ActivityPub.ex: do not return boosted statuses from blocked users.

lib/pleroma/web/activity_pub/activity_pub.ex

@@ -307,7 +307,10 @@ defp restrict_recent(query, _) do
 
   defp restrict_blocked(query, %{"blocking_user" => %User{info: info}}) do
     blocks = info["blocks"] || []
-    from(activity in query, where: fragment("not (? = ANY(?))", activity.actor, ^blocks))
+    from(activity in query,
+      where: fragment("not (? = ANY(?))", activity.actor, ^blocks),
+      where: fragment("not (?->'to' \\?| ?)", activity.data, ^blocks)
+    )
   end
 
   defp restrict_blocked(query, _), do: query

test/web/activity_pub/activity_pub_test.exs

@@ -2,6 +2,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubTest do
   use Pleroma.DataCase
   alias Pleroma.Web.ActivityPub.ActivityPub
   alias Pleroma.Web.ActivityPub.Utils
+  alias Pleroma.Web.CommonAPI
   alias Pleroma.{Activity, Object, User}
   alias Pleroma.Builders.ActivityBuilder
 
@@ -128,12 +129,15 @@ test "retrieves activities that have a given context" do
   test "doesn't return blocked activities" do
     activity_one = insert(:note_activity)
     activity_two = insert(:note_activity)
+    activity_three = insert(:note_activity)
     user = insert(:user)
+    booster = insert(:user)
     {:ok, user} = User.block(user, %{ap_id: activity_one.data["actor"]})
 
     activities = ActivityPub.fetch_activities([], %{"blocking_user" => user})
 
     assert Enum.member?(activities, activity_two)
+    assert Enum.member?(activities, activity_three)
     refute Enum.member?(activities, activity_one)
 
     {:ok, user} = User.unblock(user, %{ap_id: activity_one.data["actor"]})
@@ -141,11 +145,26 @@ test "doesn't return blocked activities" do
     activities = ActivityPub.fetch_activities([], %{"blocking_user" => user})
 
     assert Enum.member?(activities, activity_two)
+    assert Enum.member?(activities, activity_three)
+    assert Enum.member?(activities, activity_one)
+
+    {:ok, user} = User.block(user, %{ap_id: activity_three.data["actor"]})
+    {:ok, _announce, %{data: %{"id" => id}}} = CommonAPI.repeat(activity_three.id, booster)
+    %Activity{} = boost_activity = Activity.get_create_activity_by_object_ap_id(id)
+    activity_three = Repo.get(Activity, activity_three.id)
+
+    activities = ActivityPub.fetch_activities([], %{"blocking_user" => user})
+
+    assert Enum.member?(activities, activity_two)
+    refute Enum.member?(activities, activity_three)
+    refute Enum.member?(activities, boost_activity)
     assert Enum.member?(activities, activity_one)
 
     activities = ActivityPub.fetch_activities([], %{"blocking_user" => nil})
 
     assert Enum.member?(activities, activity_two)
+    assert Enum.member?(activities, activity_three)
+    assert Enum.member?(activities, boost_activity)
     assert Enum.member?(activities, activity_one)
   end