From acb8f5fe5d55cf728e6d38ae671a9f54b7e6b8f6 Mon Sep 17 00:00:00 2001
From: Matt Baer <matt@write.as>
Date: Sat, 7 Dec 2019 09:06:31 -0500
Subject: [PATCH 1/6] Fix broken password-collection template

Fixed "user-supsended" to "user-suspended"
---
 templates/password-collection.tmpl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/templates/password-collection.tmpl b/templates/password-collection.tmpl
index 73c4465..66a3bef 100644
--- a/templates/password-collection.tmpl
+++ b/templates/password-collection.tmpl
@@ -26,7 +26,7 @@
 	</head>
 	<body id="collection" itemscope itemtype="http://schema.org/WebPage">
 		{{if .Suspended}}
-			{{template "user-supsended"}}
+			{{template "user-suspended"}}
 		{{end}}
 		<header>
 		<h1 dir="{{.Direction}}" id="blog-title"><a href="/{{.Alias}}/" class="h-card p-author u-url" rel="me author">{{.DisplayTitle}}</a></h1>

From 0b701c5f7f36736127c809d71a1bb2b7d9ae495c Mon Sep 17 00:00:00 2001
From: Matt Baer <matt@write.as>
Date: Sat, 7 Dec 2019 09:08:37 -0500
Subject: [PATCH 2/6] Update "account silenced" alert on edit-meta

Use "silenced" phrasing instead of "suspended"
---
 templates/edit-meta.tmpl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/edit-meta.tmpl b/templates/edit-meta.tmpl
index 6707e68..49c7781 100644
--- a/templates/edit-meta.tmpl
+++ b/templates/edit-meta.tmpl
@@ -270,7 +270,7 @@
 		<script>
 function updateMeta() {
 	if ({{.Suspended}}) {
-		alert('Your account is currently supsended, editing posts is disabled.');
+		alert("Your account is silenced, so you can't edit posts.");
 		return
 	}
 	document.getElementById('create-error').style.display = 'none';

From 6f6204a849b52510c42e16c22b29f7f4c993ac0c Mon Sep 17 00:00:00 2001
From: Matt Baer <matt@write.as>
Date: Tue, 17 Dec 2019 13:02:21 -0500
Subject: [PATCH 3/6] Return 404 for suspended pass-protected colls

Previously, any password-protected collection on a suspended account
would prompt visitors for a password, and *then* take them to the "not
found" page. This fixes that.
---
 collections.go | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/collections.go b/collections.go
index b85f0a4..66ad7a0 100644
--- a/collections.go
+++ b/collections.go
@@ -648,6 +648,16 @@ func processCollectionPermissions(app *App, cr *collectionReq, u *User, w http.R
 				uname = u.Username
 			}
 
+			// TODO: move this to all permission checks?
+			suspended, err := app.db.IsUserSuspended(c.OwnerID)
+			if err != nil {
+				log.Error("process protected collection permissions: %v", err)
+				return nil, err
+			}
+			if suspended {
+				return nil, ErrCollectionNotFound
+			}
+
 			// See if we've authorized this collection
 			authd := isAuthorizedForCollection(app, c.Alias, r)
 

From aa405bc57ce390c9b17d9447053a73b762d87845 Mon Sep 17 00:00:00 2001
From: Matt Baer <matt@write.as>
Date: Tue, 17 Dec 2019 13:11:32 -0500
Subject: [PATCH 4/6] Remove "silenced" warning on password-collection.tmpl

Logged-in users never see this particular page, so it's not needed here.
---
 templates/password-collection.tmpl | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/templates/password-collection.tmpl b/templates/password-collection.tmpl
index 66a3bef..e0b755d 100644
--- a/templates/password-collection.tmpl
+++ b/templates/password-collection.tmpl
@@ -25,9 +25,6 @@
 
 	</head>
 	<body id="collection" itemscope itemtype="http://schema.org/WebPage">
-		{{if .Suspended}}
-			{{template "user-suspended"}}
-		{{end}}
 		<header>
 		<h1 dir="{{.Direction}}" id="blog-title"><a href="/{{.Alias}}/" class="h-card p-author u-url" rel="me author">{{.DisplayTitle}}</a></h1>
 		</header>

From 4c0e4d04c14fb9942c28cd04265ffe440eae0278 Mon Sep 17 00:00:00 2001
From: Rob Loranger <dev@loranger.xyz>
Date: Tue, 17 Dec 2019 10:42:31 -0800
Subject: [PATCH 5/6] 404 for protected posts when previously authorized

a user who had previously authenticated on a protected collection would
still see the post after the owner was silenced, with a banner meant for
the owner displayed.
---
 posts.go | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/posts.go b/posts.go
index 9440ad8..62a3ae3 100644
--- a/posts.go
+++ b/posts.go
@@ -1342,8 +1342,13 @@ func viewCollectionPost(app *App, w http.ResponseWriter, r *http.Request) error
 	if c.IsPrivate() && (u == nil || u.ID != c.OwnerID) {
 		return ErrPostNotFound
 	}
-	if c.IsProtected() && ((u == nil || u.ID != c.OwnerID) && !isAuthorizedForCollection(app, c.Alias, r)) {
-		return impart.HTTPError{http.StatusFound, c.CanonicalURL() + "/?g=" + slug}
+	if c.IsProtected() && (u == nil || u.ID != c.OwnerID) {
+		if suspended {
+			return ErrPostNotFound
+		} else if !isAuthorizedForCollection(app, c.Alias, r) {
+			return impart.HTTPError{http.StatusFound, c.CanonicalURL() + "/?g=" + slug}
+
+		}
 	}
 
 	cr.isCollOwner = u != nil && c.OwnerID == u.ID

From 6afafa4d67d3238378f58565d01197005779bcd8 Mon Sep 17 00:00:00 2001
From: Matt Baer <matt@write.as>
Date: Tue, 17 Dec 2019 21:10:39 -0500
Subject: [PATCH 6/6] Fix whitespace

---
 posts.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/posts.go b/posts.go
index 62a3ae3..547343b 100644
--- a/posts.go
+++ b/posts.go
@@ -1347,7 +1347,6 @@ func viewCollectionPost(app *App, w http.ResponseWriter, r *http.Request) error
 			return ErrPostNotFound
 		} else if !isAuthorizedForCollection(app, c.Alias, r) {
 			return impart.HTTPError{http.StatusFound, c.CanonicalURL() + "/?g=" + slug}
-
 		}
 	}
 
