From 36fa5e8802b45bdaee048dd63065d8e73142e52b Mon Sep 17 00:00:00 2001
From: scarlett <nia@netbsd.org>
Date: Mon, 7 Jan 2019 10:30:30 +0000
Subject: [PATCH 1/2] Check visible_for_user when performing a search using a
 direct link.

---
 .../web/mastodon_api/mastodon_api_controller.ex     | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
index 95d0f849c..f739e8f7d 100644
--- a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
+++ b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
@@ -725,11 +725,14 @@ def unblock_domain(%{assigns: %{user: blocker}} = conn, %{"domain" => domain}) d
     json(conn, %{})
   end
 
-  def status_search(query) do
+  def status_search(user, query) do
     fetched =
       if Regex.match?(~r/https?:/, query) do
-        with {:ok, object} <- ActivityPub.fetch_object_from_id(query) do
-          [Activity.get_create_activity_by_object_ap_id(object.data["id"])]
+        with {:ok, object} <- ActivityPub.fetch_object_from_id(query),
+             %Activity{} = activity <-
+               Activity.get_create_activity_by_object_ap_id(object.data["id"]),
+             true <- ActivityPub.visible_for_user?(activity, user) do
+          [activity]
         else
           _e -> []
         end
@@ -756,7 +759,7 @@ def status_search(query) do
   def search2(%{assigns: %{user: user}} = conn, %{"q" => query} = params) do
     accounts = User.search(query, params["resolve"] == "true")
 
-    statuses = status_search(query)
+    statuses = status_search(user, query)
 
     tags_path = Web.base_url() <> "/tag/"
 
@@ -780,7 +783,7 @@ def search2(%{assigns: %{user: user}} = conn, %{"q" => query} = params) do
   def search(%{assigns: %{user: user}} = conn, %{"q" => query} = params) do
     accounts = User.search(query, params["resolve"] == "true")
 
-    statuses = status_search(query)
+    statuses = status_search(user, query)
 
     tags =
       String.split(query)

From 7dcafb4894006bd9f531403fe585ec4938d4de12 Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Mon, 7 Jan 2019 13:13:37 +0100
Subject: [PATCH 2/2] MastoAPI: Add test.

---
 .../mastodon_api_controller_test.exs           | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/test/web/mastodon_api/mastodon_api_controller_test.exs b/test/web/mastodon_api/mastodon_api_controller_test.exs
index 0136acf8c..ce87010c8 100644
--- a/test/web/mastodon_api/mastodon_api_controller_test.exs
+++ b/test/web/mastodon_api/mastodon_api_controller_test.exs
@@ -1312,6 +1312,24 @@ test "search fetches remote statuses", %{conn: conn} do
     end)
   end
 
+  test "search doesn't show statuses that it shouldn't", %{conn: conn} do
+    {:ok, activity} =
+      CommonAPI.post(insert(:user), %{
+        "status" => "This is about 2hu, but private",
+        "visibility" => "private"
+      })
+
+    capture_log(fn ->
+      conn =
+        conn
+        |> get("/api/v1/search", %{"q" => activity.data["object"]["id"]})
+
+      assert results = json_response(conn, 200)
+
+      [] = results["statuses"]
+    end)
+  end
+
   test "search fetches remote accounts", %{conn: conn} do
     conn =
       conn