Sanitize html (#3708)

[lemmy.git] / crates / api / src / local_user / ban_person.rs

diff --git a/crates/api/src/local_user/ban_person.rs b/crates/api/src/local_user/ban_person.rs
index 6de826dca1ec06c3cac38bd08dcb48ae57c2f0ed..77e8e805680d56becda7ac62c628474c20b74b71 100644 (file)
--- a/crates/api/src/local_user/ban_person.rs
+++ b/crates/api/src/local_user/ban_person.rs
@@ -1,115 +1,81 @@
 use crate::Perform;
 use actix_web::web::Data;
 use lemmy_api_common::{
+  context::LemmyContext,
   person::{BanPerson, BanPersonResponse},
-  utils::{blocking, get_local_user_view_from_jwt, is_admin, remove_user_data},
-};
-use lemmy_apub::{
-  activities::block::SiteOrCommunity,
-  protocol::activities::block::{block_user::BlockUser, undo_block_user::UndoBlockUser},
+  utils::{is_admin, local_user_view_from_jwt, remove_user_data, sanitize_html_opt},
 };
 use lemmy_db_schema::{
   source::{
     moderator::{ModBan, ModBanForm},
-    person::Person,
-    site::Site,
+    person::{Person, PersonUpdateForm},
   },
   traits::Crud,
 };
-use lemmy_db_views_actor::structs::PersonViewSafe;
-use lemmy_utils::{error::LemmyError, utils::naive_from_unix, ConnectionId};
-use lemmy_websocket::{messages::SendAllMessage, LemmyContext, UserOperation};
+use lemmy_db_views_actor::structs::PersonView;
+use lemmy_utils::{
+  error::{LemmyError, LemmyErrorExt, LemmyErrorType},
+  utils::{time::naive_from_unix, validation::is_valid_body_field},
+};
 
 #[async_trait::async_trait(?Send)]
 impl Perform for BanPerson {
   type Response = BanPersonResponse;
 
-  #[tracing::instrument(skip(context, websocket_id))]
-  async fn perform(
-    &self,
-    context: &Data<LemmyContext>,
-    websocket_id: Option<ConnectionId>,
-  ) -> Result<BanPersonResponse, LemmyError> {
+  #[tracing::instrument(skip(context))]
+  async fn perform(&self, context: &Data<LemmyContext>) -> Result<BanPersonResponse, LemmyError> {
     let data: &BanPerson = self;
-    let local_user_view =
-      get_local_user_view_from_jwt(&data.auth, context.pool(), context.secret()).await?;
+    let local_user_view = local_user_view_from_jwt(&data.auth, context).await?;
 
     // Make sure user is an admin
     is_admin(&local_user_view)?;
 
+    is_valid_body_field(&data.reason, false)?;
+
     let ban = data.ban;
     let banned_person_id = data.person_id;
     let expires = data.expires.map(naive_from_unix);
 
-    let ban_person = move |conn: &'_ _| Person::ban_person(conn, banned_person_id, ban, expires);
-    let person = blocking(context.pool(), ban_person)
-      .await?
-      .map_err(|e| LemmyError::from_error_message(e, "couldnt_update_user"))?;
+    let person = Person::update(
+      &mut context.pool(),
+      banned_person_id,
+      &PersonUpdateForm::builder()
+        .banned(Some(ban))
+        .ban_expires(Some(expires))
+        .build(),
+    )
+    .await
+    .with_lemmy_type(LemmyErrorType::CouldntUpdateUser)?;
 
     // Remove their data if that's desired
     let remove_data = data.remove_data.unwrap_or(false);
     if remove_data {
-      remove_user_data(person.id, context.pool()).await?;
+      remove_user_data(
+        person.id,
+        &mut context.pool(),
+        context.settings(),
+        context.client(),
+      )
+      .await?;
     }
 
     // Mod tables
     let form = ModBanForm {
       mod_person_id: local_user_view.person.id,
       other_person_id: data.person_id,
-      reason: data.reason.to_owned(),
+      reason: sanitize_html_opt(&data.reason),
       banned: Some(data.ban),
       expires,
     };
 
-    blocking(context.pool(), move |conn| ModBan::create(conn, &form)).await??;
+    ModBan::create(&mut context.pool(), &form).await?;
 
     let person_id = data.person_id;
-    let person_view = blocking(context.pool(), move |conn| {
-      PersonViewSafe::read(conn, person_id)
-    })
-    .await??;
-
-    let site = SiteOrCommunity::Site(
-      blocking(context.pool(), Site::read_local_site)
-        .await??
-        .into(),
-    );
-    // if the action affects a local user, federate to other instances
-    if person.local {
-      if ban {
-        BlockUser::send(
-          &site,
-          &person.into(),
-          &local_user_view.person.into(),
-          remove_data,
-          data.reason.clone(),
-          expires,
-          context,
-        )
-        .await?;
-      } else {
-        UndoBlockUser::send(
-          &site,
-          &person.into(),
-          &local_user_view.person.into(),
-          data.reason.clone(),
-          context,
-        )
-        .await?;
-      }
-    }
+    let person_view = PersonView::read(&mut context.pool(), person_id).await?;
 
-    let res = BanPersonResponse {
+    Ok(BanPersonResponse {
       person_view,
       banned: data.ban,
-    };
-
-    context.chat_server().do_send(SendAllMessage {
-      op: UserOperation::BanPerson,
-      response: res.clone(),
-      websocket_id,
-    });
-
-    Ok(res)
+    })
   }
 }