]> Untitled Git - lemmy.git/blobdiff - crates/api_crud/src/comment/create.rs
Sanitize html (#3708)
[lemmy.git] / crates / api_crud / src / comment / create.rs
index 1b772cd84c51a19be17dbeb6633786d320b837f2..4a7513a4b50f0dc2bbfe2859836652bb2c6444a5 100644 (file)
 use crate::PerformCrud;
 use actix_web::web::Data;
 use lemmy_api_common::{
-  blocking,
-  check_community_ban,
-  comment::*,
-  get_local_user_view_from_jwt,
-  get_post,
-  send_local_notifs,
+  build_response::{build_comment_response, send_local_notifs},
+  comment::{CommentResponse, CreateComment},
+  context::LemmyContext,
+  utils::{
+    check_community_ban,
+    check_community_deleted_or_removed,
+    check_post_deleted_or_removed,
+    generate_local_apub_endpoint,
+    get_post,
+    local_site_to_slur_regex,
+    local_user_view_from_jwt,
+    sanitize_html,
+    EndpointType,
+  },
 };
-use lemmy_apub::{
-  activities::{comment::create_or_update::CreateOrUpdateComment, CreateOrUpdateType},
-  generate_apub_endpoint,
-  ApubLikeableType,
-  EndpointType,
+use lemmy_db_schema::{
+  impls::actor_language::default_post_language,
+  source::{
+    actor_language::CommunityLanguage,
+    comment::{Comment, CommentInsertForm, CommentLike, CommentLikeForm, CommentUpdateForm},
+    comment_reply::{CommentReply, CommentReplyUpdateForm},
+    local_site::LocalSite,
+    person_mention::{PersonMention, PersonMentionUpdateForm},
+  },
+  traits::{Crud, Likeable},
 };
-use lemmy_db_queries::{source::comment::Comment_, Crud, Likeable};
-use lemmy_db_schema::source::comment::*;
-use lemmy_db_views::comment_view::CommentView;
 use lemmy_utils::{
-  utils::{remove_slurs, scrape_text_for_mentions},
-  ApiError,
-  ConnectionId,
-  LemmyError,
+  error::{LemmyError, LemmyErrorExt, LemmyErrorType},
+  utils::{
+    mention::scrape_text_for_mentions,
+    slurs::remove_slurs,
+    validation::is_valid_body_field,
+  },
 };
-use lemmy_websocket::{messages::SendComment, LemmyContext, UserOperationCrud};
+
+const MAX_COMMENT_DEPTH_LIMIT: usize = 100;
 
 #[async_trait::async_trait(?Send)]
 impl PerformCrud for CreateComment {
   type Response = CommentResponse;
 
-  async fn perform(
-    &self,
-    context: &Data<LemmyContext>,
-    websocket_id: Option<ConnectionId>,
-  ) -> Result<CommentResponse, LemmyError> {
+  #[tracing::instrument(skip(context))]
+  async fn perform(&self, context: &Data<LemmyContext>) -> Result<CommentResponse, LemmyError> {
     let data: &CreateComment = self;
-    let local_user_view = get_local_user_view_from_jwt(&data.auth, context.pool()).await?;
+    let local_user_view = local_user_view_from_jwt(&data.auth, context).await?;
+    let local_site = LocalSite::read(&mut context.pool()).await?;
 
-    let content_slurs_removed = remove_slurs(&data.content.to_owned());
+    let content = remove_slurs(
+      &data.content.clone(),
+      &local_site_to_slur_regex(&local_site),
+    );
+    is_valid_body_field(&Some(content.clone()), false)?;
+    let content = sanitize_html(&content);
 
     // Check for a community ban
     let post_id = data.post_id;
-    let post = get_post(post_id, context.pool()).await?;
+    let post = get_post(post_id, &mut context.pool()).await?;
+    let community_id = post.community_id;
 
-    check_community_ban(local_user_view.person.id, post.community_id, context.pool()).await?;
+    check_community_ban(local_user_view.person.id, community_id, &mut context.pool()).await?;
+    check_community_deleted_or_removed(community_id, &mut context.pool()).await?;
+    check_post_deleted_or_removed(&post)?;
 
     // Check if post is locked, no new comments
     if post.locked {
-      return Err(ApiError::err("locked").into());
+      return Err(LemmyErrorType::Locked)?;
     }
 
+    // Fetch the parent, if it exists
+    let parent_opt = if let Some(parent_id) = data.parent_id {
+      Comment::read(&mut context.pool(), parent_id).await.ok()
+    } else {
+      None
+    };
+
     // If there's a parent_id, check to make sure that comment is in that post
-    if let Some(parent_id) = data.parent_id {
-      // Make sure the parent comment exists
-      let parent = blocking(context.pool(), move |conn| Comment::read(conn, parent_id))
-        .await?
-        .map_err(|_| ApiError::err("couldnt_create_comment"))?;
+    // Strange issue where sometimes the post ID of the parent comment is incorrect
+    if let Some(parent) = parent_opt.as_ref() {
       if parent.post_id != post_id {
-        return Err(ApiError::err("couldnt_create_comment").into());
+        return Err(LemmyErrorType::CouldntCreateComment)?;
       }
+      check_comment_depth(parent)?;
     }
 
-    let comment_form = CommentForm {
-      content: content_slurs_removed,
-      parent_id: data.parent_id.to_owned(),
-      post_id: data.post_id,
-      creator_id: local_user_view.person.id,
-      ..CommentForm::default()
+    CommunityLanguage::is_allowed_community_language(
+      &mut context.pool(),
+      data.language_id,
+      community_id,
+    )
+    .await?;
+
+    // attempt to set default language if none was provided
+    let language_id = match data.language_id {
+      Some(lid) => Some(lid),
+      None => {
+        default_post_language(
+          &mut context.pool(),
+          community_id,
+          local_user_view.local_user.id,
+        )
+        .await?
+      }
     };
 
+    let comment_form = CommentInsertForm::builder()
+      .content(content.clone())
+      .post_id(data.post_id)
+      .creator_id(local_user_view.person.id)
+      .language_id(language_id)
+      .build();
+
     // Create the comment
-    let comment_form2 = comment_form.clone();
-    let inserted_comment = blocking(context.pool(), move |conn| {
-      Comment::create(conn, &comment_form2)
-    })
-    .await?
-    .map_err(|_| ApiError::err("couldnt_create_comment"))?;
+    let parent_path = parent_opt.clone().map(|t| t.path);
+    let inserted_comment =
+      Comment::create(&mut context.pool(), &comment_form, parent_path.as_ref())
+        .await
+        .with_lemmy_type(LemmyErrorType::CouldntCreateComment)?;
 
     // Necessary to update the ap_id
     let inserted_comment_id = inserted_comment.id;
-    let updated_comment: Comment =
-      blocking(context.pool(), move |conn| -> Result<Comment, LemmyError> {
-        let apub_id =
-          generate_apub_endpoint(EndpointType::Comment, &inserted_comment_id.to_string())?;
-        Ok(Comment::update_ap_id(conn, inserted_comment_id, apub_id)?)
-      })
-      .await?
-      .map_err(|_| ApiError::err("couldnt_create_comment"))?;
-
-    CreateOrUpdateComment::send(
-      &updated_comment,
-      &local_user_view.person,
-      CreateOrUpdateType::Create,
-      context,
+    let protocol_and_hostname = context.settings().get_protocol_and_hostname();
+
+    let apub_id = generate_local_apub_endpoint(
+      EndpointType::Comment,
+      &inserted_comment_id.to_string(),
+      &protocol_and_hostname,
+    )?;
+    let updated_comment = Comment::update(
+      &mut context.pool(),
+      inserted_comment_id,
+      &CommentUpdateForm::builder().ap_id(Some(apub_id)).build(),
     )
-    .await?;
+    .await
+    .with_lemmy_type(LemmyErrorType::CouldntCreateComment)?;
 
     // Scan the comment for user mentions, add those rows
-    let post_id = post.id;
-    let mentions = scrape_text_for_mentions(&comment_form.content);
+    let mentions = scrape_text_for_mentions(&content);
     let recipient_ids = send_local_notifs(
       mentions,
-      updated_comment.clone(),
-      local_user_view.person.clone(),
-      post,
-      context.pool(),
+      &updated_comment,
+      &local_user_view.person,
+      &post,
       true,
+      context,
     )
     .await?;
 
     // You like your own comment by default
     let like_form = CommentLikeForm {
       comment_id: inserted_comment.id,
-      post_id,
+      post_id: post.id,
       person_id: local_user_view.person.id,
       score: 1,
     };
 
-    let like = move |conn: &'_ _| CommentLike::like(conn, &like_form);
-    if blocking(context.pool(), like).await?.is_err() {
-      return Err(ApiError::err("couldnt_like_comment").into());
-    }
+    CommentLike::like(&mut context.pool(), &like_form)
+      .await
+      .with_lemmy_type(LemmyErrorType::CouldntLikeComment)?;
+
+    // If its a reply, mark the parent as read
+    if let Some(parent) = parent_opt {
+      let parent_id = parent.id;
+      let comment_reply = CommentReply::read_by_comment(&mut context.pool(), parent_id).await;
+      if let Ok(reply) = comment_reply {
+        CommentReply::update(
+          &mut context.pool(),
+          reply.id,
+          &CommentReplyUpdateForm { read: Some(true) },
+        )
+        .await
+        .with_lemmy_type(LemmyErrorType::CouldntUpdateReplies)?;
+      }
 
-    updated_comment
-      .send_like(&local_user_view.person, context)
-      .await?;
-
-    let person_id = local_user_view.person.id;
-    let mut comment_view = blocking(context.pool(), move |conn| {
-      CommentView::read(conn, inserted_comment.id, Some(person_id))
-    })
-    .await??;
-
-    // If its a comment to yourself, mark it as read
-    let comment_id = comment_view.comment.id;
-    if local_user_view.person.id == comment_view.get_recipient_id() {
-      blocking(context.pool(), move |conn| {
-        Comment::update_read(conn, comment_id, true)
-      })
-      .await?
-      .map_err(|_| ApiError::err("couldnt_update_comment"))?;
-      comment_view.comment.read = true;
+      // If the parent has PersonMentions mark them as read too
+      let person_id = local_user_view.person.id;
+      let person_mention =
+        PersonMention::read_by_comment_and_person(&mut context.pool(), parent_id, person_id).await;
+      if let Ok(mention) = person_mention {
+        PersonMention::update(
+          &mut context.pool(),
+          mention.id,
+          &PersonMentionUpdateForm { read: Some(true) },
+        )
+        .await
+        .with_lemmy_type(LemmyErrorType::CouldntUpdatePersonMentions)?;
+      }
     }
 
-    let mut res = CommentResponse {
-      comment_view,
+    build_comment_response(
+      context,
+      inserted_comment.id,
+      Some(local_user_view),
+      self.form_id.clone(),
       recipient_ids,
-      form_id: data.form_id.to_owned(),
-    };
-
-    context.chat_server().do_send(SendComment {
-      op: UserOperationCrud::CreateComment,
-      comment: res.clone(),
-      websocket_id,
-    });
-
-    res.recipient_ids = Vec::new(); // Necessary to avoid doubles
+    )
+    .await
+  }
+}
 
-    Ok(res)
+pub fn check_comment_depth(comment: &Comment) -> Result<(), LemmyError> {
+  let path = &comment.path.0;
+  let length = path.split('.').count();
+  if length > MAX_COMMENT_DEPTH_LIMIT {
+    Err(LemmyErrorType::MaxCommentDepthReached)?
+  } else {
+    Ok(())
   }
 }