Security fixes

CALCKEY.md

@@ -113,3 +113,4 @@
 	- 298febeb9c9501e3e3df16982c08657d1da474e0: enhance: add re-collapsing to quoted notes
 	- b0fdedb264db87575063abed45e52ad71ce4a6af: fix lints in folder.vue
 	- 6fed87f85d132304eb84b0a59b84dce299a1822f: fix pagination.vue lints
+	- Tosti's security fixes

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "calckey",
-	"version": "12.119.0-calc.1-rc.9.9",
+	"version": "12.119.0-calc.2",
 	"codename": "aqua",
 	"repository": {
 		"type": "git",

packages/backend/src/server/api/endpoints/federation/followers.ts

@@ -5,7 +5,8 @@ import { makePaginationQuery } from '../../common/make-pagination-query.js';
 export const meta = {
 	tags: ['federation'],
 
-	requireCredential: false,
+	requireCredential: true,
+	requireAdmin: true,
 	requireCredentialPrivateMode: true,
 
 	res: {

packages/backend/src/server/api/endpoints/federation/following.ts

@@ -5,7 +5,8 @@ import { makePaginationQuery } from '../../common/make-pagination-query.js';
 export const meta = {
 	tags: ['federation'],
 
-	requireCredential: false,
+	requireCredential: true,
+	requireAdmin: true,
 	requireCredentialPrivateMode: true,
 
 	res: {

packages/backend/src/server/api/endpoints/federation/instances.ts

@@ -6,7 +6,7 @@ import { fetchMeta } from '@/misc/fetch-meta.js';
 export const meta = {
 	tags: ['federation'],
 
-	requireCredential: false,
+	requireCredential: true,
 	requireCredentialPrivateMode: true,
 
 	res: {

packages/backend/src/server/api/endpoints/federation/show-instance.ts

@@ -5,7 +5,7 @@ import { toPuny } from '@/misc/convert-host.js';
 export const meta = {
 	tags: ['federation'],
 
-	requireCredential: false,
+	requireCredential: true,
 	requireCredentialPrivateMode: true,
 
 	res: {

packages/backend/src/server/api/endpoints/stats.ts

@@ -4,7 +4,7 @@ import { } from '@/services/chart/index.js';
 import { IsNull } from 'typeorm';
 
 export const meta = {
-	requireCredential: false,
+	requireCredential: true,
 	requireCredentialPrivateMode: true,
 
 	tags: ['meta'],

packages/backend/src/server/api/endpoints/users.ts

@@ -6,7 +6,7 @@ import { generateBlockQueryForUsers } from '../common/generate-block-query.js';
 export const meta = {
 	tags: ['users'],
 
-	requireCredential: false,
+	requireCredential: true,
 	requireCredentialPrivateMode: true,
 
 	res: {