]> Untitled Git - lemmy.git/blob - crates/api_crud/src/community/update.rs
Sanitize html (#3708)
[lemmy.git] / crates / api_crud / src / community / update.rs
1 use crate::PerformCrud;
2 use actix_web::web::Data;
3 use lemmy_api_common::{
4   build_response::build_community_response,
5   community::{CommunityResponse, EditCommunity},
6   context::LemmyContext,
7   utils::{local_site_to_slur_regex, local_user_view_from_jwt, sanitize_html_opt},
8 };
9 use lemmy_db_schema::{
10   newtypes::PersonId,
11   source::{
12     actor_language::{CommunityLanguage, SiteLanguage},
13     community::{Community, CommunityUpdateForm},
14     local_site::LocalSite,
15   },
16   traits::Crud,
17   utils::{diesel_option_overwrite, diesel_option_overwrite_to_url, naive_now},
18 };
19 use lemmy_db_views_actor::structs::CommunityModeratorView;
20 use lemmy_utils::{
21   error::{LemmyError, LemmyErrorExt, LemmyErrorType},
22   utils::{slurs::check_slurs_opt, validation::is_valid_body_field},
23 };
24
25 #[async_trait::async_trait(?Send)]
26 impl PerformCrud for EditCommunity {
27   type Response = CommunityResponse;
28
29   #[tracing::instrument(skip(context))]
30   async fn perform(&self, context: &Data<LemmyContext>) -> Result<CommunityResponse, LemmyError> {
31     let data: &EditCommunity = self;
32     let local_user_view = local_user_view_from_jwt(&data.auth, context).await?;
33     let local_site = LocalSite::read(&mut context.pool()).await?;
34
35     let slur_regex = local_site_to_slur_regex(&local_site);
36     check_slurs_opt(&data.title, &slur_regex)?;
37     check_slurs_opt(&data.description, &slur_regex)?;
38     is_valid_body_field(&data.description, false)?;
39
40     let title = sanitize_html_opt(&data.title);
41     let description = sanitize_html_opt(&data.description);
42
43     let icon = diesel_option_overwrite_to_url(&data.icon)?;
44     let banner = diesel_option_overwrite_to_url(&data.banner)?;
45     let description = diesel_option_overwrite(description);
46
47     // Verify its a mod (only mods can edit it)
48     let community_id = data.community_id;
49     let mods: Vec<PersonId> =
50       CommunityModeratorView::for_community(&mut context.pool(), community_id)
51         .await
52         .map(|v| v.into_iter().map(|m| m.moderator.id).collect())?;
53     if !mods.contains(&local_user_view.person.id) {
54       return Err(LemmyErrorType::NotAModerator)?;
55     }
56
57     let community_id = data.community_id;
58     if let Some(languages) = data.discussion_languages.clone() {
59       let site_languages = SiteLanguage::read_local_raw(&mut context.pool()).await?;
60       // check that community languages are a subset of site languages
61       // https://stackoverflow.com/a/64227550
62       let is_subset = languages.iter().all(|item| site_languages.contains(item));
63       if !is_subset {
64         return Err(LemmyErrorType::LanguageNotAllowed)?;
65       }
66       CommunityLanguage::update(&mut context.pool(), languages, community_id).await?;
67     }
68
69     let community_form = CommunityUpdateForm::builder()
70       .title(title)
71       .description(description)
72       .icon(icon)
73       .banner(banner)
74       .nsfw(data.nsfw)
75       .posting_restricted_to_mods(data.posting_restricted_to_mods)
76       .updated(Some(Some(naive_now())))
77       .build();
78
79     let community_id = data.community_id;
80     Community::update(&mut context.pool(), community_id, &community_form)
81       .await
82       .with_lemmy_type(LemmyErrorType::CouldntUpdateCommunity)?;
83
84     build_community_response(context, local_user_view, community_id).await
85   }
86 }