]> Untitled Git - lemmy.git/blobdiff - crates/api_crud/src/site/update.rs
Sanitize html (#3708)
[lemmy.git] / crates / api_crud / src / site / update.rs
index c9f97e8dfab9d0c7f295a3ba3207dc3792d478a3..2b8ce4c0f3f1957252944d760db5b1769bef10ec 100644 (file)
@@ -6,7 +6,12 @@ use actix_web::web::Data;
 use lemmy_api_common::{
   context::LemmyContext,
   site::{EditSite, SiteResponse},
-  utils::{is_admin, local_site_rate_limit_to_rate_limit_config, local_user_view_from_jwt},
+  utils::{
+    is_admin,
+    local_site_rate_limit_to_rate_limit_config,
+    local_user_view_from_jwt,
+    sanitize_html_opt,
+  },
 };
 use lemmy_db_schema::{
   source::{
@@ -25,7 +30,7 @@ use lemmy_db_schema::{
 };
 use lemmy_db_views::structs::SiteView;
 use lemmy_utils::{
-  error::{LemmyError, LemmyResult},
+  error::{LemmyError, LemmyErrorExt, LemmyErrorType, LemmyResult},
   utils::{
     slurs::check_slurs_opt,
     validation::{
@@ -46,7 +51,7 @@ impl PerformCrud for EditSite {
   async fn perform(&self, context: &Data<LemmyContext>) -> Result<SiteResponse, LemmyError> {
     let data: &EditSite = self;
     let local_user_view = local_user_view_from_jwt(&data.auth, context).await?;
-    let site_view = SiteView::read_local(context.pool()).await?;
+    let site_view = SiteView::read_local(&mut context.pool()).await?;
     let local_site = site_view.local_site;
     let site = site_view.site;
 
@@ -56,39 +61,47 @@ impl PerformCrud for EditSite {
     validate_update_payload(&local_site, data)?;
 
     if let Some(discussion_languages) = data.discussion_languages.clone() {
-      SiteLanguage::update(context.pool(), discussion_languages.clone(), &site).await?;
+      SiteLanguage::update(&mut context.pool(), discussion_languages.clone(), &site).await?;
     }
 
+    let name = sanitize_html_opt(&data.name);
+    let sidebar = sanitize_html_opt(&data.sidebar);
+    let description = sanitize_html_opt(&data.description);
+
     let site_form = SiteUpdateForm::builder()
-      .name(data.name.clone())
-      .sidebar(diesel_option_overwrite(&data.sidebar))
-      .description(diesel_option_overwrite(&data.description))
+      .name(name)
+      .sidebar(diesel_option_overwrite(sidebar))
+      .description(diesel_option_overwrite(description))
       .icon(diesel_option_overwrite_to_url(&data.icon)?)
       .banner(diesel_option_overwrite_to_url(&data.banner)?)
       .updated(Some(Some(naive_now())))
       .build();
 
-    Site::update(context.pool(), site.id, &site_form)
+    Site::update(&mut context.pool(), site.id, &site_form)
       .await
       // Ignore errors for all these, so as to not throw errors if no update occurs
       // Diesel will throw an error for empty update forms
       .ok();
 
+    let application_question = sanitize_html_opt(&data.application_question);
+    let default_theme = sanitize_html_opt(&data.default_theme);
+    let legal_information = sanitize_html_opt(&data.legal_information);
+
     let local_site_form = LocalSiteUpdateForm::builder()
       .enable_downvotes(data.enable_downvotes)
       .registration_mode(data.registration_mode)
       .enable_nsfw(data.enable_nsfw)
       .community_creation_admin_only(data.community_creation_admin_only)
       .require_email_verification(data.require_email_verification)
-      .application_question(diesel_option_overwrite(&data.application_question))
+      .application_question(diesel_option_overwrite(application_question))
       .private_instance(data.private_instance)
-      .default_theme(data.default_theme.clone())
+      .default_theme(default_theme)
       .default_post_listing_type(data.default_post_listing_type)
-      .legal_information(diesel_option_overwrite(&data.legal_information))
+      .legal_information(diesel_option_overwrite(legal_information))
       .application_email_admins(data.application_email_admins)
       .hide_modlog_mod_names(data.hide_modlog_mod_names)
       .updated(Some(Some(naive_now())))
-      .slur_filter_regex(diesel_option_overwrite(&data.slur_filter_regex))
+      .slur_filter_regex(diesel_option_overwrite(data.slur_filter_regex.clone()))
       .actor_name_max_length(data.actor_name_max_length)
       .federation_enabled(data.federation_enabled)
       .captcha_enabled(data.captcha_enabled)
@@ -96,7 +109,7 @@ impl PerformCrud for EditSite {
       .reports_email_admins(data.reports_email_admins)
       .build();
 
-    let update_local_site = LocalSite::update(context.pool(), &local_site_form)
+    let update_local_site = LocalSite::update(&mut context.pool(), &local_site_form)
       .await
       .ok();
 
@@ -115,15 +128,15 @@ impl PerformCrud for EditSite {
       .search_per_second(data.rate_limit_search_per_second)
       .build();
 
-    LocalSiteRateLimit::update(context.pool(), &local_site_rate_limit_form)
+    LocalSiteRateLimit::update(&mut context.pool(), &local_site_rate_limit_form)
       .await
       .ok();
 
     // Replace the blocked and allowed instances
     let allowed = data.allowed_instances.clone();
-    FederationAllowList::replace(context.pool(), allowed).await?;
+    FederationAllowList::replace(&mut context.pool(), allowed).await?;
     let blocked = data.blocked_instances.clone();
-    FederationBlockList::replace(context.pool(), blocked).await?;
+    FederationBlockList::replace(&mut context.pool(), blocked).await?;
 
     // TODO can't think of a better way to do this.
     // If the server suddenly requires email verification, or required applications, no old users
@@ -137,9 +150,9 @@ impl PerformCrud for EditSite {
       .map(|ols| ols.registration_mode == RegistrationMode::RequireApplication)
       .unwrap_or(false);
     if !old_require_application && new_require_application {
-      LocalUser::set_all_users_registration_applications_accepted(context.pool())
+      LocalUser::set_all_users_registration_applications_accepted(&mut context.pool())
         .await
-        .map_err(|e| LemmyError::from_error_message(e, "couldnt_set_all_registrations_accepted"))?;
+        .with_lemmy_type(LemmyErrorType::CouldntSetAllRegistrationsAccepted)?;
     }
 
     let new_require_email_verification = update_local_site
@@ -147,15 +160,15 @@ impl PerformCrud for EditSite {
       .map(|ols| ols.require_email_verification)
       .unwrap_or(false);
     if !local_site.require_email_verification && new_require_email_verification {
-      LocalUser::set_all_users_email_verified(context.pool())
+      LocalUser::set_all_users_email_verified(&mut context.pool())
         .await
-        .map_err(|e| LemmyError::from_error_message(e, "couldnt_set_all_email_verified"))?;
+        .with_lemmy_type(LemmyErrorType::CouldntSetAllEmailVerified)?;
     }
 
     let new_taglines = data.taglines.clone();
-    let taglines = Tagline::replace(context.pool(), local_site.id, new_taglines).await?;
+    let taglines = Tagline::replace(&mut context.pool(), local_site.id, new_taglines).await?;
 
-    let site_view = SiteView::read_local(context.pool()).await?;
+    let site_view = SiteView::read_local(&mut context.pool()).await?;
 
     let rate_limit_config =
       local_site_rate_limit_to_rate_limit_config(&site_view.local_site_rate_limit);
@@ -217,16 +230,20 @@ fn validate_update_payload(local_site: &LocalSite, edit_site: &EditSite) -> Lemm
 
 #[cfg(test)]
 mod tests {
+  #![allow(clippy::unwrap_used)]
+  #![allow(clippy::indexing_slicing)]
+
   use crate::site::update::validate_update_payload;
   use lemmy_api_common::site::EditSite;
   use lemmy_db_schema::{source::local_site::LocalSite, ListingType, RegistrationMode};
+  use lemmy_utils::error::LemmyErrorType;
 
   #[test]
   fn test_validate_invalid_update_payload() {
     let invalid_payloads = [
       (
         "EditSite name matches LocalSite slur filter",
-        "slurs",
+        LemmyErrorType::Slurs,
         &generate_local_site(
           Some(String::from("(foo|bar)")),
           true,
@@ -248,7 +265,7 @@ mod tests {
       ),
       (
         "EditSite name matches new slur filter",
-        "slurs",
+        LemmyErrorType::Slurs,
         &generate_local_site(
           Some(String::from("(foo|bar)")),
           true,
@@ -270,7 +287,7 @@ mod tests {
       ),
       (
         "EditSite listing type is Subscribed, which is invalid",
-        "invalid_default_post_listing_type",
+        LemmyErrorType::InvalidDefaultPostListingType,
         &generate_local_site(
           None::<String>,
           true,
@@ -292,7 +309,7 @@ mod tests {
       ),
       (
         "EditSite is both private and federated",
-        "cant_enable_private_instance_and_federation_together",
+        LemmyErrorType::CantEnablePrivateInstanceAndFederationTogether,
         &generate_local_site(
           None::<String>,
           true,
@@ -314,7 +331,7 @@ mod tests {
       ),
       (
         "LocalSite is private, but EditSite also makes it federated",
-        "cant_enable_private_instance_and_federation_together",
+        LemmyErrorType::CantEnablePrivateInstanceAndFederationTogether,
         &generate_local_site(
           None::<String>,
           true,
@@ -336,7 +353,7 @@ mod tests {
       ),
       (
         "EditSite requires application, but neither it nor LocalSite has an application question",
-        "application_question_required",
+        LemmyErrorType::ApplicationQuestionRequired,
         &generate_local_site(
           None::<String>,
           true,
@@ -361,7 +378,7 @@ mod tests {
     invalid_payloads.iter().enumerate().for_each(
       |(
          idx,
-         &(reason, expected_err, local_site, edit_site),
+         &(reason, ref expected_err, local_site, edit_site),
        )| {
         match validate_update_payload(local_site, edit_site) {
           Ok(_) => {
@@ -372,9 +389,9 @@ mod tests {
           }
           Err(error) => {
             assert!(
-              error.message.eq(&Some(String::from(expected_err))),
+              error.error_type.eq(&expected_err.clone()),
               "Got Err {:?}, but should have failed with message: {} for reason: {}. invalid_payloads.nth({})",
-              error.message,
+              error.error_type,
               expected_err,
               reason,
               idx