Restricted Following to Owners

TryGhost · Jul 10, 2024 · 342e4b3 · 342e4b3
1 parent e40b448
commit 342e4b3
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/src/handlers.ts b/src/handlers.ts
@@ -43,6 +43,11 @@ async function postToArticle(ctx: RequestContext<ContextData>, post: any) {
 export async function followAction(
     ctx: Context<{ Variables: HonoContextVariables }>,
 ) {
+    if (ctx.get('role') !== 'Owner') {
+        return new Response(null, {
+            status: 403
+        });
+    }
     const handle = ctx.req.param('handle');
     const actorToFollow = await lookupObject(handle);
     if (!isActor(actorToFollow)) {