#434

backend/app/controllers/posts_controller.rb

@@ -38,7 +38,7 @@ class PostsController < ApplicationController
     offset = (page - 1) * limit
 
     pt_max_sql =
-        PostVersion
+        HistoryAccess.visible(PostVersion.all)
         .select('post_id, MAX(created_at) AS max_updated_at')
         .group('post_id')
         .to_sql
@@ -344,6 +344,7 @@ class PostsController < ApplicationController
       unless force
         base_version = post.post_versions.find_by!(version_no: base_version_no)
 
+        HistoryAccess.require!(base_version)
         base_snapshot = post_snapshot_from_version(base_version)
         current_snapshot = post_snapshot_from_record(post, locale)
       end
@@ -449,7 +450,7 @@ class PostsController < ApplicationController
   private
 
   def tag_filter_references literals
-    PostTagSearch.parse_references(params[:tag_refs], literals)
+    PostTagSearch.parse_references(params.to_unsafe_h, literals)
   rescue ArgumentError, JSON::ParserError, TypeError
     raise ActionController::BadRequest
   end