Sanitize html (#3708)

[lemmy.git] / crates / apub / src / activities / deletion / delete.rs

diff --git a/crates/apub/src/activities/deletion/delete.rs b/crates/apub/src/activities/deletion/delete.rs
index 337ba9e8afa271c37388ec1bdd63bacbc96e194c..06f7463ae0f12dfe163677153e726aaf846da746 100644 (file)
--- a/crates/apub/src/activities/deletion/delete.rs
+++ b/crates/apub/src/activities/deletion/delete.rs
@@ -3,18 +3,12 @@ use crate::{
     deletion::{receive_delete_action, verify_delete_activity, DeletableObjects},
     generate_activity_id,
   },
-  insert_activity,
+  insert_received_activity,
   objects::person::ApubPerson,
   protocol::{activities::deletion::delete::Delete, IdOrNestedObject},
 };
 use activitypub_federation::{config::Data, kinds::activity::DeleteType, traits::ActivityHandler};
-use lemmy_api_common::{
-  context::LemmyContext,
-  websocket::{
-    send::{send_comment_ws_message_simple, send_community_ws_message, send_post_ws_message},
-    UserOperationCrud,
-  },
-};
+use lemmy_api_common::{context::LemmyContext, utils::sanitize_html_opt};
 use lemmy_db_schema::{
   source::{
     comment::{Comment, CommentUpdateForm},
@@ -31,7 +25,7 @@ use lemmy_db_schema::{
   },
   traits::Crud,
 };
-use lemmy_utils::error::LemmyError;
+use lemmy_utils::error::{LemmyError, LemmyErrorType};
 use url::Url;
 
 #[async_trait::async_trait]
@@ -49,13 +43,13 @@ impl ActivityHandler for Delete {
 
   #[tracing::instrument(skip_all)]
   async fn verify(&self, context: &Data<Self::DataType>) -> Result<(), LemmyError> {
+    insert_received_activity(&self.id, context).await?;
     verify_delete_activity(self, self.summary.is_some(), context).await?;
     Ok(())
   }
 
   #[tracing::instrument(skip_all)]
   async fn receive(self, context: &Data<LemmyContext>) -> Result<(), LemmyError> {
-    insert_activity(&self.id, &self, false, false, context).await?;
     if let Some(reason) = self.summary {
       // We set reason to empty string if it doesn't exist, to distinguish between delete and
       // remove. Here we change it back to option, so we don't write it to db.
@@ -111,13 +105,12 @@ pub(in crate::activities) async fn receive_remove_action(
   reason: Option<String>,
   context: &Data<LemmyContext>,
 ) -> Result<(), LemmyError> {
-  use UserOperationCrud::*;
+  let reason = sanitize_html_opt(&reason);
+
   match DeletableObjects::read_from_db(object, context).await? {
     DeletableObjects::Community(community) => {
       if community.local {
-        return Err(LemmyError::from_message(
-          "Only local admin can remove community",
-        ));
+        return Err(LemmyErrorType::OnlyLocalAdminCanRemoveCommunity)?;
       }
       let form = ModRemoveCommunityForm {
         mod_person_id: actor.id,
@@ -126,15 +119,13 @@ pub(in crate::activities) async fn receive_remove_action(
         reason,
         expires: None,
       };
-      ModRemoveCommunity::create(context.pool(), &form).await?;
-      let deleted_community = Community::update(
-        context.pool(),
+      ModRemoveCommunity::create(&mut context.pool(), &form).await?;
+      Community::update(
+        &mut context.pool(),
         community.id,
         &CommunityUpdateForm::builder().removed(Some(true)).build(),
       )
       .await?;
-
-      send_community_ws_message(deleted_community.id, RemoveCommunity, None, None, context).await?;
     }
     DeletableObjects::Post(post) => {
       let form = ModRemovePostForm {
@@ -143,15 +134,13 @@ pub(in crate::activities) async fn receive_remove_action(
         removed: Some(true),
         reason,
       };
-      ModRemovePost::create(context.pool(), &form).await?;
-      let removed_post = Post::update(
-        context.pool(),
+      ModRemovePost::create(&mut context.pool(), &form).await?;
+      Post::update(
+        &mut context.pool(),
         post.id,
         &PostUpdateForm::builder().removed(Some(true)).build(),
       )
       .await?;
-
-      send_post_ws_message(removed_post.id, RemovePost, None, None, context).await?;
     }
     DeletableObjects::Comment(comment) => {
       let form = ModRemoveCommentForm {
@@ -160,15 +149,13 @@ pub(in crate::activities) async fn receive_remove_action(
         removed: Some(true),
         reason,
       };
-      ModRemoveComment::create(context.pool(), &form).await?;
-      let removed_comment = Comment::update(
-        context.pool(),
+      ModRemoveComment::create(&mut context.pool(), &form).await?;
+      Comment::update(
+        &mut context.pool(),
         comment.id,
         &CommentUpdateForm::builder().removed(Some(true)).build(),
       )
       .await?;
-
-      send_comment_ws_message_simple(removed_comment.id, RemoveComment, context).await?;
     }
     DeletableObjects::PrivateMessage(_) => unimplemented!(),
   }