Followers and circle members may like, react, vote and downvote
LikeHandler.MaySee let a remote account interact with a followers-only post only when the post named it in to, cc or its mentions. Our own followers-only posts are addressed to the followers collection, never to each follower, and circle posts were not considered at all, so every like, reaction, downvote and poll vote from a follower on a followers-only post, and from a member on a circle post, was dropped as "not-visible". Likes, dislikes, reactions and poll votes now ask VisibilityPolicy.RemoteCanSee: anyone for public and unlisted posts, an addressed account for a DM, an accepted follower or an addressed account for followers-only, a foreign member for a circle post, and never a server's instance actor (SignedFetchAuthorizer's alias is for refetches only). Found by planning the town's multi-server interaction checks (G-0001). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw
This commit is contained in:
1 parent
436f7da464
commit
128ff89426
6 files changed
+99
-11
No files matched your search
@@ -1,6 +1,7 @@
|
||||
using MongoDB.Driver;
|
||||
using MongoDB.Entities;
|
||||
|
||||
using PrivaPub.Domain.Privacy;
|
||||
using PrivaPub.Domain.Social;
|
||||
using PrivaPub.Federation.Actors;
|
||||
using PrivaPub.Federation.Inbox.Handlers;
|
||||
@@ -120,7 +121,7 @@ namespace PrivaPub.Domain.Statuses
|
||||
public async Task Receive(PostEntity post, ForeignAvatar voter, string choice, string activityId, CancellationToken token)
|
||||
{
|
||||
var poll = post.Poll;
|
||||
if (poll == default || post.IsFederatedCopy || Ended(poll) || !LikeHandler.MaySee(post, voter))
|
||||
if (poll == default || post.IsFederatedCopy || Ended(poll) || !await VisibilityPolicy.RemoteCanSee(post, voter, token))
|
||||
return;
|
||||
var index = poll.Options.FindIndex(o => o.Title == choice);
|
||||
if (index < 0)
|
||||
|
||||
Reference in new issue
Block a user