fix(api): check visibility for group members in groups endpoint

2023-02-12 04:29:11 +00:00
parent b904be939a
commit a39d0c8ab6
1 changed files with 6 additions and 2 deletions
--- a/PluralKit.API/Controllers/v2/GroupControllerV2.cs
+++ b/PluralKit.API/Controllers/v2/GroupControllerV2.cs
@@ -39,7 +39,11 @@ public class GroupControllerV2: PKControllerBase

        if (with_members && j_groups.Count > 0)
        {
-            var q = await _repo.GetGroupMemberInfo(await groups.Select(x => x.Id).ToListAsync());
+            var q = await _repo.GetGroupMemberInfo(await groups
+                .Where(g => g.Visibility.CanAccess(ctx))
+                .Select(x => x.Id)
+                .ToListAsync());
+

            foreach (var row in q)
                if (row.MemberVisibility.CanAccess(ctx))