Sanitize html (#3708)

[lemmy.git] / crates / api / src / community / ban.rs

diff --git a/crates/api/src/community/ban.rs b/crates/api/src/community/ban.rs
index 9ea0c5c93c9ee39a2aa6479dff198cab3e96a424..95c2bbc04175a1b043ae12bf34e7e10cd351e479 100644 (file)
--- a/crates/api/src/community/ban.rs
+++ b/crates/api/src/community/ban.rs
@@ -2,44 +2,43 @@ use crate::Perform;
 use actix_web::web::Data;
 use lemmy_api_common::{
   community::{BanFromCommunity, BanFromCommunityResponse},
-  utils::{blocking, get_local_user_view_from_jwt, is_mod_or_admin, remove_user_data_in_community},
-};
-use lemmy_apub::{
-  activities::block::SiteOrCommunity,
-  objects::{community::ApubCommunity, person::ApubPerson},
-  protocol::activities::block::{block_user::BlockUser, undo_block_user::UndoBlockUser},
+  context::LemmyContext,
+  utils::{
+    is_mod_or_admin,
+    local_user_view_from_jwt,
+    remove_user_data_in_community,
+    sanitize_html_opt,
+  },
 };
 use lemmy_db_schema::{
   source::{
     community::{
-      Community,
       CommunityFollower,
       CommunityFollowerForm,
       CommunityPersonBan,
       CommunityPersonBanForm,
     },
     moderator::{ModBanFromCommunity, ModBanFromCommunityForm},
-    person::Person,
   },
   traits::{Bannable, Crud, Followable},
 };
-use lemmy_db_views_actor::structs::PersonViewSafe;
-use lemmy_utils::{error::LemmyError, utils::naive_from_unix, ConnectionId};
-use lemmy_websocket::{messages::SendCommunityRoomMessage, LemmyContext, UserOperation};
+use lemmy_db_views_actor::structs::PersonView;
+use lemmy_utils::{
+  error::{LemmyError, LemmyErrorExt, LemmyErrorType},
+  utils::{time::naive_from_unix, validation::is_valid_body_field},
+};
 
 #[async_trait::async_trait(?Send)]
 impl Perform for BanFromCommunity {
   type Response = BanFromCommunityResponse;
 
-  #[tracing::instrument(skip(context, websocket_id))]
+  #[tracing::instrument(skip(context))]
   async fn perform(
     &self,
     context: &Data<LemmyContext>,
-    websocket_id: Option<ConnectionId>,
   ) -> Result<BanFromCommunityResponse, LemmyError> {
     let data: &BanFromCommunity = self;
-    let local_user_view =
-      get_local_user_view_from_jwt(&data.auth, context.pool(), context.secret()).await?;
+    let local_user_view = local_user_view_from_jwt(&data.auth, context).await?;
 
     let community_id = data.community_id;
     let banned_person_id = data.person_id;
@@ -47,7 +46,8 @@ impl Perform for BanFromCommunity {
     let expires = data.expires.map(naive_from_unix);
 
     // Verify that only mods or admins can ban
-    is_mod_or_admin(context.pool(), local_user_view.person.id, community_id).await?;
+    is_mod_or_admin(&mut context.pool(), local_user_view.person.id, community_id).await?;
+    is_valid_body_field(&data.reason, false)?;
 
     let community_user_ban_form = CommunityPersonBanForm {
       community_id: data.community_id,
@@ -55,22 +55,10 @@ impl Perform for BanFromCommunity {
       expires: Some(expires),
     };
 
-    let community: ApubCommunity = blocking(context.pool(), move |conn: &mut _| {
-      Community::read(conn, community_id)
-    })
-    .await??
-    .into();
-    let banned_person: ApubPerson = blocking(context.pool(), move |conn: &mut _| {
-      Person::read(conn, banned_person_id)
-    })
-    .await??
-    .into();
-
     if data.ban {
-      let ban = move |conn: &mut _| CommunityPersonBan::ban(conn, &community_user_ban_form);
-      blocking(context.pool(), ban)
-        .await?
-        .map_err(|e| LemmyError::from_error_message(e, "community_user_already_banned"))?;
+      CommunityPersonBan::ban(&mut context.pool(), &community_user_ban_form)
+        .await
+        .with_lemmy_type(LemmyErrorType::CommunityUserAlreadyBanned)?;
 
       // Also unsubscribe them from the community, if they are subscribed
       let community_follower_form = CommunityFollowerForm {
@@ -78,40 +66,19 @@ impl Perform for BanFromCommunity {
         person_id: banned_person_id,
         pending: false,
       };
-      blocking(context.pool(), move |conn: &mut _| {
-        CommunityFollower::unfollow(conn, &community_follower_form)
-      })
-      .await?
-      .ok();
 
-      BlockUser::send(
-        &SiteOrCommunity::Community(community),
-        &banned_person,
-        &local_user_view.person.clone().into(),
-        remove_data,
-        data.reason.clone(),
-        expires,
-        context,
-      )
-      .await?;
+      CommunityFollower::unfollow(&mut context.pool(), &community_follower_form)
+        .await
+        .ok();
     } else {
-      let unban = move |conn: &mut _| CommunityPersonBan::unban(conn, &community_user_ban_form);
-      blocking(context.pool(), unban)
-        .await?
-        .map_err(|e| LemmyError::from_error_message(e, "community_user_already_banned"))?;
-      UndoBlockUser::send(
-        &SiteOrCommunity::Community(community),
-        &banned_person,
-        &local_user_view.person.clone().into(),
-        data.reason.clone(),
-        context,
-      )
-      .await?;
+      CommunityPersonBan::unban(&mut context.pool(), &community_user_ban_form)
+        .await
+        .with_lemmy_type(LemmyErrorType::CommunityUserAlreadyBanned)?;
     }
 
     // Remove/Restore their data if that's desired
     if remove_data {
-      remove_user_data_in_community(community_id, banned_person_id, context.pool()).await?;
+      remove_user_data_in_community(community_id, banned_person_id, &mut context.pool()).await?;
     }
 
     // Mod tables
@@ -119,33 +86,19 @@ impl Perform for BanFromCommunity {
       mod_person_id: local_user_view.person.id,
       other_person_id: data.person_id,
       community_id: data.community_id,
-      reason: data.reason.to_owned(),
+      reason: sanitize_html_opt(&data.reason),
       banned: Some(data.ban),
       expires,
     };
-    blocking(context.pool(), move |conn| {
-      ModBanFromCommunity::create(conn, &form)
-    })
-    .await??;
+
+    ModBanFromCommunity::create(&mut context.pool(), &form).await?;
 
     let person_id = data.person_id;
-    let person_view = blocking(context.pool(), move |conn| {
-      PersonViewSafe::read(conn, person_id)
-    })
-    .await??;
+    let person_view = PersonView::read(&mut context.pool(), person_id).await?;
 
-    let res = BanFromCommunityResponse {
+    Ok(BanFromCommunityResponse {
       person_view,
       banned: data.ban,
-    };
-
-    context.chat_server().do_send(SendCommunityRoomMessage {
-      op: UserOperation::BanFromCommunity,
-      response: res.clone(),
-      community_id,
-      websocket_id,
-    });
-
-    Ok(res)
+    })
   }
 }