]> Untitled Git - lemmy.git/blobdiff - crates/api_crud/src/comment/create.rs
Sanitize html (#3708)
[lemmy.git] / crates / api_crud / src / comment / create.rs
index 1b0289b42e54e5f263312376ef465528ad516ada..4a7513a4b50f0dc2bbfe2859836652bb2c6444a5 100644 (file)
 use crate::PerformCrud;
 use actix_web::web::Data;
 use lemmy_api_common::{
-  blocking,
-  check_community_ban,
-  check_community_deleted_or_removed,
-  check_post_deleted_or_removed,
-  comment::*,
-  get_local_user_view_from_jwt,
-  get_post,
-};
-use lemmy_apub::{
-  fetcher::post_or_comment::PostOrComment,
-  generate_local_apub_endpoint,
-  objects::comment::ApubComment,
-  protocol::activities::{
-    create_or_update::comment::CreateOrUpdateComment,
-    voting::vote::{Vote, VoteType},
-    CreateOrUpdateType,
+  build_response::{build_comment_response, send_local_notifs},
+  comment::{CommentResponse, CreateComment},
+  context::LemmyContext,
+  utils::{
+    check_community_ban,
+    check_community_deleted_or_removed,
+    check_post_deleted_or_removed,
+    generate_local_apub_endpoint,
+    get_post,
+    local_site_to_slur_regex,
+    local_user_view_from_jwt,
+    sanitize_html,
+    EndpointType,
   },
-  EndpointType,
 };
 use lemmy_db_schema::{
+  impls::actor_language::default_post_language,
   source::{
-    comment::{Comment, CommentForm, CommentLike, CommentLikeForm},
-    person_mention::PersonMention,
+    actor_language::CommunityLanguage,
+    comment::{Comment, CommentInsertForm, CommentLike, CommentLikeForm, CommentUpdateForm},
+    comment_reply::{CommentReply, CommentReplyUpdateForm},
+    local_site::LocalSite,
+    person_mention::{PersonMention, PersonMentionUpdateForm},
   },
   traits::{Crud, Likeable},
 };
-use lemmy_db_views::comment_view::CommentView;
 use lemmy_utils::{
-  utils::{remove_slurs, scrape_text_for_mentions},
-  ConnectionId,
-  LemmyError,
-};
-use lemmy_websocket::{
-  send::{send_comment_ws_message, send_local_notifs},
-  LemmyContext,
-  UserOperationCrud,
+  error::{LemmyError, LemmyErrorExt, LemmyErrorType},
+  utils::{
+    mention::scrape_text_for_mentions,
+    slurs::remove_slurs,
+    validation::is_valid_body_field,
+  },
 };
 
+const MAX_COMMENT_DEPTH_LIMIT: usize = 100;
+
 #[async_trait::async_trait(?Send)]
 impl PerformCrud for CreateComment {
   type Response = CommentResponse;
 
-  #[tracing::instrument(skip(context, websocket_id))]
-  async fn perform(
-    &self,
-    context: &Data<LemmyContext>,
-    websocket_id: Option<ConnectionId>,
-  ) -> Result<CommentResponse, LemmyError> {
+  #[tracing::instrument(skip(context))]
+  async fn perform(&self, context: &Data<LemmyContext>) -> Result<CommentResponse, LemmyError> {
     let data: &CreateComment = self;
-    let local_user_view =
-      get_local_user_view_from_jwt(&data.auth, context.pool(), context.secret()).await?;
+    let local_user_view = local_user_view_from_jwt(&data.auth, context).await?;
+    let local_site = LocalSite::read(&mut context.pool()).await?;
 
-    let content_slurs_removed =
-      remove_slurs(&data.content.to_owned(), &context.settings().slur_regex());
+    let content = remove_slurs(
+      &data.content.clone(),
+      &local_site_to_slur_regex(&local_site),
+    );
+    is_valid_body_field(&Some(content.clone()), false)?;
+    let content = sanitize_html(&content);
 
     // Check for a community ban
     let post_id = data.post_id;
-    let post = get_post(post_id, context.pool()).await?;
+    let post = get_post(post_id, &mut context.pool()).await?;
     let community_id = post.community_id;
 
-    check_community_ban(local_user_view.person.id, community_id, context.pool()).await?;
-    check_community_deleted_or_removed(community_id, context.pool()).await?;
+    check_community_ban(local_user_view.person.id, community_id, &mut context.pool()).await?;
+    check_community_deleted_or_removed(community_id, &mut context.pool()).await?;
     check_post_deleted_or_removed(&post)?;
 
     // Check if post is locked, no new comments
     if post.locked {
-      return Err(LemmyError::from_message("locked"));
+      return Err(LemmyErrorType::Locked)?;
     }
 
-    // If there's a parent_id, check to make sure that comment is in that post
-    if let Some(parent_id) = data.parent_id {
-      // Make sure the parent comment exists
-      let parent = blocking(context.pool(), move |conn| Comment::read(conn, parent_id))
-        .await?
-        .map_err(LemmyError::from)
-        .map_err(|e| e.with_message("couldnt_create_comment"))?;
+    // Fetch the parent, if it exists
+    let parent_opt = if let Some(parent_id) = data.parent_id {
+      Comment::read(&mut context.pool(), parent_id).await.ok()
+    } else {
+      None
+    };
 
-      // Strange issue where sometimes the post ID is incorrect
+    // If there's a parent_id, check to make sure that comment is in that post
+    // Strange issue where sometimes the post ID of the parent comment is incorrect
+    if let Some(parent) = parent_opt.as_ref() {
       if parent.post_id != post_id {
-        return Err(LemmyError::from_message("couldnt_create_comment"));
+        return Err(LemmyErrorType::CouldntCreateComment)?;
       }
+      check_comment_depth(parent)?;
     }
 
-    let comment_form = CommentForm {
-      content: content_slurs_removed,
-      parent_id: data.parent_id.to_owned(),
-      post_id: data.post_id,
-      creator_id: local_user_view.person.id,
-      ..CommentForm::default()
+    CommunityLanguage::is_allowed_community_language(
+      &mut context.pool(),
+      data.language_id,
+      community_id,
+    )
+    .await?;
+
+    // attempt to set default language if none was provided
+    let language_id = match data.language_id {
+      Some(lid) => Some(lid),
+      None => {
+        default_post_language(
+          &mut context.pool(),
+          community_id,
+          local_user_view.local_user.id,
+        )
+        .await?
+      }
     };
 
+    let comment_form = CommentInsertForm::builder()
+      .content(content.clone())
+      .post_id(data.post_id)
+      .creator_id(local_user_view.person.id)
+      .language_id(language_id)
+      .build();
+
     // Create the comment
-    let comment_form2 = comment_form.clone();
-    let inserted_comment = blocking(context.pool(), move |conn| {
-      Comment::create(conn, &comment_form2)
-    })
-    .await?
-    .map_err(LemmyError::from)
-    .map_err(|e| e.with_message("couldnt_create_comment"))?;
+    let parent_path = parent_opt.clone().map(|t| t.path);
+    let inserted_comment =
+      Comment::create(&mut context.pool(), &comment_form, parent_path.as_ref())
+        .await
+        .with_lemmy_type(LemmyErrorType::CouldntCreateComment)?;
 
     // Necessary to update the ap_id
     let inserted_comment_id = inserted_comment.id;
     let protocol_and_hostname = context.settings().get_protocol_and_hostname();
 
-    let updated_comment: Comment =
-      blocking(context.pool(), move |conn| -> Result<Comment, LemmyError> {
-        let apub_id = generate_local_apub_endpoint(
-          EndpointType::Comment,
-          &inserted_comment_id.to_string(),
-          &protocol_and_hostname,
-        )?;
-        Ok(Comment::update_ap_id(conn, inserted_comment_id, apub_id)?)
-      })
-      .await?
-      .map_err(LemmyError::from)
-      .map_err(|e| e.with_message("couldnt_create_comment"))?;
+    let apub_id = generate_local_apub_endpoint(
+      EndpointType::Comment,
+      &inserted_comment_id.to_string(),
+      &protocol_and_hostname,
+    )?;
+    let updated_comment = Comment::update(
+      &mut context.pool(),
+      inserted_comment_id,
+      &CommentUpdateForm::builder().ap_id(Some(apub_id)).build(),
+    )
+    .await
+    .with_lemmy_type(LemmyErrorType::CouldntCreateComment)?;
 
     // Scan the comment for user mentions, add those rows
-    let post_id = post.id;
-    let mentions = scrape_text_for_mentions(&comment_form.content);
+    let mentions = scrape_text_for_mentions(&content);
     let recipient_ids = send_local_notifs(
       mentions,
       &updated_comment,
@@ -134,92 +151,61 @@ impl PerformCrud for CreateComment {
     // You like your own comment by default
     let like_form = CommentLikeForm {
       comment_id: inserted_comment.id,
-      post_id,
+      post_id: post.id,
       person_id: local_user_view.person.id,
       score: 1,
     };
 
-    let like = move |conn: &'_ _| CommentLike::like(conn, &like_form);
-    blocking(context.pool(), like)
-      .await?
-      .map_err(LemmyError::from)
-      .map_err(|e| e.with_message("couldnt_like_comment"))?;
-
-    let apub_comment: ApubComment = updated_comment.into();
-    CreateOrUpdateComment::send(
-      apub_comment.clone(),
-      &local_user_view.person.clone().into(),
-      CreateOrUpdateType::Create,
-      context,
-      &mut 0,
-    )
-    .await?;
-    let object = PostOrComment::Comment(Box::new(apub_comment));
-    Vote::send(
-      &object,
-      &local_user_view.person.clone().into(),
-      community_id,
-      VoteType::Like,
-      context,
-    )
-    .await?;
+    CommentLike::like(&mut context.pool(), &like_form)
+      .await
+      .with_lemmy_type(LemmyErrorType::CouldntLikeComment)?;
 
-    let person_id = local_user_view.person.id;
-    let comment_id = inserted_comment.id;
-    let comment_view = blocking(context.pool(), move |conn| {
-      CommentView::read(conn, comment_id, Some(person_id))
-    })
-    .await??;
-
-    // If its a comment to yourself, mark it as read
-    if local_user_view.person.id == comment_view.get_recipient_id() {
-      let comment_id = inserted_comment.id;
-      blocking(context.pool(), move |conn| {
-        Comment::update_read(conn, comment_id, true)
-      })
-      .await?
-      .map_err(LemmyError::from)
-      .map_err(|e| e.with_message("couldnt_update_comment"))?;
-    }
     // If its a reply, mark the parent as read
-    if let Some(parent_id) = data.parent_id {
-      let parent_comment = blocking(context.pool(), move |conn| {
-        CommentView::read(conn, parent_id, Some(person_id))
-      })
-      .await??;
-      if local_user_view.person.id == parent_comment.get_recipient_id() {
-        blocking(context.pool(), move |conn| {
-          Comment::update_read(conn, parent_id, true)
-        })
-        .await?
-        .map_err(LemmyError::from)
-        .map_err(|e| e.with_message("couldnt_update_parent_comment"))?;
+    if let Some(parent) = parent_opt {
+      let parent_id = parent.id;
+      let comment_reply = CommentReply::read_by_comment(&mut context.pool(), parent_id).await;
+      if let Ok(reply) = comment_reply {
+        CommentReply::update(
+          &mut context.pool(),
+          reply.id,
+          &CommentReplyUpdateForm { read: Some(true) },
+        )
+        .await
+        .with_lemmy_type(LemmyErrorType::CouldntUpdateReplies)?;
       }
+
       // If the parent has PersonMentions mark them as read too
       let person_id = local_user_view.person.id;
-      let person_mention = blocking(context.pool(), move |conn| {
-        PersonMention::read_by_comment_and_person(conn, parent_id, person_id)
-      })
-      .await?;
+      let person_mention =
+        PersonMention::read_by_comment_and_person(&mut context.pool(), parent_id, person_id).await;
       if let Ok(mention) = person_mention {
-        blocking(context.pool(), move |conn| {
-          PersonMention::update_read(conn, mention.id, true)
-        })
-        .await?
-        .map_err(LemmyError::from)
-        .map_err(|e| e.with_message("couldnt_update_person_mentions"))?;
+        PersonMention::update(
+          &mut context.pool(),
+          mention.id,
+          &PersonMentionUpdateForm { read: Some(true) },
+        )
+        .await
+        .with_lemmy_type(LemmyErrorType::CouldntUpdatePersonMentions)?;
       }
     }
 
-    send_comment_ws_message(
+    build_comment_response(
+      context,
       inserted_comment.id,
-      UserOperationCrud::CreateComment,
-      websocket_id,
-      data.form_id.to_owned(),
-      Some(local_user_view.person.id),
+      Some(local_user_view),
+      self.form_id.clone(),
       recipient_ids,
-      context,
     )
     .await
   }
 }
+
+pub fn check_comment_depth(comment: &Comment) -> Result<(), LemmyError> {
+  let path = &comment.path.0;
+  let length = path.split('.').count();
+  if length > MAX_COMMENT_DEPTH_LIMIT {
+    Err(LemmyErrorType::MaxCommentDepthReached)?
+  } else {
+    Ok(())
+  }
+}