.circleci
.dependabot
.github
app
chewy
controllers
activitypub
admin
api
v1
accounts
admin
apps
instances
lists
polls
push
statuses
timelines
accounts_controller.rb
apps_controller.rb
blocks_controller.rb
conversations_controller.rb
custom_emojis_controller.rb
domain_blocks_controller.rb
endorsements_controller.rb
favourites_controller.rb
filters_controller.rb
follow_requests_controller.rb
instances_controller.rb
lists_controller.rb
media_controller.rb
mutes_controller.rb
notifications_controller.rb
polls_controller.rb
preferences_controller.rb
reports_controller.rb
scheduled_statuses_controller.rb
search_controller.rb
statuses_controller.rb
streaming_controller.rb
suggestions_controller.rb
v2
web
base_controller.rb
oembed_controller.rb
proofs_controller.rb
auth
concerns
oauth
settings
well_known
about_controller.rb
account_follow_controller.rb
account_unfollow_controller.rb
accounts_controller.rb
application_controller.rb
authorize_interactions_controller.rb
custom_css_controller.rb
directories_controller.rb
emojis_controller.rb
filters_controller.rb
follower_accounts_controller.rb
following_accounts_controller.rb
home_controller.rb
instance_actors_controller.rb
intents_controller.rb
invites_controller.rb
manifests_controller.rb
media_controller.rb
media_proxy_controller.rb
public_timelines_controller.rb
relationships_controller.rb
remote_follow_controller.rb
remote_interaction_controller.rb
shares_controller.rb
statuses_controller.rb
tags_controller.rb
helpers
javascript
lib
mailers
models
policies
presenters
serializers
services
validators
views
workers
bin
config
db
dist
lib
log
nanobox
public
spec
streaming
vendor
.buildpacks
.codeclimate.yml
.dockerignore
.editorconfig
.env.nanobox
.env.production.sample
.env.test
.env.vagrant
.eslintignore
.eslintrc.js
.foreman
.gitattributes
.gitignore
.haml-lint.yml
.nanoignore
.nvmrc
.profile
.rspec
.rubocop.yml
.ruby-version
.sass-lint.yml
.slugignore
.yarnclean
AUTHORS.md
Aptfile
CHANGELOG.md
CODE_OF_CONDUCT.md
CONTRIBUTING.md
Capfile
Dockerfile
Gemfile
Gemfile.lock
LICENSE
Procfile
Procfile.dev
README.md
Rakefile
Vagrantfile
app.json
babel.config.js
boxfile.yml
config.ru
crowdin.yml
docker-compose.yml
package.json
postcss.config.js
priv-config
scalingo.json
yarn.lock
48fee1a800
* Fix poll API not requiring authentication on non-public polls That API does not reveal the content of the status, i.e. the question itself, nor who the author is, nor which status it belongs to, but it does reveal the poll options and how many answers they got Fix #10959 * Add test
29 lines
702 B
Ruby
29 lines
702 B
Ruby
# frozen_string_literal: true
|
|
|
|
class Api::V1::PollsController < Api::BaseController
|
|
include Authorization
|
|
|
|
before_action -> { authorize_if_got_token! :read, :'read:statuses' }, only: :show
|
|
before_action :set_poll
|
|
before_action :refresh_poll
|
|
|
|
respond_to :json
|
|
|
|
def show
|
|
render json: @poll, serializer: REST::PollSerializer, include_results: true
|
|
end
|
|
|
|
private
|
|
|
|
def set_poll
|
|
@poll = Poll.attached.find(params[:id])
|
|
authorize @poll.status, :show?
|
|
rescue Mastodon::NotPermittedError
|
|
raise ActiveRecord::RecordNotFound
|
|
end
|
|
|
|
def refresh_poll
|
|
ActivityPub::FetchRemotePollService.new.call(@poll, current_account) if user_signed_in? && @poll.possibly_stale?
|
|
end
|
|
end
|