Sanitize html (#3708)

[lemmy.git] / crates / api / src / local_user / save_settings.rs

diff --git a/crates/api/src/local_user/save_settings.rs b/crates/api/src/local_user/save_settings.rs
index e74266fc9dd3e13154bdbc240ade484ff43c9f89..152c11ad12e1e9c6c0840bb82603ad905d1a1369 100644 (file)
--- a/crates/api/src/local_user/save_settings.rs
+++ b/crates/api/src/local_user/save_settings.rs
@@ -3,7 +3,7 @@ use actix_web::web::Data;
 use lemmy_api_common::{
   context::LemmyContext,
   person::{LoginResponse, SaveUserSettings},
-  utils::{local_user_view_from_jwt, send_verification_email},
+  utils::{local_user_view_from_jwt, sanitize_html_opt, send_verification_email},
 };
 use lemmy_db_schema::{
   source::{
@@ -17,7 +17,7 @@ use lemmy_db_schema::{
 use lemmy_db_views::structs::SiteView;
 use lemmy_utils::{
   claims::Claims,
-  error::LemmyError,
+  error::{LemmyError, LemmyErrorExt, LemmyErrorType},
   utils::validation::{
     build_totp_2fa,
     generate_totp_2fa_secret,
@@ -35,29 +35,37 @@ impl Perform for SaveUserSettings {
   async fn perform(&self, context: &Data<LemmyContext>) -> Result<LoginResponse, LemmyError> {
     let data: &SaveUserSettings = self;
     let local_user_view = local_user_view_from_jwt(&data.auth, context).await?;
-    let site_view = SiteView::read_local(context.pool()).await?;
+    let site_view = SiteView::read_local(&mut context.pool()).await?;
+
+    let bio = sanitize_html_opt(&data.bio);
+    let display_name = sanitize_html_opt(&data.display_name);
 
     let avatar = diesel_option_overwrite_to_url(&data.avatar)?;
     let banner = diesel_option_overwrite_to_url(&data.banner)?;
-    let bio = diesel_option_overwrite(&data.bio);
-    let display_name = diesel_option_overwrite(&data.display_name);
-    let matrix_user_id = diesel_option_overwrite(&data.matrix_user_id);
+    let bio = diesel_option_overwrite(bio);
+    let display_name = diesel_option_overwrite(display_name);
+    let matrix_user_id = diesel_option_overwrite(data.matrix_user_id.clone());
     let email_deref = data.email.as_deref().map(str::to_lowercase);
-    let email = diesel_option_overwrite(&email_deref);
+    let email = diesel_option_overwrite(email_deref.clone());
 
     if let Some(Some(email)) = &email {
       let previous_email = local_user_view.local_user.email.clone().unwrap_or_default();
       // Only send the verification email if there was an email change
       if previous_email.ne(email) {
-        send_verification_email(&local_user_view, email, context.pool(), context.settings())
-          .await?;
+        send_verification_email(
+          &local_user_view,
+          email,
+          &mut context.pool(),
+          context.settings(),
+        )
+        .await?;
       }
     }
 
     // When the site requires email, make sure email is not Some(None). IE, an overwrite to a None value
     if let Some(email) = &email {
       if email.is_none() && site_view.local_site.require_email_verification {
-        return Err(LemmyError::from_message("email_required"));
+        return Err(LemmyErrorType::EmailRequired)?;
       }
     }
 
@@ -80,6 +88,7 @@ impl Perform for SaveUserSettings {
     let person_id = local_user_view.person.id;
     let default_listing_type = data.default_listing_type;
     let default_sort_type = data.default_sort_type;
+    let theme = sanitize_html_opt(&data.theme);
 
     let person_form = PersonUpdateForm::builder()
       .display_name(display_name)
@@ -90,12 +99,12 @@ impl Perform for SaveUserSettings {
       .banner(banner)
       .build();
 
-    Person::update(context.pool(), person_id, &person_form)
+    Person::update(&mut context.pool(), person_id, &person_form)
       .await
-      .map_err(|e| LemmyError::from_error_message(e, "user_already_exists"))?;
+      .with_lemmy_type(LemmyErrorType::UserAlreadyExists)?;
 
     if let Some(discussion_languages) = data.discussion_languages.clone() {
-      LocalUserLanguage::update(context.pool(), discussion_languages, local_user_id).await?;
+      LocalUserLanguage::update(&mut context.pool(), discussion_languages, local_user_id).await?;
     }
 
     // If generate_totp is Some(false), this will clear it out from the database.
@@ -119,29 +128,34 @@ impl Perform for SaveUserSettings {
       .show_new_post_notifs(data.show_new_post_notifs)
       .send_notifications_to_email(data.send_notifications_to_email)
       .show_nsfw(data.show_nsfw)
+      .blur_nsfw(data.blur_nsfw)
+      .auto_expand(data.auto_expand)
       .show_bot_accounts(data.show_bot_accounts)
       .show_scores(data.show_scores)
       .default_sort_type(default_sort_type)
       .default_listing_type(default_listing_type)
-      .theme(data.theme.clone())
+      .theme(theme)
       .interface_language(data.interface_language.clone())
       .totp_2fa_secret(totp_2fa_secret)
       .totp_2fa_url(totp_2fa_url)
+      .open_links_in_new_tab(data.open_links_in_new_tab)
+      .infinite_scroll_enabled(data.infinite_scroll_enabled)
       .build();
 
-    let local_user_res = LocalUser::update(context.pool(), local_user_id, &local_user_form).await;
+    let local_user_res =
+      LocalUser::update(&mut context.pool(), local_user_id, &local_user_form).await;
     let updated_local_user = match local_user_res {
       Ok(u) => u,
       Err(e) => {
         let err_type = if e.to_string()
           == "duplicate key value violates unique constraint \"local_user_email_key\""
         {
-          "email_already_exists"
+          LemmyErrorType::EmailAlreadyExists
         } else {
-          "user_already_exists"
+          LemmyErrorType::UserAlreadyExists
         };
 
-        return Err(LemmyError::from_error_message(e, err_type));
+        return Err(e).with_lemmy_type(err_type);
       }
     };