From 8f5212e453f7d20d1422fe5715e66d0b4a4610de Mon Sep 17 00:00:00 2001 From: Hazelnoot Date: Tue, 10 Jun 2025 19:56:36 -0400 Subject: [PATCH] enforce DM visibility in notes/mentions --- packages/backend/src/server/api/endpoints/notes/mentions.ts | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/packages/backend/src/server/api/endpoints/notes/mentions.ts b/packages/backend/src/server/api/endpoints/notes/mentions.ts index a52f35cde6..f30e5a583f 100644 --- a/packages/backend/src/server/api/endpoints/notes/mentions.ts +++ b/packages/backend/src/server/api/endpoints/notes/mentions.ts @@ -79,14 +79,13 @@ export default class extends Endpoint { // eslint- , 'source') .innerJoin(MiNote, 'note', 'note.id = source.id'); - // Mentioned or visible users can always access - //this.queryService.generateVisibilityQuery(query, me); + this.queryService.generateVisibilityQuery(qb, me); this.queryService.generateBlockedHostQueryForNote(qb); this.queryService.generateMutedUserQueryForNotes(qb, me); this.queryService.generateMutedNoteThreadQuery(qb, me); this.queryService.generateBlockedUserQueryForNotes(qb, me); // A renote can't mention a user, so it will never appear here anyway. - //this.queryService.generateMutedUserRenotesQueryForNotes(query, me); + //this.queryService.generateMutedUserRenotesQueryForNotes(qb, me); if (ps.visibility) { qb.andWhere('note.visibility = :visibility', { visibility: ps.visibility });