From: David Yip <yipdw@member.fsf.org>
Date: Fri, 17 Nov 2017 15:07:21 +0000 (-0600)
Subject: Update StatusPolicy to check current_account for local_only? toots.
X-Git-Url: https://git.xn--scling-oua.cat.family/?a=commitdiff_plain;h=f6355f6ffb124ffe3a9e7339543a4f7ac7c0905a;p=mastodon.git

Update StatusPolicy to check current_account for local_only? toots.

StatusPolicy#account was renamed to StatusPolicy#current_account in
upstream.  This commit renames the local-only changes to match and
augments the #show? policy spec with what we expect for local-only
toots.
---

diff --git a/app/policies/status_policy.rb b/app/policies/status_policy.rb
index 8e0c1eef1..369ede2b0 100644
--- a/app/policies/status_policy.rb
+++ b/app/policies/status_policy.rb
@@ -6,7 +6,7 @@ class StatusPolicy < ApplicationPolicy
   end
 
   def show?
-    return false if local_only? && account.nil?
+    return false if local_only? && current_account.nil?
 
     if direct?
       owned? || record.mentions.where(account: current_account).exists?
diff --git a/spec/policies/status_policy_spec.rb b/spec/policies/status_policy_spec.rb
index bacb8fd9e..a90e22aad 100644
--- a/spec/policies/status_policy_spec.rb
+++ b/spec/policies/status_policy_spec.rb
@@ -71,6 +71,12 @@ RSpec.describe StatusPolicy, type: :model do
 
       expect(subject).to_not permit(viewer, status)
     end
+
+    it 'denies access when local-only and the viewer is not logged in' do
+      allow(status).to receive(:local_only?) { true }
+
+      expect(subject).to_not permit(nil, status)
+    end
   end
 
   permissions :reblog? do