From f32184b23ee87f5fab9987859c19ace3f6f9bedb Mon Sep 17 00:00:00 2001
From: Julian Lam <julian@nodebb.org>
Date: Mon, 2 Dec 2024 16:27:49 -0500
Subject: [PATCH] fix: use fediverse pseudo-user for webfinger privilege checks

---
 src/controllers/well-known.js | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/controllers/well-known.js b/src/controllers/well-known.js
index 93a0839176..7df8d543fc 100644
--- a/src/controllers/well-known.js
+++ b/src/controllers/well-known.js
@@ -31,9 +31,9 @@ Controller.webfinger = async (req, res) => {
 		if (slug === hostname) {
 			response = application(response);
 		} else if (uid) {
-			response = await profile(req.uid, uid, response);
+			response = await profile(uid, response);
 		} else if (cid) {
-			response = await category(req.uid, cid, response);
+			response = await category(cid, response);
 		} else {
 			return res.sendStatus(404);
 		}
@@ -59,8 +59,8 @@ function application(response) {
 	return response;
 }
 
-async function profile(callerUid, uid, response) {
-	const canView = await privileges.global.can('view:users', callerUid);
+async function profile(uid, response) {
+	const canView = await privileges.global.can('view:users', -2);
 	if (!canView) {
 		throw new Error('[[error:no-privileges]]');
 	}
@@ -90,8 +90,8 @@ async function profile(callerUid, uid, response) {
 	return response;
 }
 
-async function category(callerUid, cid, response) {
-	const canFind = await privileges.categories.can('find', cid, callerUid);
+async function category(cid, response) {
+	const canFind = await privileges.categories.can('find', cid, -2);
 	if (!canFind) {
 		throw new Error('[[error:no-privileges]]');
 	}