Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Can still interact with an account that has blocked you via the API #1374

Closed
0xunusedusername opened this issue Jul 23, 2023 · 0 comments · Fixed by #1378
Closed

Can still interact with an account that has blocked you via the API #1374

0xunusedusername opened this issue Jul 23, 2023 · 0 comments · Fixed by #1378
Labels
bug Something isn't working

Comments

@0xunusedusername
Copy link

0xunusedusername commented Jul 23, 2023

Describe the bug

Right now, if an account has blocked you on Bluesky, you can still interact with that account's posts if you have the post URI. Tested all types of record creation (like, reply, repost, quote post) and they all posted successfully and are visible on the timeline. While the first three are still not visible to the account that did the blocking, I am worried that the quote post functioning is a viable harassment vector.

Expected behavior

Ideally, the block should prevent these functions from resolving. I think either the PDS should have logic that prevents these records from being created, or the AppView can prevent these records from being displayed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant