Update trustedproxy config

app/Http/Controllers/Groups/GroupsPostController.php

@@ -41,6 +41,7 @@ class GroupsPostController extends Controller
 
         $group = Group::findOrFail($request->input('group_id'));
         $pid = $request->user()->profile_id;
+        abort_if(! $group->isMember($pid), 403, 'Not a member of group.');
         $caption = $request->input('caption');
         $type = $request->input('type', 'text');
 

app/Http/Controllers/InternalApiController.php

@@ -11,6 +11,7 @@ use App\Jobs\ModPipeline\HandleSpammerPipeline;
 use App\Profile;
 use App\Services\BookmarkService;
 use App\Services\DiscoverService;
+use App\Services\FollowerService;
 use App\Services\ModLogService;
 use App\Services\PublicTimelineService;
 use App\Services\StatusService;
@@ -91,12 +92,23 @@ class InternalApiController extends Controller
         $this->validate($request, [
             'limit' => 'nullable|int|min:1|max:6',
         ]);
+        $user = $request->user();
         $parent = Status::whereScope('public')->findOrFail($id);
         $limit = $request->input('limit') ?? 3;
         $children = Status::whereInReplyToId($parent->id)
             ->orderBy('created_at', 'desc')
-            ->take($limit)
-            ->get();
+            ->take($limit * 3)
+            ->get()
+            ->filter(function ($s) use ($user) {
+                if (in_array($s->scope, ['public', 'unlisted'])) {
+                    return true;
+                }
+                if ($s->scope === 'private') {
+                    return $user && ($s->profile_id === $user->profile_id
+                        || FollowerService::follows($user->profile_id, $s->profile_id));
+                }
+                return false;
+            })->take($limit);
         $resource = new Fractal\Resource\Collection($children, new StatusTransformer);
         $res = $this->fractal->createData($resource)->toArray();
 

config/trustedproxy.php

@@ -23,5 +23,5 @@ return [
      * how many proxies that client's request has
      * subsequently passed through.
      */
-    'proxies' => env('TRUST_PROXIES', '*'),
+    'proxies' => env('TRUST_PROXIES'),
 ];