Merge pull request #5187 from pixelfed/staging

Update StatusController, fix unlisted post guest/ap access bug

CHANGELOG.md

@@ -32,6 +32,7 @@
 - Update DirectMessageController, add carousel entity to threads ([96f24f33](https://github.com/pixelfed/pixelfed/commit/96f24f33))
 - Update and refactor total local post count logic, cache value and schedule updates twice daily to eliminate the perf issue on larger instances ([4f2b8ed2](https://github.com/pixelfed/pixelfed/commit/4f2b8ed2))
 - Update Media model, fix broken thumbnail/gray thumbnail bug ([e33643c2](https://github.com/pixelfed/pixelfed/commit/e33643c2))
+- Update StatusController, fix unlisted post guest/ap access bug ([83098428](https://github.com/pixelfed/pixelfed/commit/83098428))
 -  ([](https://github.com/pixelfed/pixelfed/commit/))
 
 ## [v0.12.1 (2024-05-07)](https://github.com/pixelfed/pixelfed/compare/v0.12.0...v0.12.1)

app/Http/Controllers/StatusController.php

@@ -43,7 +43,7 @@ class StatusController extends Controller
             $status['account']['username'] != $username ||
             isset($status['reblog']), 404);
 
-        abort_if($status['visibility'] != 'public' && ! $request->user(), 403, 'Invalid permission');
+        abort_if(! in_array($status['visibility'], ['public', 'unlisted']) && ! $request->user(), 403, 'Invalid permission');
 
         if ($request->wantsJson() && (bool) config_cache('federation.activitypub.enabled')) {
             return $this->showActivityPub($request, $status);