Sanitize html (#3708)

[lemmy.git] / crates / apub / src / activities / deletion / delete.rs

diff --git a/crates/apub/src/activities/deletion/delete.rs b/crates/apub/src/activities/deletion/delete.rs
index ae93d6e09604228091d9594658d0d2f8786498bb..06f7463ae0f12dfe163677153e726aaf846da746 100644 (file)
--- a/crates/apub/src/activities/deletion/delete.rs
+++ b/crates/apub/src/activities/deletion/delete.rs
@@ -3,19 +3,12 @@ use crate::{
     deletion::{receive_delete_action, verify_delete_activity, DeletableObjects},
     generate_activity_id,
   },
-  local_instance,
-  objects::{community::ApubCommunity, person::ApubPerson},
+  insert_received_activity,
+  objects::person::ApubPerson,
   protocol::{activities::deletion::delete::Delete, IdOrNestedObject},
 };
-use activitypub_federation::{core::object_id::ObjectId, data::Data, traits::ActivityHandler};
-use activitystreams_kinds::activity::DeleteType;
-use lemmy_api_common::{
-  websocket::{
-    send::{send_comment_ws_message_simple, send_community_ws_message, send_post_ws_message},
-    UserOperationCrud,
-  },
-  LemmyContext,
-};
+use activitypub_federation::{config::Data, kinds::activity::DeleteType, traits::ActivityHandler};
+use lemmy_api_common::{context::LemmyContext, utils::sanitize_html_opt};
 use lemmy_db_schema::{
   source::{
     comment::{Comment, CommentUpdateForm},
@@ -32,10 +25,10 @@ use lemmy_db_schema::{
   },
   traits::Crud,
 };
-use lemmy_utils::error::LemmyError;
+use lemmy_utils::error::{LemmyError, LemmyErrorType};
 use url::Url;
 
-#[async_trait::async_trait(?Send)]
+#[async_trait::async_trait]
 impl ActivityHandler for Delete {
   type DataType = LemmyContext;
   type Error = LemmyError;
@@ -49,21 +42,14 @@ impl ActivityHandler for Delete {
   }
 
   #[tracing::instrument(skip_all)]
-  async fn verify(
-    &self,
-    context: &Data<LemmyContext>,
-    request_counter: &mut i32,
-  ) -> Result<(), LemmyError> {
-    verify_delete_activity(self, self.summary.is_some(), context, request_counter).await?;
+  async fn verify(&self, context: &Data<Self::DataType>) -> Result<(), LemmyError> {
+    insert_received_activity(&self.id, context).await?;
+    verify_delete_activity(self, self.summary.is_some(), context).await?;
     Ok(())
   }
 
   #[tracing::instrument(skip_all)]
-  async fn receive(
-    self,
-    context: &Data<LemmyContext>,
-    request_counter: &mut i32,
-  ) -> Result<(), LemmyError> {
+  async fn receive(self, context: &Data<LemmyContext>) -> Result<(), LemmyError> {
     if let Some(reason) = self.summary {
       // We set reason to empty string if it doesn't exist, to distinguish between delete and
       // remove. Here we change it back to option, so we don't write it to db.
@@ -73,24 +59,14 @@ impl ActivityHandler for Delete {
         Some(reason)
       };
       receive_remove_action(
-        &self
-          .actor
-          .dereference(context, local_instance(context).await, request_counter)
-          .await?,
+        &self.actor.dereference(context).await?,
         self.object.id(),
         reason,
         context,
       )
       .await
     } else {
-      receive_delete_action(
-        self.object.id(),
-        &self.actor,
-        true,
-        context,
-        request_counter,
-      )
-      .await
+      receive_delete_action(self.object.id(), &self.actor, true, context).await
     }
   }
 }
@@ -102,7 +78,7 @@ impl Delete {
     to: Url,
     community: Option<&Community>,
     summary: Option<String>,
-    context: &LemmyContext,
+    context: &Data<LemmyContext>,
   ) -> Result<Delete, LemmyError> {
     let id = generate_activity_id(
       DeleteType::Delete,
@@ -110,14 +86,14 @@ impl Delete {
     )?;
     let cc: Option<Url> = community.map(|c| c.actor_id.clone().into());
     Ok(Delete {
-      actor: ObjectId::new(actor.actor_id.clone()),
+      actor: actor.actor_id.clone().into(),
       to: vec![to],
       object: IdOrNestedObject::Id(object.id()),
       cc: cc.into_iter().collect(),
       kind: DeleteType::Delete,
       summary,
       id,
-      audience: community.map(|c| ObjectId::<ApubCommunity>::new(c.actor_id.clone())),
+      audience: community.map(|c| c.actor_id.clone().into()),
     })
   }
 }
@@ -127,15 +103,14 @@ pub(in crate::activities) async fn receive_remove_action(
   actor: &ApubPerson,
   object: &Url,
   reason: Option<String>,
-  context: &LemmyContext,
+  context: &Data<LemmyContext>,
 ) -> Result<(), LemmyError> {
-  use UserOperationCrud::*;
+  let reason = sanitize_html_opt(&reason);
+
   match DeletableObjects::read_from_db(object, context).await? {
     DeletableObjects::Community(community) => {
       if community.local {
-        return Err(LemmyError::from_message(
-          "Only local admin can remove community",
-        ));
+        return Err(LemmyErrorType::OnlyLocalAdminCanRemoveCommunity)?;
       }
       let form = ModRemoveCommunityForm {
         mod_person_id: actor.id,
@@ -144,15 +119,13 @@ pub(in crate::activities) async fn receive_remove_action(
         reason,
         expires: None,
       };
-      ModRemoveCommunity::create(context.pool(), &form).await?;
-      let deleted_community = Community::update(
-        context.pool(),
+      ModRemoveCommunity::create(&mut context.pool(), &form).await?;
+      Community::update(
+        &mut context.pool(),
         community.id,
         &CommunityUpdateForm::builder().removed(Some(true)).build(),
       )
       .await?;
-
-      send_community_ws_message(deleted_community.id, RemoveCommunity, None, None, context).await?;
     }
     DeletableObjects::Post(post) => {
       let form = ModRemovePostForm {
@@ -161,15 +134,13 @@ pub(in crate::activities) async fn receive_remove_action(
         removed: Some(true),
         reason,
       };
-      ModRemovePost::create(context.pool(), &form).await?;
-      let removed_post = Post::update(
-        context.pool(),
+      ModRemovePost::create(&mut context.pool(), &form).await?;
+      Post::update(
+        &mut context.pool(),
         post.id,
         &PostUpdateForm::builder().removed(Some(true)).build(),
       )
       .await?;
-
-      send_post_ws_message(removed_post.id, RemovePost, None, None, context).await?;
     }
     DeletableObjects::Comment(comment) => {
       let form = ModRemoveCommentForm {
@@ -178,15 +149,13 @@ pub(in crate::activities) async fn receive_remove_action(
         removed: Some(true),
         reason,
       };
-      ModRemoveComment::create(context.pool(), &form).await?;
-      let removed_comment = Comment::update(
-        context.pool(),
+      ModRemoveComment::create(&mut context.pool(), &form).await?;
+      Comment::update(
+        &mut context.pool(),
         comment.id,
         &CommentUpdateForm::builder().removed(Some(true)).build(),
       )
       .await?;
-
-      send_comment_ws_message_simple(removed_comment.id, RemoveComment, context).await?;
     }
     DeletableObjects::PrivateMessage(_) => unimplemented!(),
   }