[bug] repeats are shown broken with restrict_unauthenticated, should be hidden entirely

YokaiRick commented

2023-04-17 20:46:16 +00:00

Version

1f943ce8a5

What were you trying to do?

i want use these restrict_unauthenticated settings:

config :pleroma, :restrict_unauthenticated,
  timelines: %{local: false, federated: true},
  profiles: %{local: false, remote: true},
  activities: %{local: false, remote: true}

This way any not logged in user can see (as intended) my profile and my posts.
But they can also see my repeats, and in a kinda broken way, like in this attached screenshot.

Link to the post: https://outerheaven.club/notice/AUboaPhJm6UOhlOqci

(i used outerheaven, cause i already reverted my settings as a workaround -> currently i let display remote profiles)

What did you expect to happen?

I think they should be hidden completely, cause this kinda dissents the activities: %{local: false, remote: true} setting

What actually happened?

Ppl can see remote posts, in a broken way.

Severity

I cannot use it as easily as I'd like

Have you searched for this issue?

I have double-checked and have not found this issue mentioned anywhere.

### Version 1f943ce8a5e5205637b6f446c7ff4b6fff559454 ### What were you trying to do? i want use these restrict_unauthenticated settings: ``` config :pleroma, :restrict_unauthenticated, timelines: %{local: false, federated: true}, profiles: %{local: false, remote: true}, activities: %{local: false, remote: true} ``` This way any not logged in user can see (as intended) my profile and my posts. But they can also see my repeats, and in a kinda broken way, like in this attached screenshot. Link to the post: https://outerheaven.club/notice/AUboaPhJm6UOhlOqci (i used outerheaven, cause i already reverted my settings as a workaround -> currently i let display remote profiles) ### What did you expect to happen? I think they should be hidden completely, cause this kinda dissents the `activities: %{local: false, remote: true}` setting ### What actually happened? Ppl can see remote posts, in a broken way. ### Severity I cannot use it as easily as I'd like ### Have you searched for this issue? - [x] I have double-checked and have not found this issue mentioned anywhere.

1681763570-grim.png

39 KiB

YokaiRick commented

2023-04-17 20:49:52 +00:00

Author

fun fact, i just discovered the post only loads if i click on the '4days ago' thread link in the same tab. if i open it any other tab it doesn't load as intended 🤔

aka you can reproduce this this way:

set :restrict_unauthenticated settings as above
repeat a remote post
open a private tab, go to your profile, there you see the broken post repeated
if you click on the thread url the broken post opens in the same tab.
if you copy the thread url and open another private tab, past the link, the post doesn't get shown as intended.

hopefully my description isn't too confusing

fun fact, i just discovered the post only loads if i click on the '4days ago' thread link in the same tab. if i open it any other tab it doesn't load as intended 🤔 aka you can reproduce this this way: 1. set :restrict_unauthenticated settings as above 2. repeat a remote post 3. open a private tab, go to your profile, there you see the broken post repeated 4. if you click on the thread url the broken post opens in the same tab. 5. if you copy the thread url and open another private tab, past the link, the post doesn't get shown as intended. hopefully my description isn't too confusing

Mergan added the

Bug

label 2023-04-25 17:51:28 +00:00

XxXCertifiedForkliftDriverXxX commented

2023-06-15 13:08:21 +00:00

Howdy! As a certified forklift driver, I noticed that there seems to be a bug in the Akkoma backend. Specifically, it looks like the API is returning data that it shouldn't be returning. This is an issue that could compromise the security and privacy of users on the fediverse. I recommend moving this issue over to the backend project so developers can take a closer look and figure out what's going on. Let's make sure we get this sorted out to ensure that everyone's information is kept safe and secure. Thanks for reporting this bug!

YokaiRick commented

2023-07-20 20:53:50 +00:00

Author

yeah, i was also not sure if its a frontend or backend issue.. and sorry i misunderstood you, i thought you would move it to the backend repo. i'll do it now

YokaiRick commented

2023-07-20 21:08:43 +00:00

Author

Moved to Backend Issues AkkomaGang/akkoma#597

YokaiRick closed this issue

2023-07-20 21:08:43 +00:00

[bug] repeats are shown broken with restrict_unauthenticated, should be hidden entirely #302

Version

What were you trying to do?

What did you expect to happen?

What actually happened?

Severity

Have you searched for this issue?