commit fb5f34b
poesty
·
2023-06-11 04:06:37 +0000 UTC
parent 15137fc
Only allow logged-in user to use statuses API
1 files changed,
+74,
-70
+74,
-70
1@@ -1510,102 +1510,106 @@ int mastoapi_get_handler(const xs_dict *req, const char *q_path,
2 else
3 if (xs_startswith(cmd, "/v1/statuses/")) { /** **/
4 /* information about a status */
5- xs *l = xs_split(cmd, "/");
6- const char *id = xs_list_get(l, 3);
7- const char *op = xs_list_get(l, 4);
8+ if (logged_in) {
9+ xs *l = xs_split(cmd, "/");
10+ const char *id = xs_list_get(l, 3);
11+ const char *op = xs_list_get(l, 4);
12
13- if (!xs_is_null(id)) {
14- xs *msg = NULL;
15- xs *out = NULL;
16+ if (!xs_is_null(id)) {
17+ xs *msg = NULL;
18+ xs *out = NULL;
19
20- /* skip the 'fake' part of the id */
21- id = MID_TO_MD5(id);
22+ /* skip the 'fake' part of the id */
23+ id = MID_TO_MD5(id);
24
25- if (valid_status(object_get_by_md5(id, &msg))) {
26- if (op == NULL) {
27- if (!is_muted(&snac1, xs_dict_get(msg, "attributedTo"))) {
28- /* return the status itself */
29- out = mastoapi_status(&snac1, msg);
30+ if (valid_status(object_get_by_md5(id, &msg))) {
31+ if (op == NULL) {
32+ if (!is_muted(&snac1, xs_dict_get(msg, "attributedTo"))) {
33+ /* return the status itself */
34+ out = mastoapi_status(&snac1, msg);
35+ }
36 }
37- }
38- else
39- if (strcmp(op, "context") == 0) { /** **/
40- /* return ancestors and children */
41- xs *anc = xs_list_new();
42- xs *des = xs_list_new();
43- xs_list *p;
44- xs_str *v;
45- char pid[64];
46+ else
47+ if (strcmp(op, "context") == 0) { /** **/
48+ /* return ancestors and children */
49+ xs *anc = xs_list_new();
50+ xs *des = xs_list_new();
51+ xs_list *p;
52+ xs_str *v;
53+ char pid[64];
54
55- /* build the [grand]parent list, moving up */
56- strncpy(pid, id, sizeof(pid));
57+ /* build the [grand]parent list, moving up */
58+ strncpy(pid, id, sizeof(pid));
59
60- while (object_parent(pid, pid, sizeof(pid))) {
61- xs *m2 = NULL;
62+ while (object_parent(pid, pid, sizeof(pid))) {
63+ xs *m2 = NULL;
64
65- if (valid_status(timeline_get_by_md5(&snac1, pid, &m2))) {
66- xs *st = mastoapi_status(&snac1, m2);
67- anc = xs_list_insert(anc, 0, st);
68+ if (valid_status(timeline_get_by_md5(&snac1, pid, &m2))) {
69+ xs *st = mastoapi_status(&snac1, m2);
70+ anc = xs_list_insert(anc, 0, st);
71+ }
72+ else
73+ break;
74 }
75- else
76- break;
77- }
78
79- /* build the children list */
80- xs *children = object_children(xs_dict_get(msg, "id"));
81- p = children;
82+ /* build the children list */
83+ xs *children = object_children(xs_dict_get(msg, "id"));
84+ p = children;
85
86- while (xs_list_iter(&p, &v)) {
87- xs *m2 = NULL;
88+ while (xs_list_iter(&p, &v)) {
89+ xs *m2 = NULL;
90
91- if (valid_status(timeline_get_by_md5(&snac1, v, &m2))) {
92- if (xs_is_null(xs_dict_get(m2, "name"))) {
93- xs *st = mastoapi_status(&snac1, m2);
94- des = xs_list_append(des, st);
95+ if (valid_status(timeline_get_by_md5(&snac1, v, &m2))) {
96+ if (xs_is_null(xs_dict_get(m2, "name"))) {
97+ xs *st = mastoapi_status(&snac1, m2);
98+ des = xs_list_append(des, st);
99+ }
100 }
101 }
102- }
103
104- out = xs_dict_new();
105- out = xs_dict_append(out, "ancestors", anc);
106- out = xs_dict_append(out, "descendants", des);
107- }
108- else
109- if (strcmp(op, "reblogged_by") == 0 || /** **/
110- strcmp(op, "favourited_by") == 0) { /** **/
111- /* return the list of people who liked or boosted this */
112- out = xs_list_new();
113+ out = xs_dict_new();
114+ out = xs_dict_append(out, "ancestors", anc);
115+ out = xs_dict_append(out, "descendants", des);
116+ }
117+ else
118+ if (strcmp(op, "reblogged_by") == 0 || /** **/
119+ strcmp(op, "favourited_by") == 0) { /** **/
120+ /* return the list of people who liked or boosted this */
121+ out = xs_list_new();
122
123- xs *l = NULL;
124+ xs *l = NULL;
125
126- if (op[0] == 'r')
127- l = object_announces(xs_dict_get(msg, "id"));
128- else
129- l = object_likes(xs_dict_get(msg, "id"));
130+ if (op[0] == 'r')
131+ l = object_announces(xs_dict_get(msg, "id"));
132+ else
133+ l = object_likes(xs_dict_get(msg, "id"));
134
135- xs_list *p = l;
136- xs_str *v;
137+ xs_list *p = l;
138+ xs_str *v;
139
140- while (xs_list_iter(&p, &v)) {
141- xs *actor2 = NULL;
142+ while (xs_list_iter(&p, &v)) {
143+ xs *actor2 = NULL;
144
145- if (valid_status(object_get_by_md5(v, &actor2))) {
146- xs *acct2 = mastoapi_account(actor2);
147+ if (valid_status(object_get_by_md5(v, &actor2))) {
148+ xs *acct2 = mastoapi_account(actor2);
149
150- out = xs_list_append(out, acct2);
151+ out = xs_list_append(out, acct2);
152+ }
153 }
154 }
155 }
156- }
157- else
158- srv_debug(1, xs_fmt("mastoapi status: bad id %s", id));
159+ else
160+ srv_debug(1, xs_fmt("mastoapi status: bad id %s", id));
161
162- if (out != NULL) {
163- *body = xs_json_dumps_pp(out, 4);
164- *ctype = "application/json";
165- status = 200;
166+ if (out != NULL) {
167+ *body = xs_json_dumps_pp(out, 4);
168+ *ctype = "application/json";
169+ status = 200;
170+ }
171 }
172 }
173+ else
174+ status = 401;
175 }
176 else
177 if (strcmp(cmd, "/v1/preferences") == 0) { /** **/