From bfcf1a22e6aaf4d34efc2a5e1e4256d1f36578fd Mon Sep 17 00:00:00 2001
From: Leonard Lorenz <dev@leonardlorenz.de>
Date: Sat, 21 Nov 2020 21:40:07 +0100
Subject: [PATCH] post by id now returns unauthorized if post is hidden

---
 site/Cargo.toml    | 2 +-
 site/src/routes.rs | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/site/Cargo.toml b/site/Cargo.toml
index 32a2b8a..60885d2 100644
--- a/site/Cargo.toml
+++ b/site/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "crablog"
-version = "0.2.0"
+version = "0.2.1"
 authors = ["Leonard Lorenz <dev@leonardlorenz.de>"]
 edition = "2018"
 
diff --git a/site/src/routes.rs b/site/src/routes.rs
index f3cf216..d065380 100644
--- a/site/src/routes.rs
+++ b/site/src/routes.rs
@@ -79,6 +79,10 @@ async fn blog_by_id(tmpl: web::Data<tera::Tera>, web::Path(post_id): web::Path<s
     if valid {
         let post = db::get_post_by_id(id as i32);
 
+        if !post.published {
+            return Ok(HttpResponse::new(StatusCode::UNAUTHORIZED))
+        }
+
         let mut context = Context::new();
         context.insert("post", &post);
         context.insert("username", CONFIG_MAP.read().unwrap().get("USERNAME").unwrap());