsRepository, ChannelsRepository, MiMeta } from '@/models/_.js';
import { bindThis } from '@/decorators.js'; import { bindThis } from '@/decorators.js';
import { DebounceLoader } from '@/misc/loader.js'; import { DebounceLoader } from '@/misc/loader.js';
import { IdService } from '@/core/IdService.js'; import { IdService } from '@/core/IdService.js';
@ -39,6 +39,9 @@ export class NoteEntityService implements OnModuleInit {
@Inject(DI.meta) @Inject(DI.meta)
private meta: MiMeta, private meta: MiMeta,
@Inject(DI.blockingsRepository)
private blockingsRepository: BlockingsRepository,
@Inject(DI.usersRepository) @Inject(DI.usersRepository)
private usersRepository: UsersRepository, private usersRepository: UsersRepository,
@ -142,6 +145,17 @@ export class NoteEntityService implements OnModuleInit {
} }
} }
if (!hide && meId && packedNote.userId !== meId) {
const isBlocked = await this.blockingsRepository.exists({
where: {
blockeeId: meId,
blockerId: packedNote.userId,
},
});
if (isBlocked) hide = true;
}
if (hide) { if (hide) {
packedNote.visibleUserIds = undefined; packedNote.visibleUserIds = undefined;
packedNote.fileIds = []; packedNote.fileIds = [];
@ -149,6 +163,12 @@ export class NoteEntityService implements OnModuleInit {
packedNote.text = null; packedNote.text = null;
packedNote.poll = undefined; packedNote.poll = undefined;
packedNote.cw = null; packedNote.cw = null;
packedNote.repliesCount = 0;
packedNote.reactionAcceptance = null;
packedNote.reactionAndUserPairCache = undefined;
packedNote.reactionCount = 0;
packedNote.reactionEmojis = undefined;
packedNote.reactions = undefined;
packedNote.isHidden = true; packedNote.isHidden = true;
} }
} }
@ -262,7 +282,13 @@ export class NoteEntityService implements OnModuleInit {
return true; return true;
} else { } else {
// フォロワーかどうか // フォロワーかどうか
const [following, user] = await Promise.all([ const [blocked, following, user] = await Promise.all([
this.blockingsRepository.exists({
where: {
blockeeId: meId,
blockerId: note.userId,
},
}),
this.followingsRepository.count({ this.followingsRepository.count({
where: { where: {
followeeId: note.userId, followeeId: note.userId,
@ -273,6 +299,8 @@ export class NoteEntityService implements OnModuleInit {
this.usersRepository.findOneByOrFail({ id: meId }), this.usersRepository.findOneByOrFail({ id: meId }),
]); ]);
if (blocked) return false;
/* If we know the following, everyhting is fine. /* If we know the following, everyhting is fine.
But if we do not know the following, it might be that both the But if we do not know the following, it might be that both the
@ -284,6 +312,17 @@ export class NoteEntityService implements OnModuleInit {
} }
} }
if (meId != null) {
const isBlocked = await this.blockingsRepository.exists({
where: {
blockeeId: meId,
blockerId: note.userId,
},
});
if (isBlocked) return false;
}
return true; return true;
} }