liz/PluralKit
liz/PluralKit
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(api): check visibility for group members in groups endpoint

Browse Source
This commit is contained in:
spiral 2023-02-12 04:29:11 +00:00 committed by GitHub
parent b904be939a
commit a39d0c8ab6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
PluralKit.API/Controllers/v2/GroupControllerV2.cs
View File

@ -39,7 +39,11 @@ public class GroupControllerV2: PKControllerBase
if (with_members && j_groups.Count > 0) if (with_members && j_groups.Count > 0)
{ {
var q = await _repo.GetGroupMemberInfo(await groups.Select(x => x.Id).ToListAsync()); var q = await _repo.GetGroupMemberInfo(await groups
.Where(g => g.Visibility.CanAccess(ctx))
.Select(x => x.Id)
.ToListAsync());
foreach (var row in q) foreach (var row in q)
if (row.MemberVisibility.CanAccess(ctx)) if (row.MemberVisibility.CanAccess(ctx))