Dont allow admin to add mod to remote community (#2129)

diff --git a/crates/api/src/community.rs b/crates/api/src/community.rs
index f4f4332345ca21c3a8bae7ae023267d2475cd52e..d2e149448a4b60a2aab15f5e1708bc22e4c2bdac 100644 (file)
--- a/crates/api/src/community.rs
+++ b/crates/api/src/community.rs
@@ -335,6 +335,13 @@ impl Perform for AddModToCommunity {
 
     // Verify that only mods or admins can add mod
     is_mod_or_admin(context.pool(), local_user_view.person.id, community_id).await?;
+    let community = blocking(context.pool(), move |conn| {
+      Community::read(conn, community_id)
+    })
+    .await??;
+    if local_user_view.person.admin && !community.local {
+      return Err(LemmyError::from_message("not_a_moderator"));
+    }
 
     // Update in local database
     let community_moderator_form = CommunityModeratorForm {
@@ -374,11 +381,7 @@ impl Perform for AddModToCommunity {
     })
     .await??
     .into();
-    let community: ApubCommunity = blocking(context.pool(), move |conn| {
-      Community::read(conn, community_id)
-    })
-    .await??
-    .into();
+    let community: ApubCommunity = community.into();
     if data.added {
       AddMod::send(
         &community,