]> Untitled Git - lemmy.git/blobdiff - crates/apub/src/activities/block/block_user.rs
Sanitize html (#3708)
[lemmy.git] / crates / apub / src / activities / block / block_user.rs
index bcab3148ac8b594b0e0e87180a7c28663d00ef44..abfab84565fd1f09d1ca895f84ae61f61e3d7ff9 100644 (file)
@@ -1,27 +1,29 @@
 use crate::{
   activities::{
-    block::{generate_cc, generate_instance_inboxes, SiteOrCommunity},
-    community::{announce::GetCommunity, send_activity_in_community},
+    block::{generate_cc, SiteOrCommunity},
+    community::send_activity_in_community,
     generate_activity_id,
     send_lemmy_activity,
-    verify_activity,
     verify_is_public,
     verify_mod_action,
     verify_person_in_community,
   },
   activity_lists::AnnouncableActivities,
-  objects::{community::ApubCommunity, person::ApubPerson},
+  insert_received_activity,
+  objects::{instance::remote_instance_inboxes, person::ApubPerson},
   protocol::activities::block::block_user::BlockUser,
 };
-use activitystreams_kinds::{activity::BlockType, public};
+use activitypub_federation::{
+  config::Data,
+  kinds::{activity::BlockType, public},
+  protocol::verification::verify_domains_match,
+  traits::{ActivityHandler, Actor},
+};
 use anyhow::anyhow;
 use chrono::NaiveDateTime;
-use lemmy_api_common::utils::{blocking, remove_user_data, remove_user_data_in_community};
-use lemmy_apub_lib::{
-  data::Data,
-  object_id::ObjectId,
-  traits::{ActivityHandler, ActorType},
-  verify::verify_domains_match,
+use lemmy_api_common::{
+  context::LemmyContext,
+  utils::{remove_user_data, remove_user_data_in_community, sanitize_html_opt},
 };
 use lemmy_db_schema::{
   source::{
@@ -32,12 +34,12 @@ use lemmy_db_schema::{
       CommunityPersonBanForm,
     },
     moderator::{ModBan, ModBanForm, ModBanFromCommunity, ModBanFromCommunityForm},
-    person::Person,
+    person::{Person, PersonUpdateForm},
   },
   traits::{Bannable, Crud, Followable},
 };
-use lemmy_utils::{settings::structs::Settings, utils::convert_datetime, LemmyError};
-use lemmy_websocket::LemmyContext;
+use lemmy_utils::{error::LemmyError, utils::time::convert_datetime};
+use url::Url;
 
 impl BlockUser {
   pub(in crate::activities::block) async fn new(
@@ -47,13 +49,18 @@ impl BlockUser {
     remove_data: Option<bool>,
     reason: Option<String>,
     expires: Option<NaiveDateTime>,
-    context: &LemmyContext,
+    context: &Data<LemmyContext>,
   ) -> Result<BlockUser, LemmyError> {
+    let audience = if let SiteOrCommunity::Community(c) = target {
+      Some(c.id().into())
+    } else {
+      None
+    };
     Ok(BlockUser {
-      actor: ObjectId::new(mod_.actor_id()),
+      actor: mod_.id().into(),
       to: vec![public()],
-      object: ObjectId::new(user.actor_id()),
-      cc: generate_cc(target, context.pool()).await?,
+      object: user.id().into(),
+      cc: generate_cc(target, &mut context.pool()).await?,
       target: target.id(),
       kind: BlockType::Block,
       remove_data,
@@ -62,8 +69,8 @@ impl BlockUser {
         BlockType::Block,
         &context.settings().get_protocol_and_hostname(),
       )?,
+      audience,
       expires: expires.map(convert_datetime),
-      unparsed: Default::default(),
     })
   }
 
@@ -75,7 +82,7 @@ impl BlockUser {
     remove_data: bool,
     reason: Option<String>,
     expires: Option<NaiveDateTime>,
-    context: &LemmyContext,
+    context: &Data<LemmyContext>,
   ) -> Result<(), LemmyError> {
     let block = BlockUser::new(
       target,
@@ -87,103 +94,94 @@ impl BlockUser {
       context,
     )
     .await?;
-    let block_id = block.id.clone();
 
     match target {
       SiteOrCommunity::Site(_) => {
-        let inboxes = generate_instance_inboxes(user, context.pool()).await?;
-        send_lemmy_activity(context, &block, &block_id, mod_, inboxes, false).await
+        let inboxes = remote_instance_inboxes(&mut context.pool()).await?;
+        send_lemmy_activity(context, block, mod_, inboxes, false).await
       }
       SiteOrCommunity::Community(c) => {
         let activity = AnnouncableActivities::BlockUser(block);
-        let inboxes = vec![user.shared_inbox_or_inbox_url()];
-        send_activity_in_community(activity, &block_id, mod_, c, inboxes, context).await
+        let inboxes = vec![user.shared_inbox_or_inbox()];
+        send_activity_in_community(activity, mod_, c, inboxes, true, context).await
       }
     }
   }
 }
 
-#[async_trait::async_trait(?Send)]
+#[async_trait::async_trait]
 impl ActivityHandler for BlockUser {
   type DataType = LemmyContext;
+  type Error = LemmyError;
+
+  fn id(&self) -> &Url {
+    &self.id
+  }
+
+  fn actor(&self) -> &Url {
+    self.actor.inner()
+  }
 
   #[tracing::instrument(skip_all)]
-  async fn verify(
-    &self,
-    context: &Data<LemmyContext>,
-    request_counter: &mut i32,
-  ) -> Result<(), LemmyError> {
+  async fn verify(&self, context: &Data<LemmyContext>) -> Result<(), LemmyError> {
+    insert_received_activity(&self.id, context).await?;
     verify_is_public(&self.to, &self.cc)?;
-    verify_activity(&self.id, self.actor.inner(), &context.settings())?;
-    match self
-      .target
-      .dereference(context, context.client(), request_counter)
-      .await?
-    {
+    match self.target.dereference(context).await? {
       SiteOrCommunity::Site(site) => {
         let domain = self.object.inner().domain().expect("url needs domain");
-        if Settings::get().hostname == domain {
+        if context.settings().hostname == domain {
           return Err(
             anyhow!("Site bans from remote instance can't affect user's home instance").into(),
           );
         }
         // site ban can only target a user who is on the same instance as the actor (admin)
-        verify_domains_match(&site.actor_id(), self.actor.inner())?;
-        verify_domains_match(&site.actor_id(), self.object.inner())?;
+        verify_domains_match(&site.id(), self.actor.inner())?;
+        verify_domains_match(&site.id(), self.object.inner())?;
       }
       SiteOrCommunity::Community(community) => {
-        verify_person_in_community(&self.actor, &community, context, request_counter).await?;
-        verify_mod_action(
-          &self.actor,
-          self.object.inner(),
-          &community,
-          context,
-          request_counter,
-        )
-        .await?;
+        verify_person_in_community(&self.actor, &community, context).await?;
+        verify_mod_action(&self.actor, self.object.inner(), community.id, context).await?;
       }
     }
     Ok(())
   }
 
   #[tracing::instrument(skip_all)]
-  async fn receive(
-    self,
-    context: &Data<LemmyContext>,
-    request_counter: &mut i32,
-  ) -> Result<(), LemmyError> {
+  async fn receive(self, context: &Data<LemmyContext>) -> Result<(), LemmyError> {
     let expires = self.expires.map(|u| u.naive_local());
-    let mod_person = self
-      .actor
-      .dereference(context, context.client(), request_counter)
-      .await?;
-    let blocked_person = self
-      .object
-      .dereference(context, context.client(), request_counter)
-      .await?;
-    let target = self
-      .target
-      .dereference(context, context.client(), request_counter)
-      .await?;
+    let mod_person = self.actor.dereference(context).await?;
+    let blocked_person = self.object.dereference(context).await?;
+    let target = self.target.dereference(context).await?;
     match target {
       SiteOrCommunity::Site(_site) => {
-        let blocked_person = blocking(context.pool(), move |conn| {
-          Person::ban_person(conn, blocked_person.id, true, expires)
-        })
-        .await??;
+        let blocked_person = Person::update(
+          &mut context.pool(),
+          blocked_person.id,
+          &PersonUpdateForm::builder()
+            .banned(Some(true))
+            .ban_expires(Some(expires))
+            .build(),
+        )
+        .await?;
         if self.remove_data.unwrap_or(false) {
-          remove_user_data(blocked_person.id, context.pool()).await?;
+          remove_user_data(
+            blocked_person.id,
+            &mut context.pool(),
+            context.settings(),
+            context.client(),
+          )
+          .await?;
         }
 
         // write mod log
         let form = ModBanForm {
           mod_person_id: mod_person.id,
           other_person_id: blocked_person.id,
-          reason: self.summary,
+          reason: sanitize_html_opt(&self.summary),
           banned: Some(true),
           expires,
         };
-        blocking(context.pool(), move |conn| ModBan::create(conn, &form)).await??;
+        ModBan::create(&mut context.pool(), &form).await?;
       }
       SiteOrCommunity::Community(community) => {
         let community_user_ban_form = CommunityPersonBanForm {
@@ -191,10 +189,7 @@ impl ActivityHandler for BlockUser {
           person_id: blocked_person.id,
           expires: Some(expires),
         };
-        blocking(context.pool(), move |conn| {
-          CommunityPersonBan::ban(conn, &community_user_ban_form)
-        })
-        .await??;
+        CommunityPersonBan::ban(&mut context.pool(), &community_user_ban_form).await?;
 
         // Also unsubscribe them from the community, if they are subscribed
         let community_follower_form = CommunityFollowerForm {
@@ -202,14 +197,13 @@ impl ActivityHandler for BlockUser {
           person_id: blocked_person.id,
           pending: false,
         };
-        blocking(context.pool(), move |conn: &'_ _| {
-          CommunityFollower::unfollow(conn, &community_follower_form)
-        })
-        .await?
-        .ok();
+        CommunityFollower::unfollow(&mut context.pool(), &community_follower_form)
+          .await
+          .ok();
 
         if self.remove_data.unwrap_or(false) {
-          remove_user_data_in_community(community.id, blocked_person.id, context.pool()).await?;
+          remove_user_data_in_community(community.id, blocked_person.id, &mut context.pool())
+            .await?;
         }
 
         // write to mod log
@@ -217,36 +211,14 @@ impl ActivityHandler for BlockUser {
           mod_person_id: mod_person.id,
           other_person_id: blocked_person.id,
           community_id: community.id,
-          reason: self.summary,
+          reason: sanitize_html_opt(&self.summary),
           banned: Some(true),
           expires,
         };
-        blocking(context.pool(), move |conn| {
-          ModBanFromCommunity::create(conn, &form)
-        })
-        .await??;
+        ModBanFromCommunity::create(&mut context.pool(), &form).await?;
       }
     }
 
     Ok(())
   }
 }
-
-#[async_trait::async_trait(?Send)]
-impl GetCommunity for BlockUser {
-  #[tracing::instrument(skip_all)]
-  async fn get_community(
-    &self,
-    context: &LemmyContext,
-    request_counter: &mut i32,
-  ) -> Result<ApubCommunity, LemmyError> {
-    let target = self
-      .target
-      .dereference(context, context.client(), request_counter)
-      .await?;
-    match target {
-      SiteOrCommunity::Community(c) => Ok(c),
-      SiteOrCommunity::Site(_) => Err(anyhow!("Calling get_community() on site activity").into()),
-    }
-  }
-}