From 92ea9b97ddec3e22a1cc156d09eabcfb4a22ae26 Mon Sep 17 00:00:00 2001
From: Felix Ableitner <me@nutomic.com>
Date: Tue, 23 Feb 2021 19:00:47 +0100
Subject: [PATCH] Dont include community in comment `to` field (fixes #1446)

---
 crates/apub/src/inbox/community_inbox.rs |  5 ++---
 crates/apub/src/objects/comment.rs       | 10 +++-------
 crates/apub/src/objects/mod.rs           |  4 ++--
 crates/apub/src/objects/post.rs          |  6 ++++--
 4 files changed, 11 insertions(+), 14 deletions(-)

diff --git a/crates/apub/src/inbox/community_inbox.rs b/crates/apub/src/inbox/community_inbox.rs
index 45e7ab43c..f9056a770 100644
--- a/crates/apub/src/inbox/community_inbox.rs
+++ b/crates/apub/src/inbox/community_inbox.rs
@@ -120,7 +120,7 @@ pub(crate) async fn community_receive_message(
     User_::read_from_apub_id(&conn, &actor_id.into())
   })
   .await??;
-  check_community_or_site_ban(&user, &to_community, context.pool()).await?;
+  check_community_or_site_ban(&user, to_community.id, context.pool()).await?;
 
   let any_base = activity.clone().into_any_base()?;
   let actor_url = actor.actor_id();
@@ -261,14 +261,13 @@ async fn handle_undo_follow(
 
 pub(crate) async fn check_community_or_site_ban(
   user: &User_,
-  community: &Community,
+  community_id: i32,
   pool: &DbPool,
 ) -> Result<(), LemmyError> {
   if user.banned {
     return Err(anyhow!("User is banned from site").into());
   }
   let user_id = user.id;
-  let community_id = community.id;
   let is_banned = move |conn: &'_ _| CommunityUserBanView::get(conn, user_id, community_id).is_ok();
   if blocking(pool, is_banned).await? {
     return Err(anyhow!("User is banned from community").into());
diff --git a/crates/apub/src/objects/comment.rs b/crates/apub/src/objects/comment.rs
index beebe8332..8452f3787 100644
--- a/crates/apub/src/objects/comment.rs
+++ b/crates/apub/src/objects/comment.rs
@@ -24,7 +24,6 @@ use anyhow::{anyhow, Context};
 use lemmy_db_queries::{Crud, DbPool};
 use lemmy_db_schema::source::{
   comment::{Comment, CommentForm},
-  community::Community,
   post::Post,
   user::User_,
 };
@@ -50,9 +49,6 @@ impl ToApub for Comment {
     let post_id = self.post_id;
     let post = blocking(pool, move |conn| Post::read(conn, post_id)).await??;
 
-    let community_id = post.community_id;
-    let community = blocking(pool, move |conn| Community::read(conn, community_id)).await??;
-
     // Add a vector containing some important info to the "in_reply_to" field
     // [post_ap_id, Option(parent_comment_ap_id)]
     let mut in_reply_to_vec = vec![post.ap_id.into_inner()];
@@ -68,7 +64,7 @@ impl ToApub for Comment {
       .set_many_contexts(lemmy_context()?)
       .set_id(self.ap_id.to_owned().into_inner())
       .set_published(convert_datetime(self.published))
-      .set_many_tos(vec![community.actor_id.into_inner(), public()])
+      .set_to(public())
       .set_many_in_reply_tos(in_reply_to_vec)
       .set_attributed_to(creator.actor_id.into_inner());
 
@@ -104,13 +100,13 @@ impl FromApub for Comment {
     expected_domain: Url,
     request_counter: &mut i32,
   ) -> Result<Comment, LemmyError> {
-    check_object_for_community_or_site_ban(note, context, request_counter).await?;
-
     let comment: Comment =
       get_object_from_apub(note, context, expected_domain, request_counter).await?;
 
     let post_id = comment.post_id;
     let post = blocking(context.pool(), move |conn| Post::read(conn, post_id)).await??;
+    check_object_for_community_or_site_ban(note, post.community_id, context, request_counter)
+      .await?;
     if post.locked {
       // This is not very efficient because a comment gets inserted just to be deleted right
       // afterwards, but it seems to be the easiest way to implement it.
diff --git a/crates/apub/src/objects/mod.rs b/crates/apub/src/objects/mod.rs
index bf0ac24cb..79b9ad405 100644
--- a/crates/apub/src/objects/mod.rs
+++ b/crates/apub/src/objects/mod.rs
@@ -207,6 +207,7 @@ where
 
 pub(in crate::objects) async fn check_object_for_community_or_site_ban<T, Kind>(
   object: &T,
+  community_id: i32,
   context: &LemmyContext,
   request_counter: &mut i32,
 ) -> Result<(), LemmyError>
@@ -219,8 +220,7 @@ where
     .as_single_xsd_any_uri()
     .context(location_info!())?;
   let user = get_or_fetch_and_upsert_user(user_id, context, request_counter).await?;
-  let community = get_to_community(object, context, request_counter).await?;
-  check_community_or_site_ban(&user, &community, context.pool()).await
+  check_community_or_site_ban(&user, community_id, context.pool()).await
 }
 
 pub(in crate::objects) async fn get_to_community<T, Kind>(
diff --git a/crates/apub/src/objects/post.rs b/crates/apub/src/objects/post.rs
index d3d9dfb8b..2cac67ea4 100644
--- a/crates/apub/src/objects/post.rs
+++ b/crates/apub/src/objects/post.rs
@@ -118,8 +118,10 @@ impl FromApub for Post {
     expected_domain: Url,
     request_counter: &mut i32,
   ) -> Result<Post, LemmyError> {
-    check_object_for_community_or_site_ban(page, context, request_counter).await?;
-    get_object_from_apub(page, context, expected_domain, request_counter).await
+    let post: Post = get_object_from_apub(page, context, expected_domain, request_counter).await?;
+    check_object_for_community_or_site_ban(page, post.community_id, context, request_counter)
+      .await?;
+    Ok(post)
   }
 }