Fix potential private status leak (mastodon#10969)

vulpineclub · Nov 19, 2019 · 86d8fba · 86d8fba
1 parent 43007ae
commit 86d8fba
Showing 1 changed file with 1 addition and 4 deletions.
diff --git a/app/controllers/statuses_controller.rb b/app/controllers/statuses_controller.rb
@@ -30,9 +30,7 @@ class StatusesController < ApplicationController
   def show
     respond_to do |format|
       format.html do
-        use_pack 'public'
-
-        unless user_signed_in?
+        if current_account.nil?
           skip_session!
           expires_in 10.seconds, public: true
         end
@@ -64,7 +62,6 @@ def activity
   end
 
   def embed
-    use_pack 'embed'
     raise ActiveRecord::RecordNotFound if @status.hidden?
 
     skip_session!