Merge pull request 'Apply security patch from pleroma to prevent nested file names...
[akkoma] / lib / pleroma / web / common_api / activity_draft.ex
1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
4
5 defmodule Pleroma.Web.CommonAPI.ActivityDraft do
6 alias Pleroma.Activity
7 alias Pleroma.Conversation.Participation
8 alias Pleroma.Object
9 alias Pleroma.Web.ActivityPub.Builder
10 alias Pleroma.Web.CommonAPI
11 alias Pleroma.Web.CommonAPI.Utils
12
13 import Pleroma.Web.Gettext
14
15 defstruct valid?: true,
16 errors: [],
17 user: nil,
18 params: %{},
19 status: nil,
20 summary: nil,
21 full_payload: nil,
22 attachments: [],
23 in_reply_to: nil,
24 in_reply_to_conversation: nil,
25 language: nil,
26 content_map: %{},
27 quote_id: nil,
28 quote: nil,
29 visibility: nil,
30 expires_at: nil,
31 extra: nil,
32 emoji: %{},
33 content_html: nil,
34 mentions: [],
35 tags: [],
36 to: [],
37 cc: [],
38 context: nil,
39 sensitive: false,
40 object: nil,
41 preview?: false,
42 changes: %{}
43
44 def new(user, params) do
45 %__MODULE__{user: user}
46 |> put_params(params)
47 end
48
49 def create(user, params) do
50 user
51 |> new(params)
52 |> status()
53 |> summary()
54 |> with_valid(&attachments/1)
55 |> full_payload()
56 |> expires_at()
57 |> poll()
58 |> with_valid(&in_reply_to/1)
59 |> with_valid(&in_reply_to_conversation/1)
60 |> with_valid(&visibility/1)
61 |> with_valid(&quote_id/1)
62 |> content()
63 |> with_valid(&language/1)
64 |> with_valid(&to_and_cc/1)
65 |> with_valid(&context/1)
66 |> sensitive()
67 |> with_valid(&object/1)
68 |> preview?()
69 |> with_valid(&changes/1)
70 |> validate()
71 end
72
73 defp put_params(draft, params) do
74 params = Map.put_new(params, :in_reply_to_status_id, params[:in_reply_to_id])
75 %__MODULE__{draft | params: params}
76 end
77
78 defp status(%{params: %{status: status}} = draft) do
79 %__MODULE__{draft | status: String.trim(status)}
80 end
81
82 defp summary(%{params: params} = draft) do
83 %__MODULE__{draft | summary: Map.get(params, :spoiler_text, "")}
84 end
85
86 defp full_payload(%{status: status, summary: summary} = draft) do
87 full_payload = String.trim(status <> summary)
88
89 case Utils.validate_character_limit(full_payload, draft.attachments) do
90 :ok -> %__MODULE__{draft | full_payload: full_payload}
91 {:error, message} -> add_error(draft, message)
92 end
93 end
94
95 defp attachments(%{params: params} = draft) do
96 attachments = Utils.attachments_from_ids(params)
97 %__MODULE__{draft | attachments: attachments}
98 end
99
100 defp in_reply_to(%{params: %{in_reply_to_status_id: ""}} = draft), do: draft
101
102 defp in_reply_to(%{params: %{in_reply_to_status_id: id}} = draft) when is_binary(id) do
103 %__MODULE__{draft | in_reply_to: Activity.get_by_id(id)}
104 end
105
106 defp in_reply_to(%{params: %{in_reply_to_status_id: %Activity{} = in_reply_to}} = draft) do
107 %__MODULE__{draft | in_reply_to: in_reply_to}
108 end
109
110 defp in_reply_to(draft), do: draft
111
112 defp in_reply_to_conversation(draft) do
113 in_reply_to_conversation = Participation.get(draft.params[:in_reply_to_conversation_id])
114 %__MODULE__{draft | in_reply_to_conversation: in_reply_to_conversation}
115 end
116
117 defp quote_id(%{params: %{quote_id: ""}} = draft), do: draft
118
119 defp quote_id(%{params: %{quote_id: id}} = draft) when is_binary(id) do
120 with {:activity, %Activity{} = quote} <- {:activity, Activity.get_by_id(id)},
121 visibility <- CommonAPI.get_quoted_visibility(quote),
122 {:visibility, true} <- {:visibility, visibility in ["public", "unlisted"]} do
123 %__MODULE__{draft | quote: Activity.get_by_id(id)}
124 else
125 {:activity, _} ->
126 add_error(draft, dgettext("errors", "You can't quote a status that doesn't exist"))
127
128 {:visibility, false} ->
129 add_error(draft, dgettext("errors", "You can only quote public or unlisted statuses"))
130 end
131 end
132
133 defp quote_id(%{params: %{quote_id: %Activity{} = quote}} = draft) do
134 %__MODULE__{draft | quote: quote}
135 end
136
137 defp quote_id(draft), do: draft
138
139 defp language(%{params: %{language: language}, content_html: content} = draft)
140 when is_binary(language) do
141 if Pleroma.ISO639.valid_alpha2?(language) do
142 %__MODULE__{draft | content_map: %{language => content}}
143 else
144 add_error(draft, dgettext("errors", "Invalid language"))
145 end
146 end
147
148 defp language(%{content_html: content} = draft) do
149 # Use a default language if no language is specified
150 %__MODULE__{draft | content_map: %{"en" => content}}
151 end
152
153 defp visibility(%{params: params} = draft) do
154 case CommonAPI.get_visibility(params, draft.in_reply_to, draft.in_reply_to_conversation) do
155 {visibility, "direct"} when visibility != "direct" ->
156 add_error(draft, dgettext("errors", "The message visibility must be direct"))
157
158 {visibility, _} ->
159 %__MODULE__{draft | visibility: visibility}
160 end
161 end
162
163 defp expires_at(draft) do
164 case CommonAPI.check_expiry_date(draft.params[:expires_in]) do
165 {:ok, expires_at} -> %__MODULE__{draft | expires_at: expires_at}
166 {:error, message} -> add_error(draft, message)
167 end
168 end
169
170 defp poll(draft) do
171 case Utils.make_poll_data(draft.params) do
172 {:ok, {poll, poll_emoji}} ->
173 %__MODULE__{draft | extra: poll, emoji: Map.merge(draft.emoji, poll_emoji)}
174
175 {:error, message} ->
176 add_error(draft, message)
177 end
178 end
179
180 defp content(draft) do
181 {content_html, mentioned_users, tags} = Utils.make_content_html(draft)
182
183 mentions =
184 mentioned_users
185 |> Enum.map(fn {_, mentioned_user} -> mentioned_user.ap_id end)
186 |> Utils.get_addressed_users(draft.params[:to])
187
188 %__MODULE__{draft | content_html: content_html, mentions: mentions, tags: tags}
189 end
190
191 defp to_and_cc(draft) do
192 {to, cc} = Utils.get_to_and_cc(draft)
193 %__MODULE__{draft | to: to, cc: cc}
194 end
195
196 defp context(draft) do
197 context = Utils.make_context(draft)
198 %__MODULE__{draft | context: context}
199 end
200
201 defp sensitive(draft) do
202 sensitive = draft.params[:sensitive]
203 %__MODULE__{draft | sensitive: sensitive}
204 end
205
206 defp object(draft) do
207 emoji = Map.merge(Pleroma.Emoji.Formatter.get_emoji_map(draft.full_payload), draft.emoji)
208
209 # Sometimes people create posts with subject containing emoji,
210 # since subjects are usually copied this will result in a broken
211 # subject when someone replies from an instance that does not have
212 # the emoji or has it under different shortcode. This is an attempt
213 # to mitigate this by copying emoji from inReplyTo if they are present
214 # in the subject.
215 summary_emoji =
216 with %Activity{} <- draft.in_reply_to,
217 %Object{data: %{"tag" => [_ | _] = tag}} <- Object.normalize(draft.in_reply_to) do
218 Enum.reduce(tag, %{}, fn
219 %{"type" => "Emoji", "name" => name, "icon" => %{"url" => url}}, acc ->
220 if String.contains?(draft.summary, name) do
221 Map.put(acc, name, url)
222 else
223 acc
224 end
225
226 _, acc ->
227 acc
228 end)
229 else
230 _ -> %{}
231 end
232
233 emoji = Map.merge(emoji, summary_emoji)
234 {:ok, note_data, _meta} = Builder.note(draft)
235
236 object =
237 note_data
238 |> Map.put("emoji", emoji)
239 |> Map.put("source", %{
240 "content" => draft.status,
241 "mediaType" => Utils.get_content_type(draft.params[:content_type])
242 })
243 |> Map.put("generator", draft.params[:generator])
244 |> Map.put("contentMap", draft.content_map)
245
246 %__MODULE__{draft | object: object}
247 end
248
249 defp preview?(draft) do
250 preview? = Pleroma.Web.Utils.Params.truthy_param?(draft.params[:preview])
251 %__MODULE__{draft | preview?: preview?}
252 end
253
254 defp changes(draft) do
255 direct? = draft.visibility == "direct"
256 additional = %{"cc" => draft.cc, "directMessage" => direct?}
257
258 additional =
259 case draft.expires_at do
260 %DateTime{} = expires_at -> Map.put(additional, "expires_at", expires_at)
261 _ -> additional
262 end
263
264 changes =
265 %{
266 to: draft.to,
267 actor: draft.user,
268 context: draft.context,
269 object: draft.object,
270 additional: additional
271 }
272 |> Utils.maybe_add_list_data(draft.user, draft.visibility)
273
274 %__MODULE__{draft | changes: changes}
275 end
276
277 defp with_valid(%{valid?: true} = draft, func), do: func.(draft)
278 defp with_valid(draft, _func), do: draft
279
280 defp add_error(draft, message) do
281 %__MODULE__{draft | valid?: false, errors: [message | draft.errors]}
282 end
283
284 defp validate(%{valid?: true} = draft), do: {:ok, draft}
285 defp validate(%{errors: [message | _]}), do: {:error, message}
286 end