From e9e03c2fc702200cd7c92928ef2a7cc746d0b0ce Mon Sep 17 00:00:00 2001
From: Jan-Lukas Else <mail@jlelse.de>
Date: Mon, 13 Feb 2023 20:35:00 +0100
Subject: [PATCH] Make sure random redirect only selects published and public
 posts

---
 postsDb.go | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/postsDb.go b/postsDb.go
index 5a7f131..c1751ef 100644
--- a/postsDb.go
+++ b/postsDb.go
@@ -647,7 +647,14 @@ func (d *database) countPosts(config *postsRequestConfig) (count int, err error)
 
 func (a *goBlog) getRandomPostPath(blog string) (path string, err error) {
 	sections := lo.Keys(a.cfg.Blogs[blog].Sections)
-	query, params := buildPostsQuery(&postsRequestConfig{randomOrder: true, limit: 1, blog: blog, sections: sections}, "path")
+	query, params := buildPostsQuery(&postsRequestConfig{
+		randomOrder: true,
+		limit:       1,
+		blog:        blog,
+		sections:    sections,
+		visibility:  []postVisibility{visibilityPublic},
+		status:      []postStatus{statusPublished},
+	}, "path")
 	row, err := a.db.QueryRow(query, params...)
 	if err != nil {
 		return