2 files changed, 7 insertions, 2 deletions

diff --git a/server/controllers/activitypub/client.ts b/server/controllers/activitypub/client.ts
index 5cfbc2f1d..461a619dd 100644
--- a/server/controllers/activitypub/client.ts
+++ b/server/controllers/activitypub/client.ts
@@ -46,7 +46,7 @@ async function accountFollowersController (req: express.Request, res: express.Re
   const page = req.params.page || 1
   const { start, count } = pageToStartAndCount(page, ACTIVITY_PUB.COLLECTION_ITEMS_PER_PAGE)
 
-  const result = await db.Account.listFollowerUrlsForApi(account.id, start, count)
+  const result = await db.Account.listAcceptedFollowerUrlsForApi(account.id, start, count)
   const activityPubResult = activityPubCollectionPagination(req.url, page, result)
 
   return res.json(activityPubResult)
@@ -58,7 +58,7 @@ async function accountFollowingController (req: express.Request, res: express.Re
   const page = req.params.page || 1
   const { start, count } = pageToStartAndCount(page, ACTIVITY_PUB.COLLECTION_ITEMS_PER_PAGE)
 
-  const result = await db.Account.listFollowingUrlsForApi(account.id, start, count)
+  const result = await db.Account.listAcceptedFollowingUrlsForApi(account.id, start, count)
   const activityPubResult = activityPubCollectionPagination(req.url, page, result)
 
   return res.json(activityPubResult)
diff --git a/server/controllers/api/pods.ts b/server/controllers/api/pods.ts
index f662f1c03..2231a05fa 100644
--- a/server/controllers/api/pods.ts
+++ b/server/controllers/api/pods.ts
@@ -11,6 +11,9 @@ import { setFollowingSort } from '../../middlewares/sort'
 import { followValidator } from '../../middlewares/validators/pods'
 import { followersSortValidator, followingSortValidator } from '../../middlewares/validators/sort'
 import { sendFollow } from '../../lib/activitypub/send-request'
+import { authenticate } from '../../middlewares/oauth'
+import { ensureUserHasRight } from '../../middlewares/user-right'
+import { UserRight } from '../../../shared/models/users/user-right.enum'
 
 const podsRouter = express.Router()
 
@@ -23,6 +26,8 @@ podsRouter.get('/following',
 )
 
 podsRouter.post('/follow',
+  authenticate,
+  ensureUserHasRight(UserRight.MANAGE_PEERTUBE_FOLLOW),
   followValidator,
   setBodyHostsPort,
   asyncMiddleware(follow)