view app/controllers/tweets_controller.rb @ 235:4222343d9433 legit-client

No access to protected user
author nanaya <me@nanaya.net>
date Fri, 14 Jul 2023 22:43:40 +0900
parents 7a773720d81f
children
line wrap: on
line source

class TweetsController < ApplicationController
  def index
    return redirect if params[:name].present?
  end

  def show
    return redirect if params[:id][/\D/].present?

    @user = CachedFetch.user_by_id params[:id]

    if @user.nil?
      head :not_found
      return
    end

    if @user[:protected]
      head :forbidden
      return
    end

    return redirect if normalized_screen_name != params[:name]

    @tweets = CachedFetch.timeline params[:id]

    head :not_found if @tweets.nil?
  end

  def redirect
    @user ||= CachedFetch.user_by_username(params[:name])

    if @user.nil?
      head :not_found
    else
      redirect_to tweet_path(@user[:id], normalized_screen_name)
    end
  end

  private

  def normalized_screen_name
    @user[:username].presence || '_'
  end
end