From 32987004c95aebfc390b7cd9e93d9a386095c0a0 Mon Sep 17 00:00:00 2001 From: William Pitcock Date: Fri, 24 Nov 2017 18:36:08 -0600 Subject: [PATCH] status: preserve visibility attribute when reblogging (infoleak fix) (#5789) this should fix *all* remaining visibility-related mastodon ostatus infoleaks. thanks to @csaurus@gnusocial.de for pointing out the infoleak. --- app/models/status.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/app/models/status.rb b/app/models/status.rb index d6810941a6..8579ff9e45 100644 --- a/app/models/status.rb +++ b/app/models/status.rb @@ -278,6 +278,7 @@ class Status < ApplicationRecord def set_visibility self.visibility = (account.locked? ? :private : :public) if visibility.nil? + self.visibility = reblog.visibility if reblog? self.sensitive = false if sensitive.nil? end