Add more checks in inbox, plus some refactoring #76

nutomic · 2020-08-01T17:29:53Z

nutomic commented

2020-08-01 17:29:53 +00:00

This is just a bit of high-level stuff. In the next step, I will have to call check_is_apub_id_valid() on every apub id that is coming in through an activity.

Note that some federation tests are currently failing.

Edit: Fixed all federation tests.

This is just a bit of high-level stuff. In the next step, I will have to call `check_is_apub_id_valid()` on every apub id that is coming in through an activity. Note that some federation tests are currently failing. Edit: Fixed all federation tests.

nutomic changed title from ~~WIP: Add more checks in inbox, plus some refactoring~~ to Add more checks in inbox, plus some refactoring

2020-08-03 14:00:57 +00:00

nutomic commented

2020-08-03 14:01:47 +00:00

Ready for review. Note the commit message for the Claims::decode commit. Not sure if there is anything else thats worth extracting in the API.

dessalines reviewed 2020-08-04 14:29:45 +00:00

server/src/api/comment.rs

						
				@ -258,3 +245,1 @@

				    };

				    let user_id = claims.id;

				    let user = get_user_from_jwt(&data.auth, pool).await?;

dessalines commented

2020-08-04 14:29:45 +00:00

Def a lot easier.

dessalines reviewed 2020-08-04 14:35:30 +00:00

server/src/api/mod.rs

						
				@ -78,0 +89,4 @@

				  let user = blocking(pool, move |conn| User_::read(conn, user_id)).await??;

				  // Check for a site ban

				  if user.banned {

				    return Err(APIError::err("site_ban").into());

dessalines commented

2020-08-04 14:35:30 +00:00

Ah I see. Checking for a site ban here.

Yeah I forget which actions I allowed for those who were banned before, but they probably weren't important. And its probably best to block all actions bc it could potentially be spam anyway.

Ah I see. Checking for a site ban here. Yeah I forget which actions I allowed for those who were banned before, but they probably weren't important. And its probably best to block all actions bc it could potentially be spam anyway.