From 93610ebbc3a601348391ffe1962eb07caa869cdd Mon Sep 17 00:00:00 2001 From: Paul Date: Wed, 11 Aug 2021 20:16:11 +0100 Subject: [PATCH] Restrict bots from creating servers, groups, acking messages, and making friends. --- src/routes/channels/channel_ack.rs | 4 ++++ src/routes/channels/group_create.rs | 4 ++++ src/routes/invites/invite_join.rs | 6 +++++- src/routes/servers/server_ack.rs | 4 ++++ src/routes/servers/server_create.rs | 4 ++++ src/routes/sync/get_settings.rs | 4 ++++ src/routes/sync/get_unreads.rs | 4 ++++ src/routes/sync/set_settings.rs | 4 ++++ src/routes/users/add_friend.rs | 4 ++++ src/routes/users/block_user.rs | 5 ++++- src/routes/users/change_username.rs | 4 ++++ src/routes/users/fetch_relationship.rs | 6 +++++- src/routes/users/fetch_relationships.rs | 6 +++++- src/routes/users/remove_friend.rs | 5 ++++- src/routes/users/unblock_user.rs | 4 ++++ src/util/result.rs | 2 ++ 16 files changed, 65 insertions(+), 5 deletions(-) diff --git a/src/routes/channels/channel_ack.rs b/src/routes/channels/channel_ack.rs index 30cd7cd6..d0763b1f 100644 --- a/src/routes/channels/channel_ack.rs +++ b/src/routes/channels/channel_ack.rs @@ -7,6 +7,10 @@ use mongodb::options::UpdateOptions; #[put("//ack/")] pub async fn req(user: User, target: Ref, message: Ref) -> Result<()> { + if user.bot.is_some() { + return Err(Error::IsBot) + } + let target = target.fetch_channel().await?; let perm = permissions::PermissionCalculator::new(&user) diff --git a/src/routes/channels/group_create.rs b/src/routes/channels/group_create.rs index ced86a72..80bf372a 100644 --- a/src/routes/channels/group_create.rs +++ b/src/routes/channels/group_create.rs @@ -24,6 +24,10 @@ pub struct Data { #[post("/create", data = "")] pub async fn req(user: User, info: Json) -> Result { + if user.bot.is_some() { + return Err(Error::IsBot) + } + let info = info.into_inner(); info.validate() .map_err(|error| Error::FailedValidation { error })?; diff --git a/src/routes/invites/invite_join.rs b/src/routes/invites/invite_join.rs index 8c2c6831..f6a4d834 100644 --- a/src/routes/invites/invite_join.rs +++ b/src/routes/invites/invite_join.rs @@ -1,10 +1,14 @@ use crate::database::*; -use crate::util::result::Result; +use crate::util::result::{Error, Result}; use rocket::serde::json::Value; #[post("/")] pub async fn req(user: User, target: Ref) -> Result { + if user.bot.is_some() { + return Err(Error::IsBot) + } + let target = target.fetch_invite().await?; match target { diff --git a/src/routes/servers/server_ack.rs b/src/routes/servers/server_ack.rs index 35cd8cf8..a11e2908 100644 --- a/src/routes/servers/server_ack.rs +++ b/src/routes/servers/server_ack.rs @@ -3,6 +3,10 @@ use crate::util::result::{Error, Result}; #[put("//ack")] pub async fn req(user: User, target: Ref) -> Result<()> { + if user.bot.is_some() { + return Err(Error::IsBot) + } + let target = target.fetch_server().await?; let perm = permissions::PermissionCalculator::new(&user) diff --git a/src/routes/servers/server_create.rs b/src/routes/servers/server_create.rs index d75d66a1..8d8d6736 100644 --- a/src/routes/servers/server_create.rs +++ b/src/routes/servers/server_create.rs @@ -22,6 +22,10 @@ pub struct Data { #[post("/create", data = "")] pub async fn req(user: User, info: Json) -> Result { + if user.bot.is_some() { + return Err(Error::IsBot) + } + let info = info.into_inner(); info.validate() .map_err(|error| Error::FailedValidation { error })?; diff --git a/src/routes/sync/get_settings.rs b/src/routes/sync/get_settings.rs index de5f58f9..93bb1d86 100644 --- a/src/routes/sync/get_settings.rs +++ b/src/routes/sync/get_settings.rs @@ -13,6 +13,10 @@ pub struct Options { #[post("/settings/fetch", data = "")] pub async fn req(user: User, options: Json) -> Result { + if user.bot.is_some() { + return Err(Error::IsBot) + } + let options = options.into_inner(); let mut projection = doc! { "_id": 0, diff --git a/src/routes/sync/get_unreads.rs b/src/routes/sync/get_unreads.rs index 7f135d08..b76dfa54 100644 --- a/src/routes/sync/get_unreads.rs +++ b/src/routes/sync/get_unreads.rs @@ -6,5 +6,9 @@ use rocket::serde::json::Value; #[get("/unreads")] pub async fn req(user: User) -> Result { + if user.bot.is_some() { + return Err(Error::IsBot) + } + Ok(json!(User::fetch_unreads(&user.id).await?)) } diff --git a/src/routes/sync/set_settings.rs b/src/routes/sync/set_settings.rs index 722a04b7..a67bebb5 100644 --- a/src/routes/sync/set_settings.rs +++ b/src/routes/sync/set_settings.rs @@ -19,6 +19,10 @@ pub struct Options { #[post("/settings/set?", data = "")] pub async fn req(user: User, data: Json, options: Options) -> Result<()> { + if user.bot.is_some() { + return Err(Error::IsBot) + } + let data = data.into_inner(); let current_time = Utc::now().timestamp_millis(); let timestamp = if let Some(timestamp) = options.timestamp { diff --git a/src/routes/users/add_friend.rs b/src/routes/users/add_friend.rs index 74b5765f..b0f3e620 100644 --- a/src/routes/users/add_friend.rs +++ b/src/routes/users/add_friend.rs @@ -9,6 +9,10 @@ use rocket::serde::json::Value; #[put("//friend")] pub async fn req(user: User, username: String) -> Result { + if user.bot.is_some() { + return Err(Error::IsBot) + } + let col = get_collection("users"); let doc = col .find_one( diff --git a/src/routes/users/block_user.rs b/src/routes/users/block_user.rs index c8721d85..a6e3cbf0 100644 --- a/src/routes/users/block_user.rs +++ b/src/routes/users/block_user.rs @@ -8,8 +8,11 @@ use rocket::serde::json::Value; #[put("//block")] pub async fn req(user: User, target: Ref) -> Result { - let col = get_collection("users"); + if user.bot.is_some() { + return Err(Error::IsBot) + } + let col = get_collection("users"); let target = target.fetch_user().await?; match get_relationship(&user, &target.id) { diff --git a/src/routes/users/change_username.rs b/src/routes/users/change_username.rs index 25683c78..713a69e1 100644 --- a/src/routes/users/change_username.rs +++ b/src/routes/users/change_username.rs @@ -32,6 +32,10 @@ pub async fn req( data: Json, _ignore_id: String, ) -> Result<()> { + if user.bot.is_some() { + return Err(Error::IsBot) + } + data.validate() .map_err(|error| Error::FailedValidation { error })?; diff --git a/src/routes/users/fetch_relationship.rs b/src/routes/users/fetch_relationship.rs index d8018a15..9234eec1 100644 --- a/src/routes/users/fetch_relationship.rs +++ b/src/routes/users/fetch_relationship.rs @@ -1,9 +1,13 @@ use crate::database::*; -use crate::util::result::Result; +use crate::util::result::{Error, Result}; use rocket::serde::json::Value; #[get("//relationship")] pub async fn req(user: User, target: Ref) -> Result { + if user.bot.is_some() { + return Err(Error::IsBot) + } + Ok(json!({ "status": get_relationship(&user, &target.id) })) } diff --git a/src/routes/users/fetch_relationships.rs b/src/routes/users/fetch_relationships.rs index f4023b89..8eb1ed9b 100644 --- a/src/routes/users/fetch_relationships.rs +++ b/src/routes/users/fetch_relationships.rs @@ -1,10 +1,14 @@ use crate::database::*; -use crate::util::result::Result; +use crate::util::result::{Error, Result}; use rocket::serde::json::Value; #[get("/relationships")] pub async fn req(user: User) -> Result { + if user.bot.is_some() { + return Err(Error::IsBot) + } + Ok(if let Some(vec) = user.relations { json!(vec) } else { diff --git a/src/routes/users/remove_friend.rs b/src/routes/users/remove_friend.rs index 3fbb60ab..9f28c7bf 100644 --- a/src/routes/users/remove_friend.rs +++ b/src/routes/users/remove_friend.rs @@ -8,8 +8,11 @@ use rocket::serde::json::Value; #[delete("//friend")] pub async fn req(user: User, target: Ref) -> Result { - let col = get_collection("users"); + if user.bot.is_some() { + return Err(Error::IsBot) + } + let col = get_collection("users"); let target = target.fetch_user().await?; match get_relationship(&user, &target.id) { diff --git a/src/routes/users/unblock_user.rs b/src/routes/users/unblock_user.rs index 0b294903..45a0c6cd 100644 --- a/src/routes/users/unblock_user.rs +++ b/src/routes/users/unblock_user.rs @@ -8,6 +8,10 @@ use rocket::serde::json::Value; #[delete("//block")] pub async fn req(user: User, target: Ref) -> Result { + if user.bot.is_some() { + return Err(Error::IsBot) + } + let col = get_collection("users"); let target = target.fetch_user().await?; diff --git a/src/util/result.rs b/src/util/result.rs index ea089b12..679cf7a5 100644 --- a/src/util/result.rs +++ b/src/util/result.rs @@ -46,6 +46,7 @@ pub enum Error { // ? Bot related errors. ReachedMaximumBots, + IsBot, // ? General errors. TooManyIds, @@ -102,6 +103,7 @@ impl<'r> Responder<'r, 'static> for Error { Error::Banned => Status::Forbidden, Error::ReachedMaximumBots => Status::BadRequest, + Error::IsBot => Status::BadRequest, Error::FailedValidation { .. } => Status::UnprocessableEntity, Error::DatabaseError { .. } => Status::InternalServerError,