Add test.

lib/pleroma/web/activity_pub/activity_pub.ex

@@ -327,7 +327,7 @@ defp restrict_unlisted(query) do
       activity in query,
       where:
         fragment(
-          "not (?->'cc' \\?| ?)",
+          "(?->'to' \\?| ?)",
           activity.data,
           ^["https://www.w3.org/ns/activitystreams#Public"]
         )

test/web/activity_pub/activity_pub_test.exs

@@ -171,6 +171,16 @@ test "doesn't return blocked activities" do
   end
 
   describe "public fetch activities" do
+    test "doesn't retrieve unlisted activities" do
+      user = insert(:user)
+      {:ok, unlisted_activity} = CommonAPI.post(user, %{"status" => "yeah", "visibility" => "unlisted"})
+      {:ok, listed_activity} = CommonAPI.post(user, %{"status" => "yeah"})
+
+      [activity] = ActivityPub.fetch_public_activities()
+
+      assert activity == listed_activity
+    end
+
     test "retrieves public activities" do
       _activities = ActivityPub.fetch_public_activities()