From 76fdfd1c7f10332783ef167b7b996edd4813b1c3 Mon Sep 17 00:00:00 2001
From: Sadposter <hannah+pleroma@coffee-and-dreams.uk>
Date: Sun, 7 Apr 2019 15:11:29 +0100
Subject: [PATCH] Add check on activity visibility in sub notification

---
 lib/pleroma/web/common_api/utils.ex |  4 +++-
 test/notification_test.exs          | 12 ++++++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/lib/pleroma/web/common_api/utils.ex b/lib/pleroma/web/common_api/utils.ex
index 4e0a6b2d9..a450a70c3 100644
--- a/lib/pleroma/web/common_api/utils.ex
+++ b/lib/pleroma/web/common_api/utils.ex
@@ -12,6 +12,7 @@ defmodule Pleroma.Web.CommonAPI.Utils do
   alias Pleroma.Repo
   alias Pleroma.User
   alias Pleroma.Web.ActivityPub.Utils
+  alias Pleroma.Web.ActivityPub.Visibility
   alias Pleroma.Web.Endpoint
   alias Pleroma.Web.MediaProxy
 
@@ -337,13 +338,14 @@ def maybe_notify_mentioned_recipients(recipients, _), do: recipients
 
   def maybe_notify_subscribers(
         recipients,
-        %Activity{data: %{"actor" => actor, "type" => type}}
+        %Activity{data: %{"actor" => actor, "type" => type}} = activity
       )
       when type == "Create" do
     with %User{} = user <- User.get_by_ap_id(actor) do
       subscriber_ids =
         user
         |> User.subscribers()
+        |> Enum.filter(&Visibility.visible_for_user?(activity, &1))
         |> Enum.map(& &1.ap_id)
 
       recipients ++ subscriber_ids
diff --git a/test/notification_test.exs b/test/notification_test.exs
index 8109623af..5727620c9 100644
--- a/test/notification_test.exs
+++ b/test/notification_test.exs
@@ -106,6 +106,18 @@ test "it doesn't create duplicate notifications for follow+subscribed users" do
       {:ok, status} = TwitterAPI.create_status(user, %{"status" => "Akariiiin"})
       {:ok, [_notif]} = Notification.create_notifications(status)
     end
+
+    test "it doesn't create subscription notifications if the recipient cannot see the status" do
+      user = insert(:user)
+      subscriber = insert(:user)
+
+      User.subscribe(subscriber, user)
+
+      {:ok, status} =
+        TwitterAPI.create_status(user, %{"status" => "inwisible", "visibility" => "direct"})
+
+      assert {:ok, []} == Notification.create_notifications(status)
+    end
   end
 
   describe "get notification" do