ghost rider

src/inc/routeinc/f0cklib.mjs

@@ -371,11 +371,12 @@ const buildFeedFilters = async ({
     userHallFilter = db`and items.id in (select uha.item_id from user_halls_assign uha where uha.hall_id = ${userHallObj.id})`;
   }
 
+  const isAdmin = !!session?.admin;
   const isOwnerOrAdmin = (session && user && typeof user === 'string' && session.user && session.user.toLowerCase() === user.toLowerCase()) || (session && (session.admin || session.is_moderator));
-  const visibilityFilter = isOwnerOrAdmin
+  const visibilityFilter = isAdmin
     ? db``
     : (session && session.user
-      ? db`and (coalesce(items.visibility, 0) = 0 or lower(items.username) = ${session.user.toLowerCase()})`
+      ? db`and (coalesce(items.visibility, 0) = 0 or (lower(items.username) = ${session.user.toLowerCase()} and items.visibility != 3))`
       : db`and coalesce(items.visibility, 0) = 0`);
 
   return {
@@ -881,10 +882,11 @@ export default {
 
     // Helper to construct shared filter conditions
     const buildConditions = () => {
-      const visibilityFilter = isOwnerOrAdmin
+      const isAdmin = !!session?.admin;
+      const visibilityFilter = isAdmin
         ? db``
         : (session && session.user
-          ? db`and (coalesce(items.visibility, 0) = 0 or lower(items.username) = ${session.user.toLowerCase()})`
+          ? db`and (coalesce(items.visibility, 0) = 0 or (lower(items.username) = ${session.user.toLowerCase()} and items.visibility != 3))`
           : db`and coalesce(items.visibility, 0) = 0`);
 
       return db`
@@ -964,9 +966,18 @@ export default {
       };
     }
 
-    // If request was by sequential numeric ID (/123) and item visibility > 0 (unlisted):
+    // If item is Unavailable (visibility === 3):
+    // Only viewable by admins, not regular users or mods (renders normal post not found)
+    if (actitem.visibility === 3 && !session?.admin) {
+      return {
+        success: false,
+        message: "404 - upload not found"
+      };
+    }
+
+    // If request was by sequential numeric ID (/123) and item visibility > 0 (unlisted/private):
     // Block numeric enumeration unless viewer is owner/admin
-    if (isNumeric && actitem.visibility > 0 && !isOwnerOrAdmin) {
+    if (isNumeric && (actitem.visibility === 1 || actitem.visibility === 2) && !isOwnerOrAdmin) {
       return {
         success: false,
         message: "404 - upload not found"