jmug/stoatchat
1
0
Fork 1
mirror of https://github.com/stoatchat/stoatchat.git synced 2026-07-14 05:26:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: reintroduce permission checks for send

Browse Source
This commit is contained in:
Paul Makles
2023-06-03 14:00:17 +01:00
parent 23188032ca
commit a0002d0b43
10 changed files with 82 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
Cargo.lock generated
View File

@@ -2837,7 +2837,7 @@ dependencies = [
[[package]]
name = "revolt-bonfire"
version = "0.5.21"
version = "0.5.22"
dependencies = [
"async-std",
"async-tungstenite",
@@ -2882,7 +2882,7 @@ dependencies = [
[[package]]
name = "revolt-delta"
version = "0.5.21"
version = "0.5.22"
dependencies = [
"async-channel",
"async-std",
@@ -2955,7 +2955,7 @@ dependencies = [
[[package]]
name = "revolt-quark"
version = "0.5.21"
version = "0.5.22"
dependencies = [
"async-lock",
"async-recursion",

2
crates/bonfire/Cargo.toml
View File

@@ -1,6 +1,6 @@
[package]
name = "revolt-bonfire"
version = "0.5.21"
version = "0.5.22"
license = "AGPL-3.0-or-later"
edition = "2021"

2
crates/delta/Cargo.toml
View File

@@ -1,6 +1,6 @@
[package]
name = "revolt-delta"
version = "0.5.21"
version = "0.5.22"
license = "AGPL-3.0-or-later"
authors = ["Paul Makles <paulmakles@gmail.com>"]
edition = "2018"

8
crates/delta/src/routes/channels/message_edit.rs
View File

@@ -44,8 +44,6 @@ pub async fn req(
.throw_permission_and_view_channel(db, Permission::SendMessage)
.await?;
Message::validate_sum(&edit.content, &edit.embeds)?;
let mut message = msg.as_message(db).await?;
if message.channel != channel.id() {
return Err(Error::NotFound);
@@ -55,6 +53,12 @@ pub async fn req(
return Err(Error::CannotEditMessage);
}
if let Some(new_embeds) = &edit.embeds {
Message::validate_sum(&edit.content, new_embeds)?;
} else {
Message::validate_sum(&edit.content, &vec![])?;
}
message.edited = Some(Timestamp::now_utc());
let mut partial = PartialMessage {
edited: message.edited,

41
crates/delta/src/routes/channels/message_send.rs
View File

@@ -1,11 +1,9 @@
use revolt_quark::{
models::{
message::DataMessageSend,
Message, User,
},
models::{message::DataMessageSend, Message, User},
perms,
types::push::MessageAuthor,
web::idempotency::IdempotencyKey,
Db, Error, Permission, Ref, Result, types::push::MessageAuthor,
Db, Error, Permission, Ref, Result,
};
use rocket::serde::json::Json;
@@ -35,7 +33,7 @@ pub async fn message_send(
.throw_permission_and_view_channel(db, Permission::SendMessage)
.await?;
// Verify permissions for masquerade.
// Verify permissions for masquerade
if let Some(masq) = &data.masquerade {
permissions
.throw_permission(db, Permission::Masquerade)
@@ -48,8 +46,37 @@ pub async fn message_send(
}
}
// Check permissions for embeds
if !data.embeds.is_empty() {
permissions
.throw_permission(db, Permission::SendEmbeds)
.await?;
}
// Check permissions for files
if !data.attachments.is_empty() {
permissions
.throw_permission(db, Permission::UploadFiles)
.await?;
}
// Ensure interactions information is correct
if let Some(interactions) = &data.interactions {
interactions.validate(db, &mut permissions).await?;
}
// Create the message
let message = channel.send_message(db, data, MessageAuthor::User(&user), idempotency).await?;
let message = channel
.send_message(
db,
data,
MessageAuthor::User(&user),
idempotency,
permissions
.has_permission(db, Permission::SendEmbeds)
.await?,
)
.await?;
Ok(Json(message))
}

4
crates/delta/src/routes/webhooks/webhook_execute.rs
View File

@@ -33,6 +33,9 @@ pub async fn webhook_execute(
webhook.assert_token(&token).map_err(Error::from_core)?;
// TODO: webhooks can currently always send masquerades, files, embeds, reactions (interactions)
// TODO: they can also mention anyone
let channel = legacy_db.fetch_channel(&webhook.channel_id).await?;
let message = channel
.send_message(
@@ -40,6 +43,7 @@ pub async fn webhook_execute(
data,
MessageAuthor::Webhook(&webhook.into()),
idempotency,
true,
)
.await?;

2
crates/quark/Cargo.toml
View File

@@ -1,6 +1,6 @@
[package]
name = "revolt-quark"
version = "0.5.21"
version = "0.5.22"
edition = "2021"
license = "AGPL-3.0-or-later"

52
crates/quark/src/impl/generic/channels/channel.rs
View File

@@ -409,6 +409,7 @@ impl Channel {
data: DataMessageSend,
author: MessageAuthor<'_>,
mut idempotency: IdempotencyKey,
generate_embeds: bool,
) -> Result<Message> {
Message::validate_sum(&data.content, &data.embeds)?;
@@ -416,8 +417,8 @@ impl Channel {
// Check the message is not empty
if (data.content.as_ref().map_or(true, |v| v.is_empty()))
&& (data.attachments.as_ref().map_or(true, |v| v.is_empty()))
&& (data.embeds.as_ref().map_or(true, |v| v.is_empty()))
&& (data.attachments.is_empty())
&& (data.embeds.is_empty())
{
return Err(Error::EmptyMessage);
}
@@ -496,10 +497,8 @@ impl Channel {
// Process included embeds.
let mut embeds = vec![];
if let Some(sendable_embeds) = data.embeds {
for sendable_embed in sendable_embeds {
embeds.push(sendable_embed.into_embed(db, message_id.clone()).await?)
}
for sendable_embed in data.embeds {
embeds.push(sendable_embed.into_embed(db, message_id.clone()).await?)
}
if !embeds.is_empty() {
@@ -508,24 +507,17 @@ impl Channel {
// Add attachments to message.
let mut attachments = vec![];
if let Some(ids) = &data.attachments {
if ids.len() > *MAX_ATTACHMENT_COUNT {
return Err(Error::TooManyAttachments {
max: *MAX_ATTACHMENT_COUNT,
});
}
if data.attachments.len() > *MAX_ATTACHMENT_COUNT {
return Err(Error::TooManyAttachments {
max: *MAX_ATTACHMENT_COUNT,
});
}
for attachment_id in ids {
attachments.push(
db.find_and_use_attachment(
attachment_id,
"attachments",
"message",
&message_id,
)
for attachment_id in data.attachments {
attachments.push(
db.find_and_use_attachment(&attachment_id, "attachments", "message", &message_id)
.await?,
);
}
);
}
if !attachments.is_empty() {
@@ -541,13 +533,15 @@ impl Channel {
message.create(db, self, Some(author)).await?;
// Queue up a task for processing embeds
if let Some(content) = &message.content {
process_embeds::queue(
self.id().to_string(),
message.id.to_string(),
content.clone(),
)
.await;
if generate_embeds {
if let Some(content) = &message.content {
process_embeds::queue(
self.id().to_string(),
message.id.to_string(),
content.clone(),
)
.await;
}
}
Ok(message)

15
crates/quark/src/impl/generic/channels/message.rs
View File

@@ -18,7 +18,7 @@ use crate::{
tasks::ack::AckEvent,
types::{
january::{Embed, Text},
push::{PushNotification, MessageAuthor},
push::{MessageAuthor, PushNotification},
},
Database, Error, Permission, Result,
};
@@ -170,20 +170,15 @@ impl Message {
}
/// Validate the sum of content of a message is under threshold
pub fn validate_sum(
content: &Option<String>,
embeds: &Option<Vec<SendableEmbed>>,
) -> Result<()> {
pub fn validate_sum(content: &Option<String>, embeds: &Vec<SendableEmbed>) -> Result<()> {
let mut running_total = 0;
if let Some(content) = content {
running_total += content.len();
}
if let Some(embeds) = embeds {
for embed in embeds {
if let Some(desc) = &embed.description {
running_total += desc.len();
}
for embed in embeds {
if let Some(desc) = &embed.description {
running_total += desc.len();
}
}

7
crates/quark/src/models/channels/message.rs
View File

@@ -268,15 +268,16 @@ pub struct DataMessageSend {
#[validate(length(min = 0, max = 2000))]
pub content: Option<String>,
/// Attachments to include in message
#[validate(length(min = 1, max = 128))]
pub attachments: Option<Vec<String>>,
#[serde(default)]
pub attachments: Vec<String>,
/// Messages to reply to
pub replies: Option<Vec<Reply>>,
/// Embeds to include in message
///
/// Text embed content contributes to the content length cap
#[serde(default)]
#[validate(length(min = 1, max = 10))]
pub embeds: Option<Vec<SendableEmbed>>,
pub embeds: Vec<SendableEmbed>,
/// Masquerade to apply to this message
#[validate]
pub masquerade: Option<Masquerade>,