0
0
Fork 0

Fix leak of arbitrary statuses through unfavourite action in REST API (#13161)

This commit is contained in:
Eugen Rochko 2020-02-27 12:32:54 +01:00 committed by GitHub
parent 7face973fa
commit 0c28a505dd
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
8 changed files with 203 additions and 124 deletions

View file

@ -66,8 +66,7 @@ class Api::V1::Statuses::RebloggedByAccountsController < Api::BaseController
@status = Status.find(params[:status_id])
authorize @status, :show?
rescue Mastodon::NotPermittedError
# Reraise in order to get a 404 instead of a 403 error code
raise ActiveRecord::RecordNotFound
not_found
end
def pagination_params(core_params)