Silenced users posts still show up when accessed directly

[mrvdb]

The list of posts is correctly blocked, but individual posts are accessible it seems.

This is a partial screenshot of anonymous access to the url of the post. At the very least, the message is wrong.

I haven't tested extensively with all silenced accounts. The 'user account URI' itself is properly not giving any content. (list of posts)

Expected behaviour:

• all users, including anonymous are not able to see any posts of a silenced user
• optionally, make an exception for the admin user, so the post content can be reviewed

[thebaer]

Agreed, on this page we should check the currently authenticated user, and:

• If not logged in, return 404, just like on the silenced user's blog
• If logged in as user and user.ID != post.OwnerID, return 404
• If logged in as user and !user.IsAdmin(), return 404

Anyone should feel free to claim this task and open a pull request for a fix!

[colin-axner]

hello! I'd like to try to tackle this issue