Unfloyded/Legamunt
0
0
Fork 0
Code Activity

Extract authorization policy for viewing statuses (#3150)

Browse source
This commit is contained in:
Jack Jennings 2017-05-29 09:22:22 -07:00 • committed by Eugen Rochko
parent 9a81be0d37
commit 3a2003ba86
16 changed files with 155 additions and 80 deletions
Download patch file Download diff file Expand all files Collapse all files

8
app/controllers/stream_entries_controller.rb
View file

@ -1,6 +1,8 @@
# frozen_string_literal: true
class StreamEntriesController < ApplicationController
include Authorization
layout 'public'
before_action :set_account
@ -42,7 +44,11 @@ class StreamEntriesController < ApplicationController
@stream_entry = @account.stream_entries.where(activity_type: 'Status').find(params[:id])
@type = @stream_entry.activity_type.downcase
raise ActiveRecord::RecordNotFound if @stream_entry.activity.nil? || (@stream_entry.hidden? && !@stream_entry.activity.permitted?(current_account))
raise ActiveRecord::RecordNotFound if @stream_entry.activity.nil?
authorize @stream_entry.activity, :show? if @stream_entry.hidden?
rescue Mastodon::NotPermittedError
# Reraise in order to get a 404
raise ActiveRecord::RecordNotFound
end
def check_account_suspension