]> Untitled Git - lemmy.git/blob - crates/api_crud/src/comment/update.rs
Dont allow posts to deleted / removed communities. Fixes #1827 (#1828)
[lemmy.git] / crates / api_crud / src / comment / update.rs
1 use crate::PerformCrud;
2 use actix_web::web::Data;
3 use lemmy_api_common::{
4   blocking,
5   check_community_ban,
6   check_community_deleted_or_removed,
7   check_post_deleted_or_removed,
8   comment::*,
9   get_local_user_view_from_jwt,
10   send_local_notifs,
11 };
12 use lemmy_apub::activities::{
13   comment::create_or_update::CreateOrUpdateComment,
14   CreateOrUpdateType,
15 };
16 use lemmy_db_queries::source::comment::Comment_;
17 use lemmy_db_schema::source::comment::*;
18 use lemmy_db_views::comment_view::CommentView;
19 use lemmy_utils::{
20   utils::{remove_slurs, scrape_text_for_mentions},
21   ApiError,
22   ConnectionId,
23   LemmyError,
24 };
25 use lemmy_websocket::{send::send_comment_ws_message, LemmyContext, UserOperationCrud};
26
27 #[async_trait::async_trait(?Send)]
28 impl PerformCrud for EditComment {
29   type Response = CommentResponse;
30
31   async fn perform(
32     &self,
33     context: &Data<LemmyContext>,
34     websocket_id: Option<ConnectionId>,
35   ) -> Result<CommentResponse, LemmyError> {
36     let data: &EditComment = self;
37     let local_user_view =
38       get_local_user_view_from_jwt(&data.auth, context.pool(), context.secret()).await?;
39
40     let comment_id = data.comment_id;
41     let orig_comment = blocking(context.pool(), move |conn| {
42       CommentView::read(conn, comment_id, None)
43     })
44     .await??;
45
46     // TODO is this necessary? It should really only need to check on create
47     check_community_ban(
48       local_user_view.person.id,
49       orig_comment.community.id,
50       context.pool(),
51     )
52     .await?;
53     check_community_deleted_or_removed(orig_comment.community.id, context.pool()).await?;
54     check_post_deleted_or_removed(&orig_comment.post)?;
55
56     // Verify that only the creator can edit
57     if local_user_view.person.id != orig_comment.creator.id {
58       return Err(ApiError::err_plain("no_comment_edit_allowed").into());
59     }
60
61     // Do the update
62     let content_slurs_removed =
63       remove_slurs(&data.content.to_owned(), &context.settings().slur_regex());
64     let comment_id = data.comment_id;
65     let updated_comment = blocking(context.pool(), move |conn| {
66       Comment::update_content(conn, comment_id, &content_slurs_removed)
67     })
68     .await?
69     .map_err(|e| ApiError::err("couldnt_update_comment", e))?;
70
71     // Send the apub update
72     CreateOrUpdateComment::send(
73       &updated_comment,
74       &local_user_view.person,
75       CreateOrUpdateType::Update,
76       context,
77     )
78     .await?;
79
80     // Do the mentions / recipients
81     let updated_comment_content = updated_comment.content.to_owned();
82     let mentions = scrape_text_for_mentions(&updated_comment_content);
83     let recipient_ids = send_local_notifs(
84       mentions,
85       updated_comment,
86       local_user_view.person.clone(),
87       orig_comment.post,
88       context.pool(),
89       false,
90       &context.settings(),
91     )
92     .await?;
93
94     send_comment_ws_message(
95       data.comment_id,
96       UserOperationCrud::EditComment,
97       websocket_id,
98       data.form_id.to_owned(),
99       None,
100       recipient_ids,
101       context,
102     )
103     .await
104   }
105 }