michael/pyfedi
1
0
Fork 0
mirror of https://codeberg.org/rimu/pyfedi synced 2025-02-02 16:21:32 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions

API: ensure only reply owner can edit the reply

Browse source
This commit is contained in:
freamon 2024-10-13 12:52:20 +00:00
parent 9054f05c1d
commit 07010ffaee
2 changed files with 5 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/shared/reply.py
View file

@ -352,7 +352,7 @@ def make_reply(input, post, parent_id, src, auth=None):
def edit_reply(input, reply, post, src, auth=None):
if src == SRC_API:
user = authorise_api_user(auth, return_type='model')
user = authorise_api_user(auth, return_type='model', id_match=reply.user_id)
content = input['body']
notify_author = input['notify_author']
language_id = input['language_id']

6
app/utils.py
View file

@ -1281,7 +1281,7 @@ def add_to_modlog_activitypub(action: str, actor: User, community_id: int = None
db.session.commit()
def authorise_api_user(auth, return_type='id'):
def authorise_api_user(auth, return_type=None, id_match=None):
if not auth:
raise Exception('incorrect_login')
token = auth[7:] # remove 'Bearer '
@ -1293,7 +1293,9 @@ def authorise_api_user(auth, return_type='id'):
issued_at = decoded['iat'] # use to check against blacklisted JWTs
user = User.query.filter_by(id=user_id, ap_id=None, verified=True, banned=False, deleted=False).scalar()
if user:
if return_type == 'model':
if id_match and user.id != id_match:
raise Exception('incorrect_login')
if return_type and return_type == 'model':
return user
else:
return user.id