]> Untitled Git - lemmy.git/blobdiff - crates/apub/src/activities/block/block_user.rs
Sanitize html (#3708)
[lemmy.git] / crates / apub / src / activities / block / block_user.rs
index a701f8d90e0c573c6a6d318f31d6e7d85efba032..abfab84565fd1f09d1ca895f84ae61f61e3d7ff9 100644 (file)
@@ -1,7 +1,7 @@
 use crate::{
   activities::{
     block::{generate_cc, SiteOrCommunity},
-    community::{announce::GetCommunity, send_activity_in_community},
+    community::send_activity_in_community,
     generate_activity_id,
     send_lemmy_activity,
     verify_is_public,
@@ -9,21 +9,22 @@ use crate::{
     verify_person_in_community,
   },
   activity_lists::AnnouncableActivities,
-  local_instance,
-  objects::{community::ApubCommunity, instance::remote_instance_inboxes, person::ApubPerson},
+  insert_received_activity,
+  objects::{instance::remote_instance_inboxes, person::ApubPerson},
   protocol::activities::block::block_user::BlockUser,
-  ActorType,
 };
 use activitypub_federation::{
-  core::object_id::ObjectId,
-  data::Data,
+  config::Data,
+  kinds::{activity::BlockType, public},
+  protocol::verification::verify_domains_match,
   traits::{ActivityHandler, Actor},
-  utils::verify_domains_match,
 };
-use activitystreams_kinds::{activity::BlockType, public};
 use anyhow::anyhow;
 use chrono::NaiveDateTime;
-use lemmy_api_common::utils::{remove_user_data, remove_user_data_in_community};
+use lemmy_api_common::{
+  context::LemmyContext,
+  utils::{remove_user_data, remove_user_data_in_community, sanitize_html_opt},
+};
 use lemmy_db_schema::{
   source::{
     community::{
@@ -37,8 +38,7 @@ use lemmy_db_schema::{
   },
   traits::{Bannable, Crud, Followable},
 };
-use lemmy_utils::{error::LemmyError, utils::convert_datetime};
-use lemmy_websocket::LemmyContext;
+use lemmy_utils::{error::LemmyError, utils::time::convert_datetime};
 use url::Url;
 
 impl BlockUser {
@@ -49,13 +49,18 @@ impl BlockUser {
     remove_data: Option<bool>,
     reason: Option<String>,
     expires: Option<NaiveDateTime>,
-    context: &LemmyContext,
+    context: &Data<LemmyContext>,
   ) -> Result<BlockUser, LemmyError> {
+    let audience = if let SiteOrCommunity::Community(c) = target {
+      Some(c.id().into())
+    } else {
+      None
+    };
     Ok(BlockUser {
-      actor: ObjectId::new(mod_.actor_id()),
+      actor: mod_.id().into(),
       to: vec![public()],
-      object: ObjectId::new(user.actor_id()),
-      cc: generate_cc(target, context.pool()).await?,
+      object: user.id().into(),
+      cc: generate_cc(target, &mut context.pool()).await?,
       target: target.id(),
       kind: BlockType::Block,
       remove_data,
@@ -64,6 +69,7 @@ impl BlockUser {
         BlockType::Block,
         &context.settings().get_protocol_and_hostname(),
       )?,
+      audience,
       expires: expires.map(convert_datetime),
     })
   }
@@ -76,7 +82,7 @@ impl BlockUser {
     remove_data: bool,
     reason: Option<String>,
     expires: Option<NaiveDateTime>,
-    context: &LemmyContext,
+    context: &Data<LemmyContext>,
   ) -> Result<(), LemmyError> {
     let block = BlockUser::new(
       target,
@@ -91,7 +97,7 @@ impl BlockUser {
 
     match target {
       SiteOrCommunity::Site(_) => {
-        let inboxes = remote_instance_inboxes(context.pool()).await?;
+        let inboxes = remote_instance_inboxes(&mut context.pool()).await?;
         send_lemmy_activity(context, block, mod_, inboxes, false).await
       }
       SiteOrCommunity::Community(c) => {
@@ -103,7 +109,7 @@ impl BlockUser {
   }
 }
 
-#[async_trait::async_trait(?Send)]
+#[async_trait::async_trait]
 impl ActivityHandler for BlockUser {
   type DataType = LemmyContext;
   type Error = LemmyError;
@@ -117,17 +123,10 @@ impl ActivityHandler for BlockUser {
   }
 
   #[tracing::instrument(skip_all)]
-  async fn verify(
-    &self,
-    context: &Data<LemmyContext>,
-    request_counter: &mut i32,
-  ) -> Result<(), LemmyError> {
+  async fn verify(&self, context: &Data<LemmyContext>) -> Result<(), LemmyError> {
+    insert_received_activity(&self.id, context).await?;
     verify_is_public(&self.to, &self.cc)?;
-    match self
-      .target
-      .dereference(context, local_instance(context).await, request_counter)
-      .await?
-    {
+    match self.target.dereference(context).await? {
       SiteOrCommunity::Site(site) => {
         let domain = self.object.inner().domain().expect("url needs domain");
         if context.settings().hostname == domain {
@@ -136,47 +135,27 @@ impl ActivityHandler for BlockUser {
           );
         }
         // site ban can only target a user who is on the same instance as the actor (admin)
-        verify_domains_match(&site.actor_id(), self.actor.inner())?;
-        verify_domains_match(&site.actor_id(), self.object.inner())?;
+        verify_domains_match(&site.id(), self.actor.inner())?;
+        verify_domains_match(&site.id(), self.object.inner())?;
       }
       SiteOrCommunity::Community(community) => {
-        verify_person_in_community(&self.actor, &community, context, request_counter).await?;
-        verify_mod_action(
-          &self.actor,
-          self.object.inner(),
-          community.id,
-          context,
-          request_counter,
-        )
-        .await?;
+        verify_person_in_community(&self.actor, &community, context).await?;
+        verify_mod_action(&self.actor, self.object.inner(), community.id, context).await?;
       }
     }
     Ok(())
   }
 
   #[tracing::instrument(skip_all)]
-  async fn receive(
-    self,
-    context: &Data<LemmyContext>,
-    request_counter: &mut i32,
-  ) -> Result<(), LemmyError> {
+  async fn receive(self, context: &Data<LemmyContext>) -> Result<(), LemmyError> {
     let expires = self.expires.map(|u| u.naive_local());
-    let mod_person = self
-      .actor
-      .dereference(context, local_instance(context).await, request_counter)
-      .await?;
-    let blocked_person = self
-      .object
-      .dereference(context, local_instance(context).await, request_counter)
-      .await?;
-    let target = self
-      .target
-      .dereference(context, local_instance(context).await, request_counter)
-      .await?;
+    let mod_person = self.actor.dereference(context).await?;
+    let blocked_person = self.object.dereference(context).await?;
+    let target = self.target.dereference(context).await?;
     match target {
       SiteOrCommunity::Site(_site) => {
         let blocked_person = Person::update(
-          context.pool(),
+          &mut context.pool(),
           blocked_person.id,
           &PersonUpdateForm::builder()
             .banned(Some(true))
@@ -187,7 +166,7 @@ impl ActivityHandler for BlockUser {
         if self.remove_data.unwrap_or(false) {
           remove_user_data(
             blocked_person.id,
-            context.pool(),
+            &mut context.pool(),
             context.settings(),
             context.client(),
           )
@@ -198,11 +177,11 @@ impl ActivityHandler for BlockUser {
         let form = ModBanForm {
           mod_person_id: mod_person.id,
           other_person_id: blocked_person.id,
-          reason: self.summary,
+          reason: sanitize_html_opt(&self.summary),
           banned: Some(true),
           expires,
         };
-        ModBan::create(context.pool(), &form).await?;
+        ModBan::create(&mut context.pool(), &form).await?;
       }
       SiteOrCommunity::Community(community) => {
         let community_user_ban_form = CommunityPersonBanForm {
@@ -210,7 +189,7 @@ impl ActivityHandler for BlockUser {
           person_id: blocked_person.id,
           expires: Some(expires),
         };
-        CommunityPersonBan::ban(context.pool(), &community_user_ban_form).await?;
+        CommunityPersonBan::ban(&mut context.pool(), &community_user_ban_form).await?;
 
         // Also unsubscribe them from the community, if they are subscribed
         let community_follower_form = CommunityFollowerForm {
@@ -218,12 +197,13 @@ impl ActivityHandler for BlockUser {
           person_id: blocked_person.id,
           pending: false,
         };
-        CommunityFollower::unfollow(context.pool(), &community_follower_form)
+        CommunityFollower::unfollow(&mut context.pool(), &community_follower_form)
           .await
           .ok();
 
         if self.remove_data.unwrap_or(false) {
-          remove_user_data_in_community(community.id, blocked_person.id, context.pool()).await?;
+          remove_user_data_in_community(community.id, blocked_person.id, &mut context.pool())
+            .await?;
         }
 
         // write to mod log
@@ -231,33 +211,14 @@ impl ActivityHandler for BlockUser {
           mod_person_id: mod_person.id,
           other_person_id: blocked_person.id,
           community_id: community.id,
-          reason: self.summary,
+          reason: sanitize_html_opt(&self.summary),
           banned: Some(true),
           expires,
         };
-        ModBanFromCommunity::create(context.pool(), &form).await?;
+        ModBanFromCommunity::create(&mut context.pool(), &form).await?;
       }
     }
 
     Ok(())
   }
 }
-
-#[async_trait::async_trait(?Send)]
-impl GetCommunity for BlockUser {
-  #[tracing::instrument(skip_all)]
-  async fn get_community(
-    &self,
-    context: &LemmyContext,
-    request_counter: &mut i32,
-  ) -> Result<ApubCommunity, LemmyError> {
-    let target = self
-      .target
-      .dereference(context, local_instance(context).await, request_counter)
-      .await?;
-    match target {
-      SiteOrCommunity::Community(c) => Ok(c),
-      SiteOrCommunity::Site(_) => Err(anyhow!("Calling get_community() on site activity").into()),
-    }
-  }
-}