[#114] Made MastodonAPI and TwitterAPI user show actions return 404 for auth-inactive...

unless requested by admin or moderator.

diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index 4b8caf65c91f19692e15a1e4c08453e5192a5aee..7e792cb0c2ac83a4261f29f70abf86a65e178783 100644 (file)
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -38,7 +38,9 @@ defmodule Pleroma.User do
     timestamps()
   end
 
-  def auth_active?(user), do: user.info && !user.info.confirmation_pending
+  def auth_active?(%User{} = user), do: user.info && !user.info.confirmation_pending
+
+  def superuser?(%User{} = user), do: user.info && User.Info.superuser?(user.info)
 
   def avatar_url(user) do
     case user.avatar do

diff --git a/lib/pleroma/user/info.ex b/lib/pleroma/user/info.ex
index ad9fe1bbeb12c92662350040abc272a60e31dfe8..3de4af56c78ce974130239338f7126a430ee7025 100644 (file)
--- a/lib/pleroma/user/info.ex
+++ b/lib/pleroma/user/info.ex
@@ -37,6 +37,8 @@ defmodule Pleroma.User.Info do
     # subject _> Where is this used?
   end
 
+  def superuser?(info), do: info.is_admin || info.is_moderator
+
   def set_activation_status(info, deactivated) do
     params = %{deactivated: deactivated}
 

diff --git a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
index 665b7543769ac5f59b22d1414f081c7ebe219d74..c6db894427b7a8f5071c50f40329b5ff5104e9a7 100644 (file)
--- a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
+++ b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
@@ -110,7 +110,8 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
   end
 
   def user(%{assigns: %{user: for_user}} = conn, %{"id" => id}) do
-    with %User{} = user <- Repo.get(User, id) do
+    with %User{} = user <- Repo.get(User, id),
+         true <- User.auth_active?(user) || user.id == for_user.id || User.superuser?(for_user) do
       account = AccountView.render("account.json", %{user: user, for: for_user})
       json(conn, account)
     else

diff --git a/lib/pleroma/web/twitter_api/twitter_api_controller.ex b/lib/pleroma/web/twitter_api/twitter_api_controller.ex
index b362f39466eee843822ffc5fa510d9972e192141..e047ed0add186ca87a813c7d21222e3a7006d91d 100644 (file)
--- a/lib/pleroma/web/twitter_api/twitter_api_controller.ex
+++ b/lib/pleroma/web/twitter_api/twitter_api_controller.ex
@@ -97,10 +97,13 @@ defmodule Pleroma.Web.TwitterAPI.Controller do
   end
 
   def show_user(conn, params) do
-    with {:ok, shown} <- TwitterAPI.get_user(params) do
+    for_user = conn.assigns.user
+
+    with {:ok, shown} <- TwitterAPI.get_user(params),
+         true <- User.auth_active?(shown) || for_user && (for_user.id == shown.id || User.superuser?(for_user)) do
       params =
-        if user = conn.assigns.user do
-          %{user: shown, for: user}
+        if for_user do
+          %{user: shown, for: for_user}
         else
           %{user: shown}
         end
@@ -111,6 +114,11 @@ defmodule Pleroma.Web.TwitterAPI.Controller do
     else
       {:error, msg} ->
         bad_request_reply(conn, msg)
+
+      false ->
+        conn
+        |> put_status(404)
+        |> json(%{error: "Unconfirmed user"})
     end
   end