]> Untitled Git - lemmy.git/blobdiff - crates/api_crud/src/community/update.rs
Sanitize html (#3708)
[lemmy.git] / crates / api_crud / src / community / update.rs
index f28f771195f3c4ee04f5bb31760293f17e63bd2c..128be036fd241529c64e4d76a7907b0c77ecea4e 100644 (file)
@@ -1,97 +1,86 @@
-use crate::{community::send_community_websocket, PerformCrud};
+use crate::PerformCrud;
 use actix_web::web::Data;
 use lemmy_api_common::{
-  blocking,
+  build_response::build_community_response,
   community::{CommunityResponse, EditCommunity},
-  get_local_user_view_from_jwt,
+  context::LemmyContext,
+  utils::{local_site_to_slur_regex, local_user_view_from_jwt, sanitize_html_opt},
 };
-use lemmy_apub::CommunityType;
-use lemmy_db_queries::{diesel_option_overwrite_to_url, Crud};
 use lemmy_db_schema::{
-  naive_now,
-  source::community::{Community, CommunityForm},
-  PersonId,
+  newtypes::PersonId,
+  source::{
+    actor_language::{CommunityLanguage, SiteLanguage},
+    community::{Community, CommunityUpdateForm},
+    local_site::LocalSite,
+  },
+  traits::Crud,
+  utils::{diesel_option_overwrite, diesel_option_overwrite_to_url, naive_now},
 };
-use lemmy_db_views_actor::{
-  community_moderator_view::CommunityModeratorView,
-  community_view::CommunityView,
+use lemmy_db_views_actor::structs::CommunityModeratorView;
+use lemmy_utils::{
+  error::{LemmyError, LemmyErrorExt, LemmyErrorType},
+  utils::{slurs::check_slurs_opt, validation::is_valid_body_field},
 };
-use lemmy_utils::{utils::check_slurs_opt, ApiError, ConnectionId, LemmyError};
-use lemmy_websocket::{LemmyContext, UserOperationCrud};
 
 #[async_trait::async_trait(?Send)]
 impl PerformCrud for EditCommunity {
   type Response = CommunityResponse;
 
-  async fn perform(
-    &self,
-    context: &Data<LemmyContext>,
-    websocket_id: Option<ConnectionId>,
-  ) -> Result<CommunityResponse, LemmyError> {
-    let data: &EditCommunity = &self;
-    let local_user_view = get_local_user_view_from_jwt(&data.auth, context.pool()).await?;
+  #[tracing::instrument(skip(context))]
+  async fn perform(&self, context: &Data<LemmyContext>) -> Result<CommunityResponse, LemmyError> {
+    let data: &EditCommunity = self;
+    let local_user_view = local_user_view_from_jwt(&data.auth, context).await?;
+    let local_site = LocalSite::read(&mut context.pool()).await?;
 
-    check_slurs_opt(&data.title)?;
-    check_slurs_opt(&data.description)?;
+    let slur_regex = local_site_to_slur_regex(&local_site);
+    check_slurs_opt(&data.title, &slur_regex)?;
+    check_slurs_opt(&data.description, &slur_regex)?;
+    is_valid_body_field(&data.description, false)?;
 
-    // Verify its a mod (only mods can edit it)
-    let community_id = data.community_id;
-    let mods: Vec<PersonId> = blocking(context.pool(), move |conn| {
-      CommunityModeratorView::for_community(conn, community_id)
-        .map(|v| v.into_iter().map(|m| m.moderator.id).collect())
-    })
-    .await??;
-    if !mods.contains(&local_user_view.person.id) {
-      return Err(ApiError::err("not_a_moderator").into());
-    }
-
-    let community_id = data.community_id;
-    let read_community = blocking(context.pool(), move |conn| {
-      Community::read(conn, community_id)
-    })
-    .await??;
+    let title = sanitize_html_opt(&data.title);
+    let description = sanitize_html_opt(&data.description);
 
     let icon = diesel_option_overwrite_to_url(&data.icon)?;
     let banner = diesel_option_overwrite_to_url(&data.banner)?;
+    let description = diesel_option_overwrite(description);
 
-    let community_form = CommunityForm {
-      name: read_community.name,
-      title: data.title.to_owned().unwrap_or(read_community.title),
-      description: data.description.to_owned(),
-      icon,
-      banner,
-      nsfw: data.nsfw,
-      updated: Some(naive_now()),
-      ..CommunityForm::default()
-    };
-
+    // Verify its a mod (only mods can edit it)
     let community_id = data.community_id;
-    let updated_community = blocking(context.pool(), move |conn| {
-      Community::update(conn, community_id, &community_form)
-    })
-    .await?
-    .map_err(|_| ApiError::err("couldnt_update_community"))?;
-
-    updated_community
-      .send_update(local_user_view.person.to_owned(), context)
-      .await?;
+    let mods: Vec<PersonId> =
+      CommunityModeratorView::for_community(&mut context.pool(), community_id)
+        .await
+        .map(|v| v.into_iter().map(|m| m.moderator.id).collect())?;
+    if !mods.contains(&local_user_view.person.id) {
+      return Err(LemmyErrorType::NotAModerator)?;
+    }
 
     let community_id = data.community_id;
-    let person_id = local_user_view.person.id;
-    let community_view = blocking(context.pool(), move |conn| {
-      CommunityView::read(conn, community_id, Some(person_id))
-    })
-    .await??;
+    if let Some(languages) = data.discussion_languages.clone() {
+      let site_languages = SiteLanguage::read_local_raw(&mut context.pool()).await?;
+      // check that community languages are a subset of site languages
+      // https://stackoverflow.com/a/64227550
+      let is_subset = languages.iter().all(|item| site_languages.contains(item));
+      if !is_subset {
+        return Err(LemmyErrorType::LanguageNotAllowed)?;
+      }
+      CommunityLanguage::update(&mut context.pool(), languages, community_id).await?;
+    }
 
-    let res = CommunityResponse { community_view };
+    let community_form = CommunityUpdateForm::builder()
+      .title(title)
+      .description(description)
+      .icon(icon)
+      .banner(banner)
+      .nsfw(data.nsfw)
+      .posting_restricted_to_mods(data.posting_restricted_to_mods)
+      .updated(Some(Some(naive_now())))
+      .build();
 
-    send_community_websocket(
-      &res,
-      context,
-      websocket_id,
-      UserOperationCrud::EditCommunity,
-    );
+    let community_id = data.community_id;
+    Community::update(&mut context.pool(), community_id, &community_form)
+      .await
+      .with_lemmy_type(LemmyErrorType::CouldntUpdateCommunity)?;
 
-    Ok(res)
+    build_community_response(context, local_user_view, community_id).await
   }
 }