From 87098d1676b4521f83804c19a94d34f0cd8a8109 Mon Sep 17 00:00:00 2001
From: KokaKiwi <kokakiwi@kokakiwi.net>
Date: Tue, 27 Nov 2018 01:14:43 +0100
Subject: [PATCH] Streamer: Don't send unwanted DMs to list streams

---
 lib/pleroma/web/streamer.ex |   3 +-
 test/web/streamer_test.exs  | 109 +++++++++++++++++++++++++++++++++++-
 2 files changed, 110 insertions(+), 2 deletions(-)

diff --git a/lib/pleroma/web/streamer.ex b/lib/pleroma/web/streamer.ex
index 5cab62c85..306598157 100644
--- a/lib/pleroma/web/streamer.ex
+++ b/lib/pleroma/web/streamer.ex
@@ -73,7 +73,8 @@ def handle_cast(%{action: :stream, topic: "list", item: item}, topics) do
           Pleroma.List.get_lists_from_activity(item)
           |> Enum.filter(fn list ->
             owner = Repo.get(User, list.user_id)
-            author.follower_address in owner.following
+
+            ActivityPub.visible_for_user?(item, owner)
           end)
       end
 
diff --git a/test/web/streamer_test.exs b/test/web/streamer_test.exs
index 47d491d1b..df58441f0 100644
--- a/test/web/streamer_test.exs
+++ b/test/web/streamer_test.exs
@@ -2,7 +2,7 @@ defmodule Pleroma.Web.StreamerTest do
   use Pleroma.DataCase
 
   alias Pleroma.Web.Streamer
-  alias Pleroma.User
+  alias Pleroma.{List, User}
   alias Pleroma.Web.CommonAPI
   import Pleroma.Factory
 
@@ -60,4 +60,111 @@ test "it doesn't send to blocked users" do
 
     Task.await(task)
   end
+
+  test "it doesn't send unwanted DMs to list" do
+    user_a = insert(:user)
+    user_b = insert(:user)
+    user_c = insert(:user)
+
+    {:ok, user_a} = User.follow(user_a, user_b)
+
+    {:ok, list} = List.create("Test", user_a)
+    {:ok, list} = List.follow(list, user_b)
+
+    task =
+      Task.async(fn ->
+        refute_receive {:text, _}, 1_000
+      end)
+
+    fake_socket = %{
+      transport_pid: task.pid,
+      assigns: %{
+        user: user_a
+      }
+    }
+
+    {:ok, activity} =
+      CommonAPI.post(user_b, %{
+        "status" => "@#{user_c.nickname} Test",
+        "visibility" => "direct"
+      })
+
+    topics = %{
+      "list:#{list.id}" => [fake_socket]
+    }
+
+    Streamer.handle_cast(%{action: :stream, topic: "list", item: activity}, topics)
+
+    Task.await(task)
+  end
+
+  test "it doesn't send unwanted private posts to list" do
+    user_a = insert(:user)
+    user_b = insert(:user)
+
+    {:ok, list} = List.create("Test", user_a)
+    {:ok, list} = List.follow(list, user_b)
+
+    task =
+      Task.async(fn ->
+        refute_receive {:text, _}, 1_000
+      end)
+
+    fake_socket = %{
+      transport_pid: task.pid,
+      assigns: %{
+        user: user_a
+      }
+    }
+
+    {:ok, activity} =
+      CommonAPI.post(user_b, %{
+        "status" => "Test",
+        "visibility" => "private"
+      })
+
+    topics = %{
+      "list:#{list.id}" => [fake_socket]
+    }
+
+    Streamer.handle_cast(%{action: :stream, topic: "list", item: activity}, topics)
+
+    Task.await(task)
+  end
+
+  test "it send wanted private posts to list" do
+    user_a = insert(:user)
+    user_b = insert(:user)
+
+    {:ok, user_a} = User.follow(user_a, user_b)
+
+    {:ok, list} = List.create("Test", user_a)
+    {:ok, list} = List.follow(list, user_b)
+
+    task =
+      Task.async(fn ->
+        assert_receive {:text, _}, 1_000
+      end)
+
+    fake_socket = %{
+      transport_pid: task.pid,
+      assigns: %{
+        user: user_a
+      }
+    }
+
+    {:ok, activity} =
+      CommonAPI.post(user_b, %{
+        "status" => "Test",
+        "visibility" => "private"
+      })
+
+    topics = %{
+      "list:#{list.id}" => [fake_socket]
+    }
+
+    Streamer.handle_cast(%{action: :stream, topic: "list", item: activity}, topics)
+
+    Task.await(task)
+  end
 end