Merge branch 'dtluna/pleroma-bugfix/deny-self-repeats' into develop

lib/pleroma/web/twitter_api/twitter_api_controller.ex

@@ -163,12 +163,17 @@ defmodule Pleroma.Web.TwitterAPI.Controller do
 
   def retweet(%{assigns: %{user: user}} = conn, %{"id" => id}) do
     activity = Repo.get(Activity, id)
+    if activity.data["actor"] == user.ap_id do
+      bad_request_reply(conn, "You cannot repeat your own notice.")
+    else
       {:ok, status} = TwitterAPI.retweet(user, activity)
       response = Poison.encode!(status)
 
       conn
+
       |> json_reply(200, response)
     end
+  end
 
   def register(conn, params) do
     with {:ok, user} <- TwitterAPI.register_user(params) do

test/web/twitter_api/twitter_api_controller_test.exs

@@ -331,11 +331,21 @@ defmodule Pleroma.Web.TwitterAPI.ControllerTest do
     test "with credentials", %{conn: conn, user: current_user} do
       note_activity = insert(:note_activity)
 
-      conn = conn
-      |> with_credentials(current_user.nickname, "test")
-      |> post("/api/statuses/retweet/#{note_activity.id}.json")
+      request_path = "/api/statuses/retweet/#{note_activity.id}.json"
 
-      assert json_response(conn, 200)
+      user = Repo.get_by(User, ap_id: note_activity.data["actor"])
+      response = conn
+      |> with_credentials(user.nickname, "test")
+      |> post(request_path)
+      assert json_response(response, 400) == %{"error" => "You cannot repeat your own notice.",
+                                               "request" => request_path}
+
+      response = conn
+      |> with_credentials(current_user.nickname, "test")
+      |> post(request_path)
+      activity = Repo.get(Activity, note_activity.id)
+      activity_user = Repo.get_by(User, ap_id: note_activity.data["actor"])
+      assert json_response(response, 200) == ActivityRepresenter.to_map(activity, %{user: activity_user, for: current_user})
     end
   end