From: William Pitcock <nenolod@dereferenced.org>
Date: Wed, 29 Aug 2018 08:51:51 +0000 (+0000)
Subject: mastodon api: use bounded AP object graph query to enforce containment of private... 
X-Git-Url: http://git.squeep.com/?a=commitdiff_plain;h=ded909120614e5b1fa1f9469c753a30b2d9b16ed;p=akkoma

mastodon api: use bounded AP object graph query to enforce containment of private statuses
---

diff --git a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
index f482de6fd..c90f9fa05 100644
--- a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
+++ b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
@@ -850,9 +850,14 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
         |> Map.put("type", "Create")
         |> Map.put("blocking_user", user)
 
-      # adding title is a hack to not make empty lists function like a public timeline
+      # we must filter the following list for the user to avoid leaking statuses the user
+      # does not actually have permission to see (for more info, peruse security issue #270).
+      following_to =
+        following
+        |> Enum.filter(fn x -> x in user.following end)
+
       activities =
-        ActivityPub.fetch_activities([title | following], params)
+        ActivityPub.fetch_activities_bounded(following_to, following, params)
         |> Enum.reverse()
 
       conn