Fix leak of arbitrary statuses through unfavourite action in REST API (#13161)
This commit is contained in:
parent
7face973fa
commit
0c28a505dd
8 changed files with 203 additions and 124 deletions
|
@ -66,8 +66,7 @@ class Api::V1::Statuses::RebloggedByAccountsController < Api::BaseController
|
|||
@status = Status.find(params[:status_id])
|
||||
authorize @status, :show?
|
||||
rescue Mastodon::NotPermittedError
|
||||
# Reraise in order to get a 404 instead of a 403 error code
|
||||
raise ActiveRecord::RecordNotFound
|
||||
not_found
|
||||
end
|
||||
|
||||
def pagination_params(core_params)
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue