No auth check in UserController.feed_redirect/2, even on non-federating instances.
[akkoma] / lib / pleroma / web / feed / user_controller.ex
1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
4
5 defmodule Pleroma.Web.Feed.UserController do
6 use Pleroma.Web, :controller
7
8 alias Fallback.RedirectController
9 alias Pleroma.User
10 alias Pleroma.Web.ActivityPub.ActivityPub
11 alias Pleroma.Web.ActivityPub.ActivityPubController
12 alias Pleroma.Web.Feed.FeedView
13
14 plug(Pleroma.Plugs.SetFormatPlug when action in [:feed_redirect])
15
16 action_fallback(:errors)
17
18 def feed_redirect(%{assigns: %{format: "html"}} = conn, %{"nickname" => nickname}) do
19 with {_, %User{} = user} <- {:fetch_user, User.get_cached_by_nickname_or_id(nickname)} do
20 RedirectController.redirector_with_meta(conn, %{user: user})
21 end
22 end
23
24 def feed_redirect(%{assigns: %{format: format}} = conn, _params)
25 when format in ["json", "activity+json"] do
26 ActivityPubController.call(conn, :user)
27 end
28
29 def feed_redirect(conn, %{"nickname" => nickname}) do
30 with {_, %User{} = user} <- {:fetch_user, User.get_cached_by_nickname(nickname)} do
31 redirect(conn, external: "#{user_feed_url(conn, :feed, user.nickname)}.atom")
32 end
33 end
34
35 def feed(conn, params) do
36 unless Pleroma.Config.restrict_unauthenticated_access?(:profiles, :local) do
37 render_feed(conn, params)
38 else
39 errors(conn, {:error, :not_found})
40 end
41 end
42
43 def render_feed(conn, %{"nickname" => nickname} = params) do
44 format = get_format(conn)
45
46 format =
47 if format in ["rss", "atom"] do
48 format
49 else
50 "atom"
51 end
52
53 with {_, %User{local: true} = user} <- {:fetch_user, User.get_cached_by_nickname(nickname)} do
54 activities =
55 %{
56 type: ["Create"],
57 actor_id: user.ap_id
58 }
59 |> Pleroma.Maps.put_if_present(:max_id, params["max_id"])
60 |> ActivityPub.fetch_public_or_unlisted_activities()
61
62 conn
63 |> put_resp_content_type("application/#{format}+xml")
64 |> put_view(FeedView)
65 |> render("user.#{format}",
66 user: user,
67 activities: activities,
68 feed_config: Pleroma.Config.get([:feed])
69 )
70 end
71 end
72
73 def errors(conn, {:error, :not_found}) do
74 render_error(conn, :not_found, "Not found")
75 end
76
77 def errors(conn, {:fetch_user, %User{local: false}}), do: errors(conn, {:error, :not_found})
78 def errors(conn, {:fetch_user, nil}), do: errors(conn, {:error, :not_found})
79
80 def errors(conn, _) do
81 render_error(conn, :internal_server_error, "Something went wrong")
82 end
83 end