Merge pull request #3620 from pixelfed/staging

Staging

CHANGELOG.md

@@ -54,6 +54,7 @@
 - Add configuration to v1/instance endpoint. Fixes #3605 ([2fb18b7d](https://github.com/pixelfed/pixelfed/commit/2fb18b7d))
 - Fix remote account post counts ([149cf9dc](https://github.com/pixelfed/pixelfed/commit/149cf9dc))
 - Enforce blocks on incoming likes, shares, replies and follows on all endpoints ([1545e37c](https://github.com/pixelfed/pixelfed/commit/1545e37c))
+- Fix unlisted post web redirect and api response ([6033d837](https://github.com/pixelfed/pixelfed/commit/6033d837))
 -  ([](https://github.com/pixelfed/pixelfed/commit/))
 
 ## [v0.11.3 (2022-05-09)](https://github.com/pixelfed/pixelfed/compare/v0.11.2...v0.11.3)

app/Http/Controllers/PublicApiController.php

@@ -118,7 +118,9 @@ class PublicApiController extends Controller
         $status = Status::whereProfileId($profile->id)->findOrFail($postid);
         $this->scopeCheck($profile, $status);
         if(!$request->user()) {
-            $res = ['status' => StatusService::get($status->id)];
+            $cached = StatusService::get($status->id, false);
+            abort_if(!in_array($cached['visibility'], ['public', 'unlisted']), 403);
+            $res = ['status' => $cached];
         } else {
             $item = new Fractal\Resource\Item($status, new StatusStatelessTransformer());
             $res = [

app/Http/Controllers/SpaController.php

@@ -27,7 +27,11 @@ class SpaController extends Controller
 			return view('layouts.spa');
 		}
 
-		$post = StatusService::get($id);
+		$post = StatusService::get($id, false);
+
+		if($post && !in_array($post['visibility'], ['public', 'unlisted'])) {
+			return redirect('/login');
+		}
 
 		if(
 			$post &&

app/Util/Sentiment/Bouncer.php

@@ -6,6 +6,7 @@ use App\AccountInterstitial;
 use App\Status;
 use Cache;
 use Illuminate\Support\Str;
+use App\Services\StatusService;
 
 class Bouncer {
 
@@ -134,6 +135,8 @@ class Bouncer {
 		// $status->is_nsfw = true;
 		$status->save();
 
+		StatusService::del($status->id);
+
 		Cache::forget('pf:bouncer_v0:exemption_by_pid:' . $status->profile_id);
 		Cache::forget('pf:bouncer_v0:recent_by_pid:' . $status->profile_id);
 	}