techhub/mastodon
2
0
Fork 0
Code Activity

Prevent creation of Private Mentions quoting someone who is not mentioned (#36689)

Browse Source
This commit is contained in:
Claire
2025-11-03 15:16:25 +01:00
parent 16a54f7158
commit 05964f571b
3 changed files with 56 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
spec/requests/api/v1/statuses_spec.rb
View File

@@ -228,7 +228,7 @@ RSpec.describe '/api/v1/statuses' do
end
context 'with a self-quote post' do
let(:quoted_status) { Fabricate(:status, account: user.account) }
let!(:quoted_status) { Fabricate(:status, account: user.account) }
let(:params) do
{
status: 'Hello world, this is a self-quote',
@@ -237,7 +237,48 @@ RSpec.describe '/api/v1/statuses' do
end
it 'returns a quote post, as well as rate limit headers', :aggregate_failures do
subject
expect { subject }.to change(user.account.statuses, :count).by(1)
expect(response).to have_http_status(200)
expect(response.content_type)
.to start_with('application/json')
expect(response.parsed_body[:quote]).to be_present
expect(response.headers['X-RateLimit-Limit']).to eq RateLimiter::FAMILIES[:statuses][:limit].to_s
expect(response.headers['X-RateLimit-Remaining']).to eq (RateLimiter::FAMILIES[:statuses][:limit] - 1).to_s
end
end
context 'with a quote to a non-mentioned user in a Private Mention' do
let!(:quoted_status) { Fabricate(:status, quote_approval_policy: Status::QUOTE_APPROVAL_POLICY_FLAGS[:public] << 16) }
let(:params) do
{
status: 'Hello, this is a quote',
quoted_status_id: quoted_status.id,
visibility: :direct,
}
end
it 'returns an error and does not create a post', :aggregate_failures do
expect { subject }.to_not change(user.account.statuses, :count)
expect(response).to have_http_status(422)
expect(response.content_type)
.to start_with('application/json')
end
end
context 'with a quote to a mentioned user in a Private Mention' do
let!(:quoted_status) { Fabricate(:status, quote_approval_policy: Status::QUOTE_APPROVAL_POLICY_FLAGS[:public] << 16) }
let(:params) do
{
status: "Hello @#{quoted_status.account.acct}, this is a quote",
quoted_status_id: quoted_status.id,
visibility: :direct,
}
end
it 'returns a quote post, as well as rate limit headers', :aggregate_failures do
expect { subject }.to change(user.account.statuses, :count).by(1)
expect(response).to have_http_status(200)
expect(response.content_type)