Sanitize html (#3708)

[lemmy.git] / crates / apub / src / activities / block / block_user.rs

diff --git a/crates/apub/src/activities/block/block_user.rs b/crates/apub/src/activities/block/block_user.rs
index a2f96fd5d458506db28206e24c694eb9a69b7bc2..abfab84565fd1f09d1ca895f84ae61f61e3d7ff9 100644 (file)
--- a/crates/apub/src/activities/block/block_user.rs
+++ b/crates/apub/src/activities/block/block_user.rs
@@ -9,23 +9,21 @@ use crate::{
     verify_person_in_community,
   },
   activity_lists::AnnouncableActivities,
-  local_instance,
+  insert_received_activity,
   objects::{instance::remote_instance_inboxes, person::ApubPerson},
   protocol::activities::block::block_user::BlockUser,
-  ActorType,
 };
 use activitypub_federation::{
-  core::object_id::ObjectId,
-  data::Data,
+  config::Data,
+  kinds::{activity::BlockType, public},
+  protocol::verification::verify_domains_match,
   traits::{ActivityHandler, Actor},
-  utils::verify_domains_match,
 };
-use activitystreams_kinds::{activity::BlockType, public};
 use anyhow::anyhow;
 use chrono::NaiveDateTime;
 use lemmy_api_common::{
   context::LemmyContext,
-  utils::{remove_user_data, remove_user_data_in_community},
+  utils::{remove_user_data, remove_user_data_in_community, sanitize_html_opt},
 };
 use lemmy_db_schema::{
   source::{
@@ -51,18 +49,18 @@ impl BlockUser {
     remove_data: Option<bool>,
     reason: Option<String>,
     expires: Option<NaiveDateTime>,
-    context: &LemmyContext,
+    context: &Data<LemmyContext>,
   ) -> Result<BlockUser, LemmyError> {
     let audience = if let SiteOrCommunity::Community(c) = target {
-      Some(ObjectId::new(c.actor_id()))
+      Some(c.id().into())
     } else {
       None
     };
     Ok(BlockUser {
-      actor: ObjectId::new(mod_.actor_id()),
+      actor: mod_.id().into(),
       to: vec![public()],
-      object: ObjectId::new(user.actor_id()),
-      cc: generate_cc(target, context.pool()).await?,
+      object: user.id().into(),
+      cc: generate_cc(target, &mut context.pool()).await?,
       target: target.id(),
       kind: BlockType::Block,
       remove_data,
@@ -84,7 +82,7 @@ impl BlockUser {
     remove_data: bool,
     reason: Option<String>,
     expires: Option<NaiveDateTime>,
-    context: &LemmyContext,
+    context: &Data<LemmyContext>,
   ) -> Result<(), LemmyError> {
     let block = BlockUser::new(
       target,
@@ -99,7 +97,7 @@ impl BlockUser {
 
     match target {
       SiteOrCommunity::Site(_) => {
-        let inboxes = remote_instance_inboxes(context.pool()).await?;
+        let inboxes = remote_instance_inboxes(&mut context.pool()).await?;
         send_lemmy_activity(context, block, mod_, inboxes, false).await
       }
       SiteOrCommunity::Community(c) => {
@@ -111,7 +109,7 @@ impl BlockUser {
   }
 }
 
-#[async_trait::async_trait(?Send)]
+#[async_trait::async_trait]
 impl ActivityHandler for BlockUser {
   type DataType = LemmyContext;
   type Error = LemmyError;
@@ -125,17 +123,10 @@ impl ActivityHandler for BlockUser {
   }
 
   #[tracing::instrument(skip_all)]
-  async fn verify(
-    &self,
-    context: &Data<LemmyContext>,
-    request_counter: &mut i32,
-  ) -> Result<(), LemmyError> {
+  async fn verify(&self, context: &Data<LemmyContext>) -> Result<(), LemmyError> {
+    insert_received_activity(&self.id, context).await?;
     verify_is_public(&self.to, &self.cc)?;
-    match self
-      .target
-      .dereference(context, local_instance(context).await, request_counter)
-      .await?
-    {
+    match self.target.dereference(context).await? {
       SiteOrCommunity::Site(site) => {
         let domain = self.object.inner().domain().expect("url needs domain");
         if context.settings().hostname == domain {
@@ -144,47 +135,27 @@ impl ActivityHandler for BlockUser {
           );
         }
         // site ban can only target a user who is on the same instance as the actor (admin)
-        verify_domains_match(&site.actor_id(), self.actor.inner())?;
-        verify_domains_match(&site.actor_id(), self.object.inner())?;
+        verify_domains_match(&site.id(), self.actor.inner())?;
+        verify_domains_match(&site.id(), self.object.inner())?;
       }
       SiteOrCommunity::Community(community) => {
-        verify_person_in_community(&self.actor, &community, context, request_counter).await?;
-        verify_mod_action(
-          &self.actor,
-          self.object.inner(),
-          community.id,
-          context,
-          request_counter,
-        )
-        .await?;
+        verify_person_in_community(&self.actor, &community, context).await?;
+        verify_mod_action(&self.actor, self.object.inner(), community.id, context).await?;
       }
     }
     Ok(())
   }
 
   #[tracing::instrument(skip_all)]
-  async fn receive(
-    self,
-    context: &Data<LemmyContext>,
-    request_counter: &mut i32,
-  ) -> Result<(), LemmyError> {
+  async fn receive(self, context: &Data<LemmyContext>) -> Result<(), LemmyError> {
     let expires = self.expires.map(|u| u.naive_local());
-    let mod_person = self
-      .actor
-      .dereference(context, local_instance(context).await, request_counter)
-      .await?;
-    let blocked_person = self
-      .object
-      .dereference(context, local_instance(context).await, request_counter)
-      .await?;
-    let target = self
-      .target
-      .dereference(context, local_instance(context).await, request_counter)
-      .await?;
+    let mod_person = self.actor.dereference(context).await?;
+    let blocked_person = self.object.dereference(context).await?;
+    let target = self.target.dereference(context).await?;
     match target {
       SiteOrCommunity::Site(_site) => {
         let blocked_person = Person::update(
-          context.pool(),
+          &mut context.pool(),
           blocked_person.id,
           &PersonUpdateForm::builder()
             .banned(Some(true))
@@ -195,7 +166,7 @@ impl ActivityHandler for BlockUser {
         if self.remove_data.unwrap_or(false) {
           remove_user_data(
             blocked_person.id,
-            context.pool(),
+            &mut context.pool(),
             context.settings(),
             context.client(),
           )
@@ -206,11 +177,11 @@ impl ActivityHandler for BlockUser {
         let form = ModBanForm {
           mod_person_id: mod_person.id,
           other_person_id: blocked_person.id,
-          reason: self.summary,
+          reason: sanitize_html_opt(&self.summary),
           banned: Some(true),
           expires,
         };
-        ModBan::create(context.pool(), &form).await?;
+        ModBan::create(&mut context.pool(), &form).await?;
       }
       SiteOrCommunity::Community(community) => {
         let community_user_ban_form = CommunityPersonBanForm {
@@ -218,7 +189,7 @@ impl ActivityHandler for BlockUser {
           person_id: blocked_person.id,
           expires: Some(expires),
         };
-        CommunityPersonBan::ban(context.pool(), &community_user_ban_form).await?;
+        CommunityPersonBan::ban(&mut context.pool(), &community_user_ban_form).await?;
 
         // Also unsubscribe them from the community, if they are subscribed
         let community_follower_form = CommunityFollowerForm {
@@ -226,12 +197,13 @@ impl ActivityHandler for BlockUser {
           person_id: blocked_person.id,
           pending: false,
         };
-        CommunityFollower::unfollow(context.pool(), &community_follower_form)
+        CommunityFollower::unfollow(&mut context.pool(), &community_follower_form)
           .await
           .ok();
 
         if self.remove_data.unwrap_or(false) {
-          remove_user_data_in_community(community.id, blocked_person.id, context.pool()).await?;
+          remove_user_data_in_community(community.id, blocked_person.id, &mut context.pool())
+            .await?;
         }
 
         // write to mod log
@@ -239,11 +211,11 @@ impl ActivityHandler for BlockUser {
           mod_person_id: mod_person.id,
           other_person_id: blocked_person.id,
           community_id: community.id,
-          reason: self.summary,
+          reason: sanitize_html_opt(&self.summary),
           banned: Some(true),
           expires,
         };
-        ModBanFromCommunity::create(context.pool(), &form).await?;
+        ModBanFromCommunity::create(&mut context.pool(), &form).await?;
       }
     }