API: Cut off comment subtree if no permission to view

tildes/tildes/views/api/beta/comment.py

@@ -80,10 +80,16 @@ def comment_subtree_to_api_dict(
     for comment in comments:
         comment_dict = comment_to_api_dict(request, comment)
         comment_dict["depth"] = comment.depth
-        comment_dict["children"] = (
-            comment_subtree_to_api_dict(request, comment.replies)
-            if comment.replies
-            else []
-        )
+
+        if request.has_permission("view", comment) or not comment.removed_marker:
+            # Recursively display reply comments, unless we hit a "removed marker"
+            comment_dict["children"] = (
+                comment_subtree_to_api_dict(request, comment.replies)
+                if comment.replies
+                else []
+            )
+        else:
+            comment_dict["children"] = []
+
         comments_list.append(comment_dict)
     return comments_list