f0ckv2 specifics...

src/inc/routes/comments.mjs

@@ -972,6 +972,15 @@ export default (router, tpl) => {
 
     // Recent Activity Page
     router.get(/\/activity\/?/, async (req, res) => {
+        if (!req.session && cfg.main.hide_comments_from_public) {
+            if (req.url.qs?.json === 'true' || req.headers['x-requested-with'] === 'XMLHttpRequest') {
+                return res.reply({
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ success: true, comments: [], page: 1, hasMore: false, require_login: true })
+                });
+            }
+            return res.reply({ code: 403, body: "Forbidden" });
+        }
         try {
             const page = +(req.url.qs?.page || 1);
             const limit = Math.min(+(req.url.qs?.limit || 50), 50);

src/inc/routes/notifications.mjs

@@ -142,8 +142,9 @@ db.listen('activity', async (payload) => {
             data.username = 'System';
         }
 
-        // Broadcast to ALL connected clients
+        // Broadcast to ALL connected clients (except guests if comments are hidden)
         for (const client of clients) {
+            if (!client.userId && cfg.main.hide_comments_from_public) continue;
             client.send({ type: 'activity', data });
         }
     } catch (e) {