Disallow remote users from viewing local-only toots

6 years ago · c4bec9263c
parent 9f2945ef80
commit c4bec9263c
1 changed files with 1 additions and 1 deletions
--- a/app/policies/status_policy.rb
+++ b/app/policies/status_policy.rb
@ -12,7 +12,7 @@ class StatusPolicy < ApplicationPolicy
  end

  def show?
-    return false if local_only? && current_account.nil?
+    return false if local_only? && (current_account.nil? || !current_account.local?)

    if direct?
      owned? || mention_exists?