From a85ed6defbd2cec71d9a5594ef1de18d5333c7c7 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@FreeBSD.org>
Date: Mon, 31 Aug 2020 15:58:21 -0500
Subject: [PATCH] Do not serve RSS/Atom feeds when instance is private

---
 lib/pleroma/web/feed/tag_controller.ex  | 10 +++++++++-
 lib/pleroma/web/feed/user_controller.ex | 10 +++++++++-
 lib/pleroma/web/metadata/feed.ex        | 20 ++++++++++++--------
 test/web/feed/tag_controller_test.exs   | 13 +++++++++++++
 test/web/feed/user_controller_test.exs  | 16 ++++++++++++++++
 5 files changed, 59 insertions(+), 10 deletions(-)

diff --git a/lib/pleroma/web/feed/tag_controller.ex b/lib/pleroma/web/feed/tag_controller.ex
index 39b2a766a..e090dd625 100644
--- a/lib/pleroma/web/feed/tag_controller.ex
+++ b/lib/pleroma/web/feed/tag_controller.ex
@@ -9,7 +9,15 @@ defmodule Pleroma.Web.Feed.TagController do
   alias Pleroma.Web.ActivityPub.ActivityPub
   alias Pleroma.Web.Feed.FeedView
 
-  def feed(conn, %{"tag" => raw_tag} = params) do
+  def feed(conn, params) do
+    if Pleroma.Config.get!([:instance, :public]) do
+      render_feed(conn, params)
+    else
+      render_error(conn, :not_found, "Not found")
+    end
+  end
+
+  def render_feed(conn, %{"tag" => raw_tag} = params) do
     {format, tag} = parse_tag(raw_tag)
 
     activities =
diff --git a/lib/pleroma/web/feed/user_controller.ex b/lib/pleroma/web/feed/user_controller.ex
index 9cd334a33..595889b9d 100644
--- a/lib/pleroma/web/feed/user_controller.ex
+++ b/lib/pleroma/web/feed/user_controller.ex
@@ -37,7 +37,15 @@ def feed_redirect(conn, %{"nickname" => nickname}) do
     end
   end
 
-  def feed(conn, %{"nickname" => nickname} = params) do
+  def feed(conn, params) do
+    if Pleroma.Config.get!([:instance, :public]) do
+      render_feed(conn, params)
+    else
+      errors(conn, {:error, :not_found})
+    end
+  end
+
+  def render_feed(conn, %{"nickname" => nickname} = params) do
     format = get_format(conn)
 
     format =
diff --git a/lib/pleroma/web/metadata/feed.ex b/lib/pleroma/web/metadata/feed.ex
index bd1459a17..dfe391b56 100644
--- a/lib/pleroma/web/metadata/feed.ex
+++ b/lib/pleroma/web/metadata/feed.ex
@@ -11,13 +11,17 @@ defmodule Pleroma.Web.Metadata.Providers.Feed do
 
   @impl Provider
   def build_tags(%{user: user}) do
-    [
-      {:link,
-       [
-         rel: "alternate",
-         type: "application/atom+xml",
-         href: Helpers.user_feed_path(Endpoint, :feed, user.nickname) <> ".atom"
-       ], []}
-    ]
+    if Pleroma.Config.get!([:instance, :public]) do
+      [
+        {:link,
+         [
+           rel: "alternate",
+           type: "application/atom+xml",
+           href: Helpers.user_feed_path(Endpoint, :feed, user.nickname) <> ".atom"
+         ], []}
+      ]
+    else
+      []
+    end
   end
 end
diff --git a/test/web/feed/tag_controller_test.exs b/test/web/feed/tag_controller_test.exs
index 3c29cd94f..868e40965 100644
--- a/test/web/feed/tag_controller_test.exs
+++ b/test/web/feed/tag_controller_test.exs
@@ -181,4 +181,17 @@ test "gets a feed (RSS)", %{conn: conn} do
              'yeah #PleromaArt'
            ]
   end
+
+  describe "private instance" do
+    setup do: clear_config([:instance, :public])
+
+    test "returns 404 for tags feed", %{conn: conn} do
+      Config.put([:instance, :public], false)
+
+      conn
+      |> put_req_header("accept", "application/rss+xml")
+      |> get(tag_feed_path(conn, :feed, "pleromaart"))
+      |> response(404)
+    end
+  end
 end
diff --git a/test/web/feed/user_controller_test.exs b/test/web/feed/user_controller_test.exs
index 0d2a61967..9a5610baa 100644
--- a/test/web/feed/user_controller_test.exs
+++ b/test/web/feed/user_controller_test.exs
@@ -246,4 +246,20 @@ test "with non-html / non-json format, it returns error when user is not found",
       assert response == ~S({"error":"Not found"})
     end
   end
+
+  describe "private instance" do
+    setup do: clear_config([:instance, :public])
+
+    test "returns 404 for user feed", %{conn: conn} do
+      Config.put([:instance, :public], false)
+      user = insert(:user)
+
+      {:ok, _} = CommonAPI.post(user, %{status: "test"})
+
+      assert conn
+             |> put_req_header("accept", "application/atom+xml")
+             |> get(user_feed_path(conn, :feed, user.nickname))
+             |> response(404)
+    end
+  end
 end