fix: #11512, filter by cid

src/groups/posts.js

@@ -1,7 +1,6 @@
 'use strict';
 
 const db = require('../database');
-const groups = require('.');
 const privileges = require('../privileges');
 const posts = require('../posts');
 
@@ -15,15 +14,15 @@ module.exports = function (Groups) {
 		groupNames = groupNames[0];
 
 		// Only process those groups that have the cid in its memberPostCids setting (or no setting at all)
-		const groupData = await groups.getGroupsFields(groupNames, ['memberPostCids']);
+		const groupData = await Groups.getGroupsFields(groupNames, ['memberPostCids']);
 		groupNames = groupNames.filter((groupName, idx) => (
 			!groupData[idx].memberPostCidsArray.length ||
 			groupData[idx].memberPostCidsArray.includes(postData.cid)
 		));
 
 		const keys = groupNames.map(groupName => `group:${groupName}:member:pids`);
 		await db.sortedSetsAdd(keys, postData.timestamp, postData.pid);
-		await Promise.all(groupNames.map(name => truncateMemberPosts(name)));
+		await Promise.all(groupNames.map(truncateMemberPosts));
 	};
 
 	async function truncateMemberPosts(groupName) {
@@ -37,8 +36,13 @@ module.exports = function (Groups) {
 	}
 
 	Groups.getLatestMemberPosts = async function (groupName, max, uid) {
-		let pids = await db.getSortedSetRevRange(`group:${groupName}:member:pids`, 0, max - 1);
-		pids = await privileges.posts.filter('topics:read', pids, uid);
-		return await posts.getPostSummaryByPids(pids, uid, { stripTags: false });
+		const [allPids, groupData] = await Promise.all([
+			db.getSortedSetRevRange(`group:${groupName}:member:pids`, 0, max - 1),
+			Groups.getGroupFields(groupName, ['memberPostCids']),
+		]);
+		const cids = groupData.memberPostCidsArray;
+		const pids = await privileges.posts.filter('topics:read', allPids, uid);
+		const postData = await posts.getPostSummaryByPids(pids, uid, { stripTags: false });
+		return postData.filter(p => p && p.topic && (!cids.length || cids.includes(p.topic.cid)));
 	};
 };