commit 15137fc

Only allow logged-in user to use search API

 1@@ -1627,43 +1627,47 @@ int mastoapi_get_handler(const xs_dict *req, const char *q_path,
 2     }
 3     else
 4     if (strcmp(cmd, "/v2/search") == 0) { /** **/
 5-        const char *q      = xs_dict_get(args, "q");
 6-        const char *type   = xs_dict_get(args, "type");
 7-        const char *offset = xs_dict_get(args, "offset");
 8+        if (logged_in) {
 9+            const char *q      = xs_dict_get(args, "q");
10+            const char *type   = xs_dict_get(args, "type");
11+            const char *offset = xs_dict_get(args, "offset");
12 
13-        xs *acl = xs_list_new();
14-        xs *stl = xs_list_new();
15-        xs *htl = xs_list_new();
16-        xs *res = xs_dict_new();
17+            xs *acl = xs_list_new();
18+            xs *stl = xs_list_new();
19+            xs *htl = xs_list_new();
20+            xs *res = xs_dict_new();
21 
22-        if (xs_is_null(offset) || strcmp(offset, "0") == 0) {
23-            /* reply something only for offset 0; otherwise,
24-               apps like Tusky keep asking again and again */
25+            if (xs_is_null(offset) || strcmp(offset, "0") == 0) {
26+                /* reply something only for offset 0; otherwise,
27+                   apps like Tusky keep asking again and again */
28 
29-            if (!xs_is_null(q) && !xs_is_null(type) && strcmp(type, "accounts") == 0) {
30-                /* do a webfinger query */
31-                char *actor = NULL;
32-                char *user  = NULL;
33+                if (!xs_is_null(q) && !xs_is_null(type) && strcmp(type, "accounts") == 0) {
34+                    /* do a webfinger query */
35+                    char *actor = NULL;
36+                    char *user  = NULL;
37 
38-                if (valid_status(webfinger_request(q, &actor, &user))) {
39-                    xs *actor_o = NULL;
40+                    if (valid_status(webfinger_request(q, &actor, &user))) {
41+                        xs *actor_o = NULL;
42 
43-                    if (valid_status(actor_request(&snac1, actor, &actor_o))) {
44-                        xs *acct = mastoapi_account(actor_o);
45+                        if (valid_status(actor_request(&snac1, actor, &actor_o))) {
46+                            xs *acct = mastoapi_account(actor_o);
47 
48-                        acl = xs_list_append(acl, acct);
49+                            acl = xs_list_append(acl, acct);
50+                        }
51                     }
52                 }
53             }
54-        }
55 
56-        res = xs_dict_append(res, "accounts", acl);
57-        res = xs_dict_append(res, "statuses", stl);
58-        res = xs_dict_append(res, "hashtags", htl);
59+            res = xs_dict_append(res, "accounts", acl);
60+            res = xs_dict_append(res, "statuses", stl);
61+            res = xs_dict_append(res, "hashtags", htl);
62 
63-        *body  = xs_json_dumps_pp(res, 4);
64-        *ctype = "application/json";
65-        status = 200;
66+            *body  = xs_json_dumps_pp(res, 4);
67+            *ctype = "application/json";
68+            status = 200;
69+        }
70+        else
71+            status = 401;
72     }
73 
74     /* user cleanup */