activitypub: properly filter out transitive activities concerning blocked users

lib/pleroma/web/activity_pub/activity_pub.ex

@@ -712,7 +712,7 @@ defp restrict_blocked(query, %{"blocking_user" => %User{info: info}}) do
     from(
       activity in query,
       where: fragment("not (? = ANY(?))", activity.actor, ^blocks),
-      where: fragment("not (?->'to' \\?| ?)", activity.data, ^blocks),
+      where: fragment("not (? && ?)", activity.recipients, ^blocks),
       where: fragment("not (split_part(?, '/', 3) = ANY(?))", activity.actor, ^domain_blocks)
     )
   end

test/web/activity_pub/activity_pub_test.exs

@@ -341,6 +341,29 @@ test "doesn't return blocked activities" do
     assert Enum.member?(activities, activity_one)
   end
 
+  test "doesn't return transitive interactions concerning blocked users" do
+    blocker = insert(:user)
+    blockee = insert(:user)
+    friend = insert(:user)
+
+    {:ok, blocker} = User.block(blocker, blockee)
+
+    {:ok, activity_one} = CommonAPI.post(friend, %{"status" => "hey!"})
+
+    {:ok, activity_two} = CommonAPI.post(friend, %{"status" => "hey! @#{blockee.nickname}"})
+
+    {:ok, activity_three} = CommonAPI.post(blockee, %{"status" => "hey! @#{friend.nickname}"})
+
+    {:ok, activity_four} = CommonAPI.post(blockee, %{"status" => "hey! @#{blocker.nickname}"})
+
+    activities = ActivityPub.fetch_activities([], %{"blocking_user" => blocker})
+
+    assert Enum.member?(activities, activity_one)
+    refute Enum.member?(activities, activity_two)
+    refute Enum.member?(activities, activity_three)
+    refute Enum.member?(activities, activity_four)
+  end
+
   test "doesn't return muted activities" do
     activity_one = insert(:note_activity)
     activity_two = insert(:note_activity)