X-Git-Url: https://git.logografos.com/?a=blobdiff_plain;f=lib%2Fpleroma%2Fweb%2Fcommon_api.ex;h=44eb00075ee694005241c1eabfbb846e4668d665;hb=a127041c8b3e31c9fa487dd5ca4faa29a0a59e6e;hp=89cc0d6fe82acfd418e8e5928bc4b44d72b17f79;hpb=40bfe7919694619570c3e2192dff895c78ce44b9;p=anni

diff --git a/lib/pleroma/web/common_api.ex b/lib/pleroma/web/common_api.ex
old mode 100644
new mode 100755
index 89cc0d6..44eb000
--- a/lib/pleroma/web/common_api.ex
+++ b/lib/pleroma/web/common_api.ex
@@ -33,6 +33,7 @@ defmodule Pleroma.Web.CommonAPI do
 
   def post_chat_message(%User{} = user, %User{} = recipient, content, opts \\ []) do
     with maybe_attachment <- opts[:media_id] && Object.get_by_id(opts[:media_id]),
+         :ok <- validate_chat_attachment_attribution(maybe_attachment, user),
          :ok <- validate_chat_content_length(content, !!maybe_attachment),
          {_, {:ok, chat_message_data, _meta}} <-
            {:build_object,
@@ -71,6 +72,17 @@ defmodule Pleroma.Web.CommonAPI do
     text
   end
 
+  defp validate_chat_attachment_attribution(nil, _), do: :ok
+
+  defp validate_chat_attachment_attribution(attachment, user) do
+    with :ok <- Object.authorize_access(attachment, user) do
+      :ok
+    else
+      e ->
+        e
+    end
+  end
+
   defp validate_chat_content_length(_, true), do: :ok
   defp validate_chat_content_length(nil, false), do: {:error, :no_content}