From: Eugen Rochko <eugen@zeonfederated.com>
Date: Wed, 2 Mar 2022 17:57:26 +0000 (+0100)
Subject: Fix leak of existence of otherwise inaccessible statuses in REST API (#17684)
X-Git-Url: https://git.xn--scling-oua.cat.family/?a=commitdiff_plain;h=e24b14cc74034585b29ca92bbb9623df32328bf3;p=mastodon.git

Fix leak of existence of otherwise inaccessible statuses in REST API (#17684)
---

diff --git a/app/controllers/api/v1/statuses_controller.rb b/app/controllers/api/v1/statuses_controller.rb
index 2d82a7a99..f48aeb945 100644
--- a/app/controllers/api/v1/statuses_controller.rb
+++ b/app/controllers/api/v1/statuses_controller.rb
@@ -92,8 +92,9 @@ class Api::V1::StatusesController < Api::BaseController
   end
 
   def set_thread
-    @thread = status_params[:in_reply_to_id].blank? ? nil : Status.find(status_params[:in_reply_to_id])
-  rescue ActiveRecord::RecordNotFound
+    @thread = Status.find(status_params[:in_reply_to_id]) if status_params[:in_reply_to_id].present?
+    authorize(@thread, :show?) if @thread.present?
+  rescue ActiveRecord::RecordNotFound, Mastodon::NotPermittedError
     render json: { error: I18n.t('statuses.errors.in_reply_not_found') }, status: 404
   end