From 9cabbd2be5a186981cd6b986da2b8960cb4328f9 Mon Sep 17 00:00:00 2001
From: Ted Unangst <tedu@tedunangst.com>
Date: Thu, 20 Jun 2019 15:15:50 -0400
Subject: [PATCH] unlink convoy unless logged in

---
 honk.go         |  2 +-
 views/honk.html | 11 +++++++----
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/honk.go b/honk.go
index 1669eff..341d5f6 100644
--- a/honk.go
+++ b/honk.go
@@ -1374,7 +1374,6 @@ func serve() {
 	getters.HandleFunc("/u/{name:[[:alnum:]]+}/followers", emptiness)
 	getters.HandleFunc("/u/{name:[[:alnum:]]+}/following", emptiness)
 	getters.HandleFunc("/a", avatate)
-	getters.HandleFunc("/t", showconvoy)
 	getters.HandleFunc("/d/{xid:[[:alnum:].]+}", servefile)
 	getters.HandleFunc("/emu/{xid:[[:alnum:]_.-]+}", serveemu)
 	getters.HandleFunc("/meme/{xid:[[:alnum:]_.-]+}", servememe)
@@ -1405,6 +1404,7 @@ func serve() {
 	loggedin.HandleFunc("/h", showhonker)
 	loggedin.HandleFunc("/c/{name:[[:alnum:]]+}", showcombo)
 	loggedin.HandleFunc("/c", showcombos)
+	loggedin.HandleFunc("/t", showconvoy)
 	loggedin.Handle("/savehonker", login.CSRFWrap("savehonker", http.HandlerFunc(savehonker)))
 
 	err = http.Serve(listener, mux)
diff --git a/views/honk.html b/views/honk.html
index 7148bb3..211d0e7 100644
--- a/views/honk.html
+++ b/views/honk.html
@@ -1,4 +1,5 @@
 <article class="honk {{ .Honk.What }} {{ and (not .Honk.Public) "limited" }}" data-convoy="{{ .Honk.Convoy }}">
+{{ $bonkcsrf := .BonkCSRF }}
 {{ with .Honk }}
 <header>
 <img alt="avatar" src="/a?a={{ .Honker}}">
@@ -17,9 +18,11 @@ in reply to: <a href="{{ .RID }}" rel=noreferrer>{{ .RID }}</a>
 {{ end }}
 {{ end }}
 <br>
-<span style="margin-left: 1em;" class="clip">
-convoy: <a href="/t?c={{ .Convoy }}">{{ .Convoy }}</a>
-</span>
+{{ if $bonkcsrf }}
+<span style="margin-left: 1em;" class="clip">convoy: <a href="/t?c={{ .Convoy }}">{{ .Convoy }}</a></span>
+{{ else }}
+<span style="margin-left: 1em;" class="clip">convoy: {{ .Convoy }}</span>
+{{ end }}
 </header>
 <div class="noise">
 <p>{{ .HTML }}
@@ -44,7 +47,7 @@ convoy: <a href="/t?c={{ .Convoy }}">{{ .Convoy }}</a>
 {{ end }}
 </div>
 {{ end }}
-{{ if .BonkCSRF }}
+{{ if $bonkcsrf }}
 <p>
 <details>
 <summary>Actions