Merge branch 'security/fix-local-locked-accounts' into 'develop'

security: fix local locked accounts

Closes #316

See merge request pleroma/pleroma!372

1 files changed, 9 insertions, 0 deletions

diff --git a/test/user_test.exs b/test/user_test.exs
index 4b0f0739e..248c26a3d 100644
--- a/test/user_test.exs
+++ b/test/user_test.exs
@@ -55,6 +55,15 @@ defmodule Pleroma.UserTest do
     {:error, _} = User.follow(blockee, blocker)
   end
 
+  test "local users do not automatically follow local locked accounts" do
+    follower = insert(:user, info: %{"locked" => true})
+    followed = insert(:user, info: %{"locked" => true})
+
+    {:ok, follower} = User.maybe_direct_follow(follower, followed)
+
+    refute User.following?(follower, followed)
+  end
+
   # This is a somewhat useless test.
   # test "following a remote user will ensure a websub subscription is present" do
   #   user = insert(:user)