jmug/stoatchat
1
0
Fork 1
mirror of https://github.com/stoatchat/stoatchat.git synced 2026-07-14 05:26:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Add limits to channels and roles

Browse Source
This commit is contained in:
Zomatree
2023-04-10 17:39:21 +01:00
parent b7b70346b4
commit 144f0d39c6
6 changed files with 47 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
crates/delta/src/routes/channels/message_send.rs
View File

@@ -7,7 +7,7 @@ use revolt_quark::{
},
perms,
web::idempotency::IdempotencyKey,
Db, Error, Permission, Ref, Result,
Db, Error, Permission, Ref, Result, variables::delta::{MAX_ATTACHMENT_COUNT, MAX_REPLY_COUNT},
};
use regex::Regex;
@@ -139,8 +139,8 @@ pub async fn message_send(
// 4. Verify replies are valid.
let mut replies = HashSet::new();
if let Some(entries) = data.replies {
if entries.len() > 5 {
return Err(Error::TooManyReplies);
if entries.len() > *MAX_REPLY_COUNT {
return Err(Error::TooManyReplies { max: *MAX_REPLY_COUNT });
}
for Reply { id, mention } in entries {
@@ -191,8 +191,8 @@ pub async fn message_send(
}
// ! FIXME: move this to app config
if ids.len() > 5 {
return Err(Error::TooManyAttachments);
if ids.len() > *MAX_ATTACHMENT_COUNT {
return Err(Error::TooManyAttachments { max: *MAX_ATTACHMENT_COUNT} );
}
for attachment_id in ids {

5
crates/delta/src/routes/customisation/emoji_create.rs
View File

@@ -1,5 +1,6 @@
use revolt_quark::models::emoji::EmojiParent;
use revolt_quark::models::{Emoji, File, User};
use revolt_quark::variables::delta::MAX_EMOJI_COUNT;
use revolt_quark::{perms, Db, Error, Permission, Result};
use serde::Deserialize;
use validator::Validate;
@@ -55,8 +56,8 @@ pub async fn create_emoji(
// Check that there are no more than 100 emoji
// ! FIXME: hardcoded upper limit
let emojis = db.fetch_emoji_by_parent_id(&server.id).await?;
if emojis.len() > 99 {
return Err(Error::TooManyEmoji);
if emojis.len() > *MAX_EMOJI_COUNT {
return Err(Error::TooManyEmoji { max: *MAX_EMOJI_COUNT });
}
}
EmojiParent::Detached => return Err(Error::InvalidOperation),

6
crates/delta/src/routes/servers/channel_create.rs
View File

@@ -2,7 +2,7 @@ use std::collections::HashMap;
use revolt_quark::{
models::{server::PartialServer, Channel, User},
perms, Db, Error, Permission, Ref, Result,
perms, Db, Error, Permission, Ref, Result, variables::delta::MAX_CHANNEL_COUNT,
};
use rocket::serde::json::Json;
@@ -58,6 +58,10 @@ pub async fn req(
.throw_permission(db, Permission::ManageChannel)
.await?;
if server.channels.len() > *MAX_CHANNEL_COUNT {
return Err(Error::TooManyChannels { max: *MAX_CHANNEL_COUNT })
};
let id = Ulid::new().to_string();
let mut channels = server.channels.clone();
channels.push(id.clone());

6
crates/delta/src/routes/servers/roles_create.rs
View File

@@ -1,6 +1,6 @@
use revolt_quark::{
models::{server::Role, User},
perms, Db, Error, Permission, Ref, Result,
perms, Db, Error, Permission, Ref, Result, variables::delta::MAX_ROLE_COUNT,
};
use rocket::serde::json::Json;
@@ -50,6 +50,10 @@ pub async fn req(
.throw_permission(db, Permission::ManageRole)
.await?;
if server.roles.len() > *MAX_ROLE_COUNT {
return Err(Error::TooManyRoles { max: *MAX_ROLE_COUNT })
};
let member_rank = permissions.get_member_rank();
let rank = if let Some(given_rank) = data.rank {
if given_rank <= member_rank.unwrap_or(i64::MIN) {

32
crates/quark/src/util/result.rs
View File

@@ -3,7 +3,6 @@ use revolt_rocket_okapi::revolt_okapi::openapi3;
use rocket::{
http::{ContentType, Status},
response::{self, Responder},
serde::json::serde_json::json,
Request, Response,
};
use schemars::schema::Schema;
@@ -39,8 +38,15 @@ pub enum Error {
UnknownMessage,
CannotEditMessage,
CannotJoinCall,
TooManyAttachments,
TooManyReplies,
TooManyAttachments {
max: usize
},
TooManyReplies {
max: usize
},
TooManyChannels {
max: usize
},
EmptyMessage,
PayloadTooLarge,
CannotRemoveYourself,
@@ -57,7 +63,12 @@ pub enum Error {
TooManyServers {
max: usize,
},
TooManyEmoji,
TooManyEmoji {
max: usize
},
TooManyRoles {
max: usize
},
// ? Bot related errors
ReachedMaximumBots,
@@ -151,8 +162,8 @@ impl<'r> Responder<'r, 'static> for Error {
Error::UnknownAttachment => Status::BadRequest,
Error::CannotEditMessage => Status::Forbidden,
Error::CannotJoinCall => Status::BadRequest,
Error::TooManyAttachments => Status::BadRequest,
Error::TooManyReplies => Status::BadRequest,
Error::TooManyAttachments { .. } => Status::BadRequest,
Error::TooManyReplies { .. } => Status::BadRequest,
Error::EmptyMessage => Status::UnprocessableEntity,
Error::PayloadTooLarge => Status::UnprocessableEntity,
Error::CannotRemoveYourself => Status::BadRequest,
@@ -163,8 +174,11 @@ impl<'r> Responder<'r, 'static> for Error {
Error::UnknownServer => Status::NotFound,
Error::InvalidRole => Status::NotFound,
Error::Banned => Status::Forbidden,
Error::TooManyServers { .. } => Status::Forbidden,
Error::TooManyEmoji => Status::BadRequest,
Error::TooManyServers { .. } => Status::BadRequest,
Error::TooManyEmoji { .. } => Status::BadRequest,
Error::TooManyChannels { .. } => Status::BadRequest,
Error::TooManyRoles { .. } => Status::BadRequest,
Error::ReachedMaximumBots => Status::BadRequest,
Error::IsBot => Status::BadRequest,
@@ -193,7 +207,7 @@ impl<'r> Responder<'r, 'static> for Error {
};
// Serialize the error data structure into JSON.
let string = json!(self).to_string();
let string = serde_json::to_string(&self).unwrap();
// Build and send the request.
Response::build()

6
crates/quark/src/util/variables/delta.rs
View File

@@ -44,6 +44,12 @@ pub static MAX_GROUP_SIZE: Lazy<usize> = Lazy::new(|| env::var("REVOLT_MAX_GROUP
pub static MAX_BOT_COUNT: Lazy<usize> = Lazy::new(|| env::var("REVOLT_MAX_BOT_COUNT").unwrap_or_else(|_| "5".to_string()).parse().unwrap());
pub static MAX_EMBED_COUNT: Lazy<usize> = Lazy::new(|| env::var("REVOLT_MAX_EMBED_COUNT").unwrap_or_else(|_| "5".to_string()).parse().unwrap());
pub static MAX_SERVER_COUNT: Lazy<usize> = Lazy::new(|| env::var("REVOLT_MAX_SERVER_COUNT").unwrap_or_else(|_| "100".to_string()).parse().unwrap());
pub static MAX_CHANNEL_COUNT: Lazy<usize> = Lazy::new(|| env::var("REVOLT_MAX_CHANNEL_COUNT").unwrap_or_else(|_| "200".to_string()).parse().unwrap());
pub static MAX_ROLE_COUNT: Lazy<usize> = Lazy::new(|| env::var("REVOLT_MAX_ROLE_COUNT").unwrap_or_else(|_| "200".to_string()).parse().unwrap());
pub static MAX_EMOJI_COUNT: Lazy<usize> = Lazy::new(|| env::var("REVOLT_MAX_EMOJI_COUNT").unwrap_or_else(|_| "100".to_string()).parse().unwrap());
pub static MAX_ATTACHMENT_COUNT: Lazy<usize> = Lazy::new(|| env::var("REVOLT_MAX_ATTACHMENT_COUNT").unwrap_or_else(|_| "5".to_string()).parse().unwrap());
pub static MAX_REPLY_COUNT: Lazy<usize> = Lazy::new(|| env::var("REVOLT_MAX_REPLY_COUNT").unwrap_or_else(|_| "5".to_string()).parse().unwrap());
pub static EARLY_ADOPTER_BADGE: Lazy<i64> = Lazy::new(|| env::var("REVOLT_EARLY_ADOPTER_BADGE").unwrap_or_else(|_| "0".to_string()).parse().unwrap());
pub fn preflight_checks() {