From 76034f058d322bf7891c05894994e24b29d2d3a3 Mon Sep 17 00:00:00 2001 From: Dessalines Date: Fri, 27 Dec 2024 12:52:05 -0500 Subject: [PATCH 01/10] Cleaning up oauth providers conversion. (#5280) * Cleaning up oauth providers conversion. * Use into_iter --- crates/db_schema/src/impls/oauth_provider.rs | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/crates/db_schema/src/impls/oauth_provider.rs b/crates/db_schema/src/impls/oauth_provider.rs index 9d7e791e7..7665ba050 100644 --- a/crates/db_schema/src/impls/oauth_provider.rs +++ b/crates/db_schema/src/impls/oauth_provider.rs @@ -55,13 +55,11 @@ impl OAuthProvider { pub fn convert_providers_to_public( oauth_providers: Vec, ) -> Vec { - let mut result = Vec::::new(); - for oauth_provider in &oauth_providers { - if oauth_provider.enabled { - result.push(PublicOAuthProvider(oauth_provider.clone())); - } - } - result + oauth_providers + .into_iter() + .filter(|x| x.enabled) + .map(PublicOAuthProvider) + .collect() } pub async fn get_all_public(pool: &mut DbPool<'_>) -> Result, Error> { From f76322e3f5e6792df569b01d501238a5efc683f0 Mon Sep 17 00:00:00 2001 From: Richard Schwab Date: Fri, 27 Dec 2024 18:53:23 +0100 Subject: [PATCH 02/10] Reduce false positives in URL blocklist to reduce scunthorpe problem by matching at word boundaries. (#5282) This addresses an issue brought up on matrix where blocking rt.com resulted in links to deviantart.com getting blocked. --- crates/api_common/src/utils.rs | 4 +- crates/api_crud/src/site/update.rs | 2 + crates/utils/src/utils/markdown/mod.rs | 62 +++++++++++++++++--------- 3 files changed, 45 insertions(+), 23 deletions(-) diff --git a/crates/api_common/src/utils.rs b/crates/api_common/src/utils.rs index 80f559edb..ee232c93a 100644 --- a/crates/api_common/src/utils.rs +++ b/crates/api_common/src/utils.rs @@ -552,7 +552,9 @@ pub async fn get_url_blocklist(context: &LemmyContext) -> LemmyResult let urls = LocalSiteUrlBlocklist::get_all(&mut context.pool()).await?; // The urls are already validated on saving, so just escape them. - let regexes = urls.iter().map(|url| escape(&url.url)); + // If this regex creation changes it must be synced with + // lemmy_utils::utils::markdown::create_url_blocklist_test_regex_set. + let regexes = urls.iter().map(|url| format!(r"\b{}\b", escape(&url.url))); let set = RegexSet::new(regexes)?; Ok(set) diff --git a/crates/api_crud/src/site/update.rs b/crates/api_crud/src/site/update.rs index d2585ea43..8b0dfe0c5 100644 --- a/crates/api_crud/src/site/update.rs +++ b/crates/api_crud/src/site/update.rs @@ -151,6 +151,8 @@ pub async fn update_site( .ok(); if let Some(url_blocklist) = data.blocked_urls.clone() { + // If this validation changes it must be synced with + // lemmy_utils::utils::markdown::create_url_blocklist_test_regex_set. let parsed_urls = check_urls_are_valid(&url_blocklist)?; LocalSiteUrlBlocklist::replace(&mut context.pool(), parsed_urls).await?; } diff --git a/crates/utils/src/utils/markdown/mod.rs b/crates/utils/src/utils/markdown/mod.rs index ba509596e..25ac0ffd6 100644 --- a/crates/utils/src/utils/markdown/mod.rs +++ b/crates/utils/src/utils/markdown/mod.rs @@ -47,8 +47,10 @@ pub fn markdown_check_for_blocked_urls(text: &str, blocklist: &RegexSet) -> Lemm mod tests { use super::*; + use crate::utils::validation::check_urls_are_valid; use image_links::markdown_rewrite_image_links; use pretty_assertions::assert_eq; + use regex::escape; #[test] fn test_basic_markdown() { @@ -191,9 +193,20 @@ mod tests { }); } + // This replicates the logic when saving url blocklist patterns and querying them. + // Refer to lemmy_api_crud::site::update::update_site and + // lemmy_api_common::utils::get_url_blocklist(). + fn create_url_blocklist_test_regex_set(patterns: Vec<&str>) -> LemmyResult { + let url_blocklist = patterns.iter().map(|&s| s.to_string()).collect(); + let valid_urls = check_urls_are_valid(&url_blocklist)?; + let regexes = valid_urls.iter().map(|p| format!(r"\b{}\b", escape(p))); + let set = RegexSet::new(regexes)?; + Ok(set) + } + #[test] fn test_url_blocking() -> LemmyResult<()> { - let set = RegexSet::new(vec![r"(https://)?example\.com/?"])?; + let set = create_url_blocklist_test_regex_set(vec!["example.com/"])?; assert!( markdown_check_for_blocked_urls(&String::from("[](https://example.com)"), &set).is_err() @@ -221,37 +234,42 @@ mod tests { ) .is_err()); - let set = RegexSet::new(vec![r"(https://)?example\.com/spam\.jpg"])?; - assert!(markdown_check_for_blocked_urls( - &String::from("![](https://example.com/spam.jpg)"), - &set - ) - .is_err()); + let set = create_url_blocklist_test_regex_set(vec!["example.com/spam.jpg"])?; + assert!(markdown_check_for_blocked_urls("![](https://example.com/spam.jpg)", &set).is_err()); + assert!(markdown_check_for_blocked_urls("![](https://example.com/spam.jpg1)", &set).is_ok()); + // TODO: the following should not be matched, scunthorpe problem. + assert!( + markdown_check_for_blocked_urls("![](https://example.com/spam.jpg.html)", &set).is_err() + ); - let set = RegexSet::new(vec![ - r"(https://)?quo\.example\.com/?", - r"(https://)?foo\.example\.com/?", - r"(https://)?bar\.example\.com/?", + let set = create_url_blocklist_test_regex_set(vec![ + r"quo.example.com/", + r"foo.example.com/", + r"bar.example.com/", ])?; - assert!( - markdown_check_for_blocked_urls(&String::from("https://baz.example.com"), &set).is_ok() - ); + assert!(markdown_check_for_blocked_urls("https://baz.example.com", &set).is_ok()); - assert!( - markdown_check_for_blocked_urls(&String::from("https://bar.example.com"), &set).is_err() - ); + assert!(markdown_check_for_blocked_urls("https://bar.example.com", &set).is_err()); - let set = RegexSet::new(vec![r"(https://)?example\.com/banned_page"])?; + let set = create_url_blocklist_test_regex_set(vec!["example.com/banned_page"])?; - assert!( - markdown_check_for_blocked_urls(&String::from("https://example.com/page"), &set).is_ok() - ); + assert!(markdown_check_for_blocked_urls("https://example.com/page", &set).is_ok()); - let set = RegexSet::new(vec![r"(https://)?ex\.mple\.com/?"])?; + let set = create_url_blocklist_test_regex_set(vec!["ex.mple.com/"])?; assert!(markdown_check_for_blocked_urls("example.com", &set).is_ok()); + let set = create_url_blocklist_test_regex_set(vec!["rt.com/"])?; + + assert!(markdown_check_for_blocked_urls("deviantart.com", &set).is_ok()); + assert!(markdown_check_for_blocked_urls("art.com.example.com", &set).is_ok()); + assert!(markdown_check_for_blocked_urls("https://rt.com/abc", &set).is_err()); + assert!(markdown_check_for_blocked_urls("go to rt.com.", &set).is_err()); + assert!(markdown_check_for_blocked_urls("check out rt.computer", &set).is_ok()); + // TODO: the following should not be matched, scunthorpe problem. + assert!(markdown_check_for_blocked_urls("rt.com.example.com", &set).is_err()); + Ok(()) } From 83bf60571ef152671db8f638976a756ad3a294af Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 31 Dec 2024 20:38:21 -0500 Subject: [PATCH 03/10] chore(deps): update docker (#5293) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .woodpecker.yml | 2 +- docker/Dockerfile | 2 +- docker/docker-compose.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.woodpecker.yml b/.woodpecker.yml index 8bbae613e..2eb7d277e 100644 --- a/.woodpecker.yml +++ b/.woodpecker.yml @@ -6,7 +6,7 @@ variables: # as well. Otherwise release builds can fail if Lemmy or dependencies rely on new Rust # features. In particular the ARM builder image needs to be updated manually in the repo below: # https://github.com/raskyld/lemmy-cross-toolchains - - &rust_image "rust:1.81" + - &rust_image "rust:1.83" - &rust_nightly_image "rustlang/rust:nightly" - &install_pnpm "corepack enable pnpm" - &install_binstall "wget -O- https://github.com/cargo-bins/cargo-binstall/releases/latest/download/cargo-binstall-x86_64-unknown-linux-musl.tgz | tar -xvz -C /usr/local/cargo/bin" diff --git a/docker/Dockerfile b/docker/Dockerfile index 93f17bb95..5bb39555a 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -1,4 +1,4 @@ -# syntax=docker/dockerfile:1.10 +# syntax=docker/dockerfile:1.12 ARG RUST_VERSION=1.81 ARG CARGO_BUILD_FEATURES=default ARG RUST_RELEASE_MODE=debug diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml index cb438af3a..dc978244e 100644 --- a/docker/docker-compose.yml +++ b/docker/docker-compose.yml @@ -53,7 +53,7 @@ services: lemmy-ui: # use "image" to pull down an already compiled lemmy-ui. make sure to comment out "build". - image: dessalines/lemmy-ui:0.19.6 + image: dessalines/lemmy-ui:0.19.8 # platform: linux/x86_64 # no arm64 support. uncomment platform if using m1. # use "build" to build your local lemmy ui image for development. make sure to comment out "image". # run: docker compose up --build From 34672ab21b193a8f774d6d3a5e88a58a1ba5b185 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 31 Dec 2024 21:16:18 -0500 Subject: [PATCH 04/10] chore(deps): update rust crate anyhow to v1.0.95 (#5294) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 62f0bcd83..b651f82cc 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -435,9 +435,9 @@ dependencies = [ [[package]] name = "anyhow" -version = "1.0.93" +version = "1.0.95" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4c95c10ba0b00a02636238b814946408b1322d5ac4760326e6fb8ec956d85775" +checksum = "34ac096ce696dc2fcabef30516bb13c0a68a11d30131d3df6f04711467681b04" dependencies = [ "backtrace", ] From 39aace0c8f2a3d1510f664ce3276d2ec4aa3a9df Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 31 Dec 2024 23:35:13 -0500 Subject: [PATCH 05/10] chore(deps): update rust crate clap to v4.5.23 (#5296) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- Cargo.lock | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index b651f82cc..009566cf2 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -843,9 +843,9 @@ dependencies = [ [[package]] name = "clap" -version = "4.5.21" +version = "4.5.23" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fb3b4b9e5a7c7514dfa52869339ee98b3156b0bfb4e8a77c4ff4babb64b1604f" +checksum = "3135e7ec2ef7b10c6ed8950f0f792ed96ee093fa088608f1c76e569722700c84" dependencies = [ "clap_builder", "clap_derive", @@ -853,9 +853,9 @@ dependencies = [ [[package]] name = "clap_builder" -version = "4.5.21" +version = "4.5.23" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b17a95aa67cc7b5ebd32aa5370189aa0d79069ef1c64ce893bd30fb24bff20ec" +checksum = "30582fc632330df2bd26877bde0c1f4470d57c582bbc070376afcd04d8cb4838" dependencies = [ "anstream", "anstyle", @@ -877,9 +877,9 @@ dependencies = [ [[package]] name = "clap_lex" -version = "0.7.2" +version = "0.7.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1462739cb27611015575c0c11df5df7601141071f07518d56fcc1be504cbec97" +checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6" [[package]] name = "clearurls" From ffc3493abed7cc2f901f228a2c66cb740214e0c3 Mon Sep 17 00:00:00 2001 From: Dessalines Date: Wed, 1 Jan 2025 12:47:21 -0500 Subject: [PATCH 06/10] Applying some clippy fixes. (#5292) --- crates/api_crud/src/post/create.rs | 2 +- crates/apub/src/activities/block/block_user.rs | 2 +- crates/apub/src/activities/block/undo_block_user.rs | 2 +- crates/apub/src/activities/community/update.rs | 4 ++-- crates/apub/src/objects/comment.rs | 4 ++-- crates/apub/src/objects/person.rs | 4 ++-- crates/apub/src/objects/post.rs | 4 ++-- crates/apub/src/objects/private_message.rs | 4 ++-- 8 files changed, 13 insertions(+), 13 deletions(-) diff --git a/crates/api_crud/src/post/create.rs b/crates/api_crud/src/post/create.rs index 948a7617e..452144faa 100644 --- a/crates/api_crud/src/post/create.rs +++ b/crates/api_crud/src/post/create.rs @@ -107,7 +107,7 @@ pub async fn create_post( let scheduled_publish_time = convert_published_time(data.scheduled_publish_time, &local_user_view, &context).await?; let post_form = PostInsertForm { - url: url.map(Into::into), + url, body, alt_text: data.alt_text.clone(), nsfw: data.nsfw, diff --git a/crates/apub/src/activities/block/block_user.rs b/crates/apub/src/activities/block/block_user.rs index 64c402482..14b9f9adc 100644 --- a/crates/apub/src/activities/block/block_user.rs +++ b/crates/apub/src/activities/block/block_user.rs @@ -152,7 +152,7 @@ impl ActivityHandler for BlockUser { #[tracing::instrument(skip_all)] async fn receive(self, context: &Data) -> LemmyResult<()> { insert_received_activity(&self.id, context).await?; - let expires = self.end_time.map(Into::into); + let expires = self.end_time; let mod_person = self.actor.dereference(context).await?; let blocked_person = self.object.dereference(context).await?; let target = self.target.dereference(context).await?; diff --git a/crates/apub/src/activities/block/undo_block_user.rs b/crates/apub/src/activities/block/undo_block_user.rs index 122eae429..55715fd30 100644 --- a/crates/apub/src/activities/block/undo_block_user.rs +++ b/crates/apub/src/activities/block/undo_block_user.rs @@ -100,7 +100,7 @@ impl ActivityHandler for UndoBlockUser { #[tracing::instrument(skip_all)] async fn receive(self, context: &Data) -> LemmyResult<()> { insert_received_activity(&self.id, context).await?; - let expires = self.object.end_time.map(Into::into); + let expires = self.object.end_time; let mod_person = self.actor.dereference(context).await?; let blocked_person = self.object.object.dereference(context).await?; match self.object.target.dereference(context).await? { diff --git a/crates/apub/src/activities/community/update.rs b/crates/apub/src/activities/community/update.rs index fadf918bd..b6bc50ca0 100644 --- a/crates/apub/src/activities/community/update.rs +++ b/crates/apub/src/activities/community/update.rs @@ -98,8 +98,8 @@ impl ActivityHandler for UpdateCommunity { &None, &self.object.source, )), - published: self.object.published.map(Into::into), - updated: Some(self.object.updated.map(Into::into)), + published: self.object.published, + updated: Some(self.object.updated), nsfw: Some(self.object.sensitive.unwrap_or(false)), actor_id: Some(self.object.id.into()), public_key: Some(self.object.public_key.public_key_pem), diff --git a/crates/apub/src/objects/comment.rs b/crates/apub/src/objects/comment.rs index 2c8ed9f9d..ed9a9e1a2 100644 --- a/crates/apub/src/objects/comment.rs +++ b/crates/apub/src/objects/comment.rs @@ -194,8 +194,8 @@ impl Object for ApubComment { post_id: post.id, content, removed: None, - published: note.published.map(Into::into), - updated: note.updated.map(Into::into), + published: note.published, + updated: note.updated, deleted: Some(false), ap_id: Some(note.id.into()), distinguished: note.distinguished, diff --git a/crates/apub/src/objects/person.rs b/crates/apub/src/objects/person.rs index 97b83c194..50f8e8563 100644 --- a/crates/apub/src/objects/person.rs +++ b/crates/apub/src/objects/person.rs @@ -167,8 +167,8 @@ impl Object for ApubPerson { deleted: Some(false), avatar, banner, - published: person.published.map(Into::into), - updated: person.updated.map(Into::into), + published: person.published, + updated: person.updated, actor_id: Some(person.id.into()), bio, local: Some(false), diff --git a/crates/apub/src/objects/post.rs b/crates/apub/src/objects/post.rs index bcd1dbf8e..0dd9201c2 100644 --- a/crates/apub/src/objects/post.rs +++ b/crates/apub/src/objects/post.rs @@ -249,8 +249,8 @@ impl Object for ApubPost { url: url.map(Into::into), body, alt_text, - published: page.published.map(Into::into), - updated: page.updated.map(Into::into), + published: page.published, + updated: page.updated, deleted: Some(false), nsfw: page.sensitive, ap_id: Some(page.id.clone().into()), diff --git a/crates/apub/src/objects/private_message.rs b/crates/apub/src/objects/private_message.rs index ec3e16fac..521419c82 100644 --- a/crates/apub/src/objects/private_message.rs +++ b/crates/apub/src/objects/private_message.rs @@ -166,8 +166,8 @@ impl Object for ApubPrivateMessage { creator_id: creator.id, recipient_id: recipient.id, content, - published: note.published.map(Into::into), - updated: note.updated.map(Into::into), + published: note.published, + updated: note.updated, deleted: Some(false), read: None, ap_id: Some(note.id.into()), From b8556fa5cf9211131b2198d623c300f8fee3ea77 Mon Sep 17 00:00:00 2001 From: dullbananas Date: Wed, 1 Jan 2025 10:52:20 -0700 Subject: [PATCH 07/10] Shorten "options" variable name (#5285) * comment view, post view * do rename everywhere else * fix person_view --------- Co-authored-by: Dessalines --- crates/db_views/src/comment_view.rs | 55 +++++++------- crates/db_views/src/post_view.rs | 75 ++++++++----------- crates/db_views/src/private_message_view.rs | 11 ++- .../src/registration_application_view.rs | 8 +- .../db_views_actor/src/comment_reply_view.rs | 14 ++-- crates/db_views_actor/src/community_view.rs | 20 ++--- .../db_views_actor/src/person_mention_view.rs | 14 ++-- crates/db_views_actor/src/person_view.rs | 10 +-- 8 files changed, 96 insertions(+), 111 deletions(-) diff --git a/crates/db_views/src/comment_view.rs b/crates/db_views/src/comment_view.rs index 2cf751f9f..504f3cc4e 100644 --- a/crates/db_views/src/comment_view.rs +++ b/crates/db_views/src/comment_view.rs @@ -141,28 +141,25 @@ fn queries<'a>() -> Queries< query.first(&mut conn).await }; - let list = move |mut conn: DbConn<'a>, (options, site): (CommentQuery<'a>, &'a Site)| async move { + let list = move |mut conn: DbConn<'a>, (o, site): (CommentQuery<'a>, &'a Site)| async move { // The left join below will return None in this case - let local_user_id_join = options - .local_user - .local_user_id() - .unwrap_or(LocalUserId(-1)); + let local_user_id_join = o.local_user.local_user_id().unwrap_or(LocalUserId(-1)); - let mut query = all_joins(comment::table.into_boxed(), options.local_user.person_id()); + let mut query = all_joins(comment::table.into_boxed(), o.local_user.person_id()); - if let Some(creator_id) = options.creator_id { + if let Some(creator_id) = o.creator_id { query = query.filter(comment::creator_id.eq(creator_id)); }; - if let Some(post_id) = options.post_id { + if let Some(post_id) = o.post_id { query = query.filter(comment::post_id.eq(post_id)); }; - if let Some(parent_path) = options.parent_path.as_ref() { + if let Some(parent_path) = o.parent_path.as_ref() { query = query.filter(comment::path.contained_by(parent_path)); }; //filtering out removed and deleted comments from search - if let Some(search_term) = options.search_term { + if let Some(search_term) = o.search_term { query = query.filter( comment::content .ilike(fuzzy_search(&search_term)) @@ -170,13 +167,13 @@ fn queries<'a>() -> Queries< ); }; - if let Some(community_id) = options.community_id { + if let Some(community_id) = o.community_id { query = query.filter(post::community_id.eq(community_id)); } let is_subscribed = community_actions::followed.is_not_null(); - match options.listing_type.unwrap_or_default() { + match o.listing_type.unwrap_or_default() { ListingType::Subscribed => query = query.filter(is_subscribed), /* TODO could be this: and(community_follower::person_id.eq(person_id_join)), */ ListingType::Local => { query = query @@ -190,32 +187,30 @@ fn queries<'a>() -> Queries< } // If its saved only, then filter, and order by the saved time, not the comment creation time. - if options.saved_only.unwrap_or_default() { + if o.saved_only.unwrap_or_default() { query = query .filter(comment_actions::saved.is_not_null()) .then_order_by(comment_actions::saved.desc()); } - if let Some(my_id) = options.local_user.person_id() { + if let Some(my_id) = o.local_user.person_id() { let not_creator_filter = comment::creator_id.ne(my_id); - if options.liked_only.unwrap_or_default() { + if o.liked_only.unwrap_or_default() { query = query .filter(not_creator_filter) .filter(comment_actions::like_score.eq(1)); - } else if options.disliked_only.unwrap_or_default() { + } else if o.disliked_only.unwrap_or_default() { query = query .filter(not_creator_filter) .filter(comment_actions::like_score.eq(-1)); } } - if !options.local_user.show_bot_accounts() { + if !o.local_user.show_bot_accounts() { query = query.filter(person::bot_account.eq(false)); }; - if options.local_user.is_some() - && options.listing_type.unwrap_or_default() != ListingType::ModeratorView - { + if o.local_user.is_some() && o.listing_type.unwrap_or_default() != ListingType::ModeratorView { // Filter out the rows with missing languages query = query.filter(exists( local_user_language::table.filter( @@ -232,15 +227,15 @@ fn queries<'a>() -> Queries< .filter(person_actions::blocked.is_null()); }; - if !options.local_user.show_nsfw(site) { + if !o.local_user.show_nsfw(site) { query = query .filter(post::nsfw.eq(false)) .filter(community::nsfw.eq(false)); }; - query = options.local_user.visible_communities_only(query); + query = o.local_user.visible_communities_only(query); - if !options.local_user.is_admin() { + if !o.local_user.is_admin() { query = query.filter( community::visibility .ne(CommunityVisibility::Private) @@ -249,8 +244,8 @@ fn queries<'a>() -> Queries< } // A Max depth given means its a tree fetch - let (limit, offset) = if let Some(max_depth) = options.max_depth { - let depth_limit = if let Some(parent_path) = options.parent_path.as_ref() { + let (limit, offset) = if let Some(max_depth) = o.max_depth { + let depth_limit = if let Some(parent_path) = o.parent_path.as_ref() { parent_path.0.split('.').count() as i32 + max_depth // Add one because of root "0" } else { @@ -261,7 +256,7 @@ fn queries<'a>() -> Queries< // only order if filtering by a post id, or parent_path. DOS potential otherwise and max_depth // + !post_id isn't used anyways (afaik) - if options.post_id.is_some() || options.parent_path.is_some() { + if o.post_id.is_some() || o.parent_path.is_some() { // Always order by the parent path first query = query.then_order_by(subpath(comment::path, 0, -1)); } @@ -278,16 +273,16 @@ fn queries<'a>() -> Queries< // (i64::MAX, 0) (300, 0) } else { - // limit_and_offset_unlimited(options.page, options.limit) - limit_and_offset(options.page, options.limit)? + // limit_and_offset_unlimited(o.page, o.limit) + limit_and_offset(o.page, o.limit)? }; // distinguished comments should go first when viewing post - if options.post_id.is_some() || options.parent_path.is_some() { + if o.post_id.is_some() || o.parent_path.is_some() { query = query.then_order_by(comment::distinguished.desc()); } - query = match options.sort.unwrap_or(CommentSortType::Hot) { + query = match o.sort.unwrap_or(CommentSortType::Hot) { CommentSortType::Hot => query .then_order_by(comment_aggregates::hot_rank.desc()) .then_order_by(comment_aggregates::score.desc()), diff --git a/crates/db_views/src/post_view.rs b/crates/db_views/src/post_view.rs index 6ed89e364..741df57ff 100644 --- a/crates/db_views/src/post_view.rs +++ b/crates/db_views/src/post_view.rs @@ -226,23 +226,20 @@ fn queries<'a>() -> Queries< .await }; - let list = move |mut conn: DbConn<'a>, (options, site): (PostQuery<'a>, &'a Site)| async move { + let list = move |mut conn: DbConn<'a>, (o, site): (PostQuery<'a>, &'a Site)| async move { // The left join below will return None in this case - let local_user_id_join = options - .local_user - .local_user_id() - .unwrap_or(LocalUserId(-1)); + let local_user_id_join = o.local_user.local_user_id().unwrap_or(LocalUserId(-1)); let mut query = all_joins( post_aggregates::table.into_boxed(), - options.local_user.person_id(), + o.local_user.person_id(), ); // hide posts from deleted communities query = query.filter(community::deleted.eq(false)); // only creator can see deleted posts and unpublished scheduled posts - if let Some(person_id) = options.local_user.person_id() { + if let Some(person_id) = o.local_user.person_id() { query = query.filter(post::deleted.eq(false).or(post::creator_id.eq(person_id))); query = query.filter( post::scheduled_publish_time @@ -256,21 +253,21 @@ fn queries<'a>() -> Queries< } // only show removed posts to admin when viewing user profile - if !(options.creator_id.is_some() && options.local_user.is_admin()) { + if !(o.creator_id.is_some() && o.local_user.is_admin()) { query = query .filter(community::removed.eq(false)) .filter(post::removed.eq(false)); } - if let Some(community_id) = options.community_id { + if let Some(community_id) = o.community_id { query = query.filter(post_aggregates::community_id.eq(community_id)); } - if let Some(creator_id) = options.creator_id { + if let Some(creator_id) = o.creator_id { query = query.filter(post_aggregates::creator_id.eq(creator_id)); } let is_subscribed = community_actions::followed.is_not_null(); - match options.listing_type.unwrap_or_default() { + match o.listing_type.unwrap_or_default() { ListingType::Subscribed => query = query.filter(is_subscribed), ListingType::Local => { query = query @@ -283,14 +280,14 @@ fn queries<'a>() -> Queries< } } - if let Some(search_term) = &options.search_term { - if options.url_only.unwrap_or_default() { + if let Some(search_term) = &o.search_term { + if o.url_only.unwrap_or_default() { query = query.filter(post::url.eq(search_term)); } else { let searcher = fuzzy_search(search_term); let name_filter = post::name.ilike(searcher.clone()); let body_filter = post::body.ilike(searcher.clone()); - query = if options.title_only.unwrap_or_default() { + query = if o.title_only.unwrap_or_default() { query.filter(name_filter) } else { query.filter(name_filter.or(body_filter)) @@ -299,64 +296,58 @@ fn queries<'a>() -> Queries< } } - if !options - .show_nsfw - .unwrap_or(options.local_user.show_nsfw(site)) - { + if !o.show_nsfw.unwrap_or(o.local_user.show_nsfw(site)) { query = query .filter(post::nsfw.eq(false)) .filter(community::nsfw.eq(false)); }; - if !options.local_user.show_bot_accounts() { + if !o.local_user.show_bot_accounts() { query = query.filter(person::bot_account.eq(false)); }; // Filter to show only posts with no comments - if options.no_comments_only.unwrap_or_default() { + if o.no_comments_only.unwrap_or_default() { query = query.filter(post_aggregates::comments.eq(0)); }; // If its saved only, then filter, and order by the saved time, not the comment creation time. - if options.saved_only.unwrap_or_default() { + if o.saved_only.unwrap_or_default() { query = query .filter(post_actions::saved.is_not_null()) .then_order_by(post_actions::saved.desc()); } // Only hide the read posts, if the saved_only is false. Otherwise ppl with the hide_read // setting wont be able to see saved posts. - else if !options - .show_read - .unwrap_or(options.local_user.show_read_posts()) - { + else if !o.show_read.unwrap_or(o.local_user.show_read_posts()) { // Do not hide read posts when it is a user profile view // Or, only hide read posts on non-profile views - if options.creator_id.is_none() { + if o.creator_id.is_none() { query = query.filter(post_actions::read.is_null()); } } // If a creator id isn't given (IE its on home or community pages), hide the hidden posts - if !options.show_hidden.unwrap_or_default() && options.creator_id.is_none() { + if !o.show_hidden.unwrap_or_default() && o.creator_id.is_none() { query = query.filter(post_actions::hidden.is_null()); } - if let Some(my_id) = options.local_user.person_id() { + if let Some(my_id) = o.local_user.person_id() { let not_creator_filter = post_aggregates::creator_id.ne(my_id); - if options.liked_only.unwrap_or_default() { + if o.liked_only.unwrap_or_default() { query = query .filter(not_creator_filter) .filter(post_actions::like_score.eq(1)); - } else if options.disliked_only.unwrap_or_default() { + } else if o.disliked_only.unwrap_or_default() { query = query .filter(not_creator_filter) .filter(post_actions::like_score.eq(-1)); } }; - query = options.local_user.visible_communities_only(query); + query = o.local_user.visible_communities_only(query); - if !options.local_user.is_admin() { + if !o.local_user.is_admin() { query = query.filter( community::visibility .ne(CommunityVisibility::Private) @@ -365,9 +356,9 @@ fn queries<'a>() -> Queries< } // Dont filter blocks or missing languages for moderator view type - if options.listing_type.unwrap_or_default() != ListingType::ModeratorView { + if o.listing_type.unwrap_or_default() != ListingType::ModeratorView { // Filter out the rows with missing languages if user is logged in - if options.local_user.is_some() { + if o.local_user.is_some() { query = query.filter(exists( local_user_language::table.filter( post::language_id @@ -383,15 +374,15 @@ fn queries<'a>() -> Queries< query = query.filter(person_actions::blocked.is_null()); } - let (limit, offset) = limit_and_offset(options.page, options.limit)?; + let (limit, offset) = limit_and_offset(o.page, o.limit)?; query = query.limit(limit).offset(offset); let mut query = PaginatedQueryBuilder::new(query); - let page_after = options.page_after.map(|c| c.0); - let page_before_or_equal = options.page_before_or_equal.map(|c| c.0); + let page_after = o.page_after.map(|c| c.0); + let page_before_or_equal = o.page_before_or_equal.map(|c| c.0); - if options.page_back.unwrap_or_default() { + if o.page_back.unwrap_or_default() { query = query .before(page_after) .after_or_equal(page_before_or_equal) @@ -403,7 +394,7 @@ fn queries<'a>() -> Queries< } // featured posts first - query = if options.community_id.is_none() || options.community_id_just_for_prefetch { + query = if o.community_id.is_none() || o.community_id_just_for_prefetch { query.then_desc(key::featured_local) } else { query.then_desc(key::featured_community) @@ -412,7 +403,7 @@ fn queries<'a>() -> Queries< let time = |interval| post_aggregates::published.gt(now() - interval); // then use the main sort - query = match options.sort.unwrap_or(Hot) { + query = match o.sort.unwrap_or(Hot) { Active => query.then_desc(key::hot_rank_active), Hot => query.then_desc(key::hot_rank), Scaled => query.then_desc(key::scaled_rank), @@ -436,7 +427,7 @@ fn queries<'a>() -> Queries< // use publish as fallback. especially useful for hot rank which reaches zero after some days. // necessary because old posts can be fetched over federation and inserted with high post id - query = match options.sort.unwrap_or(Hot) { + query = match o.sort.unwrap_or(Hot) { // A second time-based sort would not be very useful New | Old | NewComments => query, _ => query.then_desc(key::published), @@ -454,7 +445,7 @@ fn queries<'a>() -> Queries< .text("PostQuery::list") .text_if( "getting upper bound for next query", - options.community_id_just_for_prefetch, + o.community_id_just_for_prefetch, ) .load::(&mut conn) .await diff --git a/crates/db_views/src/private_message_view.rs b/crates/db_views/src/private_message_view.rs index 2286b7dc6..346dab49a 100644 --- a/crates/db_views/src/private_message_view.rs +++ b/crates/db_views/src/private_message_view.rs @@ -53,8 +53,7 @@ fn queries<'a>() -> Queries< .await }; - let list = move |mut conn: DbConn<'a>, - (options, recipient_id): (PrivateMessageQuery, PersonId)| async move { + let list = move |mut conn: DbConn<'a>, (o, recipient_id): (PrivateMessageQuery, PersonId)| async move { let mut query = all_joins(private_message::table.into_boxed()) .select(selection) // Dont show replies from blocked users @@ -63,9 +62,9 @@ fn queries<'a>() -> Queries< .filter(instance_actions::blocked.is_null()); // If its unread, I only want the ones to me - if options.unread_only { + if o.unread_only { query = query.filter(private_message::read.eq(false)); - if let Some(i) = options.creator_id { + if let Some(i) = o.creator_id { query = query.filter(private_message::creator_id.eq(i)) } query = query.filter(private_message::recipient_id.eq(recipient_id)); @@ -77,7 +76,7 @@ fn queries<'a>() -> Queries< .eq(recipient_id) .or(private_message::creator_id.eq(recipient_id)), ); - if let Some(i) = options.creator_id { + if let Some(i) = o.creator_id { query = query.filter( private_message::creator_id .eq(i) @@ -86,7 +85,7 @@ fn queries<'a>() -> Queries< } } - let (limit, offset) = limit_and_offset(options.page, options.limit)?; + let (limit, offset) = limit_and_offset(o.page, o.limit)?; query = query .filter(private_message::deleted.eq(false)) diff --git a/crates/db_views/src/registration_application_view.rs b/crates/db_views/src/registration_application_view.rs index 0fa0a5d7e..72329b978 100644 --- a/crates/db_views/src/registration_application_view.rs +++ b/crates/db_views/src/registration_application_view.rs @@ -53,12 +53,12 @@ fn queries<'a>() -> Queries< query.first(&mut conn).await }; - let list = move |mut conn: DbConn<'a>, options: RegistrationApplicationQuery| async move { + let list = move |mut conn: DbConn<'a>, o: RegistrationApplicationQuery| async move { let mut query = all_joins(registration_application::table.into_boxed()); // If viewing all applications, order by newest, but if viewing unresolved only, show the oldest // first (FIFO) - if options.unread_only { + if o.unread_only { query = query .filter(registration_application::admin_id.is_null()) .order_by(registration_application::published.asc()); @@ -66,11 +66,11 @@ fn queries<'a>() -> Queries< query = query.order_by(registration_application::published.desc()); } - if options.verified_email_only { + if o.verified_email_only { query = query.filter(local_user::email_verified.eq(true)) } - let (limit, offset) = limit_and_offset(options.page, options.limit)?; + let (limit, offset) = limit_and_offset(o.page, o.limit)?; query = query.limit(limit).offset(offset); diff --git a/crates/db_views_actor/src/comment_reply_view.rs b/crates/db_views_actor/src/comment_reply_view.rs index 6c5442e6a..75f8ed4e2 100644 --- a/crates/db_views_actor/src/comment_reply_view.rs +++ b/crates/db_views_actor/src/comment_reply_view.rs @@ -113,24 +113,24 @@ fn queries<'a>() -> Queries< .await }; - let list = move |mut conn: DbConn<'a>, options: CommentReplyQuery| async move { + let list = move |mut conn: DbConn<'a>, o: CommentReplyQuery| async move { // These filters need to be kept in sync with the filters in // CommentReplyView::get_unread_replies() - let mut query = all_joins(comment_reply::table.into_boxed(), options.my_person_id); + let mut query = all_joins(comment_reply::table.into_boxed(), o.my_person_id); - if let Some(recipient_id) = options.recipient_id { + if let Some(recipient_id) = o.recipient_id { query = query.filter(comment_reply::recipient_id.eq(recipient_id)); } - if options.unread_only { + if o.unread_only { query = query.filter(comment_reply::read.eq(false)); } - if !options.show_bot_accounts { + if !o.show_bot_accounts { query = query.filter(not(person::bot_account)); }; - query = match options.sort.unwrap_or(CommentSortType::New) { + query = match o.sort.unwrap_or(CommentSortType::New) { CommentSortType::Hot => query.then_order_by(comment_aggregates::hot_rank.desc()), CommentSortType::Controversial => { query.then_order_by(comment_aggregates::controversy_rank.desc()) @@ -143,7 +143,7 @@ fn queries<'a>() -> Queries< // Don't show replies from blocked persons query = query.filter(person_actions::blocked.is_null()); - let (limit, offset) = limit_and_offset(options.page, options.limit)?; + let (limit, offset) = limit_and_offset(o.page, o.limit)?; query .limit(limit) diff --git a/crates/db_views_actor/src/community_view.rs b/crates/db_views_actor/src/community_view.rs index 8bcf50ba3..1a8e3c4cd 100644 --- a/crates/db_views_actor/src/community_view.rs +++ b/crates/db_views_actor/src/community_view.rs @@ -90,17 +90,17 @@ fn queries<'a>() -> Queries< query.first(&mut conn).await }; - let list = move |mut conn: DbConn<'a>, (options, site): (CommunityQuery<'a>, &'a Site)| async move { + let list = move |mut conn: DbConn<'a>, (o, site): (CommunityQuery<'a>, &'a Site)| async move { use CommunitySortType::*; - let mut query = all_joins(community::table.into_boxed(), options.local_user).select(selection); + let mut query = all_joins(community::table.into_boxed(), o.local_user).select(selection); - if let Some(search_term) = options.search_term { + if let Some(search_term) = o.search_term { let searcher = fuzzy_search(&search_term); let name_filter = community::name.ilike(searcher.clone()); let title_filter = community::title.ilike(searcher.clone()); let description_filter = community::description.ilike(searcher.clone()); - query = if options.title_only.unwrap_or_default() { + query = if o.title_only.unwrap_or_default() { query.filter(name_filter.or(title_filter)) } else { query.filter(name_filter.or(title_filter.or(description_filter))) @@ -108,7 +108,7 @@ fn queries<'a>() -> Queries< } // Hide deleted and removed for non-admins or mods - if !options.is_mod_or_admin { + if !o.is_mod_or_admin { query = query.filter(not_removed_or_deleted).filter( community::hidden .eq(false) @@ -116,7 +116,7 @@ fn queries<'a>() -> Queries< ); } - match options.sort.unwrap_or(Hot) { + match o.sort.unwrap_or(Hot) { Hot | Active | Scaled => query = query.order_by(community_aggregates::hot_rank.desc()), NewComments | TopDay | TopTwelveHour | TopSixHour | TopHour => { query = query.order_by(community_aggregates::users_active_day.desc()) @@ -137,7 +137,7 @@ fn queries<'a>() -> Queries< NameDesc => query = query.order_by(lower(community::name).desc()), }; - if let Some(listing_type) = options.listing_type { + if let Some(listing_type) = o.listing_type { query = match listing_type { ListingType::Subscribed => { query.filter(community_actions::follow_state.eq(Some(CommunityFollowerState::Accepted))) @@ -151,13 +151,13 @@ fn queries<'a>() -> Queries< // also hidden (based on profile setting) query = query.filter(instance_actions::blocked.is_null()); query = query.filter(community_actions::blocked.is_null()); - if !(options.local_user.show_nsfw(site) || options.show_nsfw) { + if !(o.local_user.show_nsfw(site) || o.show_nsfw) { query = query.filter(community::nsfw.eq(false)); } - query = options.local_user.visible_communities_only(query); + query = o.local_user.visible_communities_only(query); - let (limit, offset) = limit_and_offset(options.page, options.limit)?; + let (limit, offset) = limit_and_offset(o.page, o.limit)?; query .limit(limit) .offset(offset) diff --git a/crates/db_views_actor/src/person_mention_view.rs b/crates/db_views_actor/src/person_mention_view.rs index 08be67a82..b3d6235d4 100644 --- a/crates/db_views_actor/src/person_mention_view.rs +++ b/crates/db_views_actor/src/person_mention_view.rs @@ -113,24 +113,24 @@ fn queries<'a>() -> Queries< .await }; - let list = move |mut conn: DbConn<'a>, options: PersonMentionQuery| async move { + let list = move |mut conn: DbConn<'a>, o: PersonMentionQuery| async move { // These filters need to be kept in sync with the filters in // PersonMentionView::get_unread_mentions() - let mut query = all_joins(person_mention::table.into_boxed(), options.my_person_id); + let mut query = all_joins(person_mention::table.into_boxed(), o.my_person_id); - if let Some(recipient_id) = options.recipient_id { + if let Some(recipient_id) = o.recipient_id { query = query.filter(person_mention::recipient_id.eq(recipient_id)); } - if options.unread_only { + if o.unread_only { query = query.filter(person_mention::read.eq(false)); } - if !options.show_bot_accounts { + if !o.show_bot_accounts { query = query.filter(not(person::bot_account)); }; - query = match options.sort.unwrap_or(CommentSortType::Hot) { + query = match o.sort.unwrap_or(CommentSortType::Hot) { CommentSortType::Hot => query.then_order_by(comment_aggregates::hot_rank.desc()), CommentSortType::Controversial => { query.then_order_by(comment_aggregates::controversy_rank.desc()) @@ -143,7 +143,7 @@ fn queries<'a>() -> Queries< // Don't show mentions from blocked persons query = query.filter(person_actions::blocked.is_null()); - let (limit, offset) = limit_and_offset(options.page, options.limit)?; + let (limit, offset) = limit_and_offset(o.page, o.limit)?; query .limit(limit) diff --git a/crates/db_views_actor/src/person_view.rs b/crates/db_views_actor/src/person_view.rs index b90ab7811..bc12e6559 100644 --- a/crates/db_views_actor/src/person_view.rs +++ b/crates/db_views_actor/src/person_view.rs @@ -99,15 +99,15 @@ fn queries<'a>( ) .filter(person::deleted.eq(false)); } - ListMode::Query(options) => { - if let Some(search_term) = options.search_term { + ListMode::Query(o) => { + if let Some(search_term) = o.search_term { let searcher = fuzzy_search(&search_term); query = query .filter(person::name.ilike(searcher.clone())) .or_filter(person::display_name.ilike(searcher)); } - let sort = options.sort.map(post_to_person_sort_type); + let sort = o.sort.map(post_to_person_sort_type); query = match sort.unwrap_or(PersonSortType::CommentScore) { PersonSortType::New => query.order_by(person::published.desc()), PersonSortType::Old => query.order_by(person::published.asc()), @@ -117,10 +117,10 @@ fn queries<'a>( PersonSortType::PostCount => query.order_by(person_aggregates::post_count.desc()), }; - let (limit, offset) = limit_and_offset(options.page, options.limit)?; + let (limit, offset) = limit_and_offset(o.page, o.limit)?; query = query.limit(limit).offset(offset); - if let Some(listing_type) = options.listing_type { + if let Some(listing_type) = o.listing_type { query = match listing_type { // return nothing as its not possible to follow users ListingType::Subscribed => query.limit(0), From 9c473e82989bf3a90f26a36b86be0b6577446833 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 1 Jan 2025 13:28:26 -0500 Subject: [PATCH 08/10] chore(deps): update rust crate chrono to v0.4.39 (#5295) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 009566cf2..3226ea2e7 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -797,9 +797,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd" [[package]] name = "chrono" -version = "0.4.38" +version = "0.4.39" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401" +checksum = "7e36cc9d416881d2e24f9a963be5fb1cd90966419ac844274161d10488b3e825" dependencies = [ "android-tzdata", "iana-time-zone", From b91790e29ec01bbf5927478944982188a4148db7 Mon Sep 17 00:00:00 2001 From: dullbananas Date: Thu, 2 Jan 2025 10:35:56 -0700 Subject: [PATCH 09/10] Fix incorrect comment in report_combined_view test (#5297) --- crates/db_views/src/report_combined_view.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/db_views/src/report_combined_view.rs b/crates/db_views/src/report_combined_view.rs index 879634cf0..999681fe0 100644 --- a/crates/db_views/src/report_combined_view.rs +++ b/crates/db_views/src/report_combined_view.rs @@ -571,7 +571,7 @@ mod tests { }; CommentReport::report(pool, &sara_report_comment_form).await?; - // Timmy creates a private message report + // Timmy creates a private message let pm_form = PrivateMessageInsertForm::new( data.timmy.id, data.sara.id, From c0342292951c237ec5f575f2165758e4f0712e6f Mon Sep 17 00:00:00 2001 From: anhcuky <42137630+anhcuky@users.noreply.github.com> Date: Fri, 3 Jan 2025 00:37:13 +0700 Subject: [PATCH 10/10] reset_password API to always return success (#5284) --- crates/api/src/local_user/reset_password.rs | 30 +++++++++++++-------- 1 file changed, 19 insertions(+), 11 deletions(-) diff --git a/crates/api/src/local_user/reset_password.rs b/crates/api/src/local_user/reset_password.rs index e0f63d2e6..20707950c 100644 --- a/crates/api/src/local_user/reset_password.rs +++ b/crates/api/src/local_user/reset_password.rs @@ -6,23 +6,31 @@ use lemmy_api_common::{ SuccessResponse, }; use lemmy_db_views::structs::{LocalUserView, SiteView}; -use lemmy_utils::error::{LemmyErrorExt, LemmyErrorType, LemmyResult}; +use lemmy_utils::error::LemmyResult; +use tracing::error; #[tracing::instrument(skip(context))] pub async fn reset_password( data: Json, context: Data, ) -> LemmyResult> { - // Fetch that email let email = data.email.to_lowercase(); - let local_user_view = LocalUserView::find_by_email(&mut context.pool(), &email) - .await - .with_lemmy_type(LemmyErrorType::IncorrectLogin)?; - - let site_view = SiteView::read_local(&mut context.pool()).await?; - check_email_verified(&local_user_view, &site_view)?; - - // Email the pure token to the user. - send_password_reset_email(&local_user_view, &mut context.pool(), context.settings()).await?; + // For security, errors are not returned. + // https://github.com/LemmyNet/lemmy/issues/5277 + let _ = try_reset_password(&email, &context).await; Ok(Json(SuccessResponse::default())) } + +async fn try_reset_password(email: &str, context: &LemmyContext) -> LemmyResult<()> { + let local_user_view = LocalUserView::find_by_email(&mut context.pool(), email).await?; + let site_view = SiteView::read_local(&mut context.pool()).await?; + + check_email_verified(&local_user_view, &site_view)?; + if let Err(e) = + send_password_reset_email(&local_user_view, &mut context.pool(), context.settings()).await + { + error!("Failed to send password reset email: {}", e); + } + + Ok(()) +}