Enforce poll limits and add error handling for MastodonAPI's post endpoint

[akkoma] / lib / pleroma / web / common_api / utils.ex

diff --git a/lib/pleroma/web/common_api/utils.ex b/lib/pleroma/web/common_api/utils.ex
index 13cdffbbd00eeb394174f114596f0e1e35d8f4a6..97172fd941aa4fd09e74fe7579f9d8e39f85c570 100644 (file)
--- a/lib/pleroma/web/common_api/utils.ex
+++ b/lib/pleroma/web/common_api/utils.ex
@@ -102,46 +102,67 @@ defmodule Pleroma.Web.CommonAPI.Utils do
     end
   end
 
-  def make_poll_data(
-        %{"poll" => %{"options" => options, "expires_in" => expires_in}} = data,
-        mentions,
-        tags
-      )
+  def make_poll_data(%{"poll" => %{"options" => options, "expires_in" => expires_in}} = data)
       when is_list(options) and is_integer(expires_in) do
-    content_type = get_content_type(data["content_type"])
-    # XXX: There is probably a more performant/cleaner way to do this
-    {poll, {mentions, tags}} =
-      Enum.map_reduce(options, {mentions, tags}, fn option, {mentions, tags} ->
-        # TODO: Custom emoji
-        {option, mentions_merge, tags_merge} = format_input(option, content_type)
-        mentions = mentions ++ mentions_merge
-        tags = tags ++ tags_merge
-
-        {%{
-           "name" => option,
-           "type" => "Note",
-           "replies" => %{"type" => "Collection", "totalItems" => 0}
-         }, {mentions, tags}}
-      end)
+    %{max_expiration: max_expiration, min_expiration: min_expiration} =
+      limits = Pleroma.Config.get([:instance, :poll_limits])
 
-    end_time =
-      NaiveDateTime.utc_now()
-      |> NaiveDateTime.add(expires_in)
-      |> NaiveDateTime.to_iso8601()
+    # XXX: There is probably a cleaner way of doing this
+    try do
+      if Enum.count(options) > limits.max_options do
+        raise ArgumentError, message: "Poll can't contain more than #{limits.max_options} options"
+      end
 
-    poll =
-      if Pleroma.Web.ControllerHelper.truthy_param?(data["poll"]["multiple"]) do
-        %{"type" => "Question", "anyOf" => poll, "closed" => end_time}
-      else
-        %{"type" => "Question", "oneOf" => poll, "closed" => end_time}
+      {poll, emoji} =
+        Enum.map_reduce(options, %{}, fn option, emoji ->
+          if String.length(option) > limits.max_option_chars do
+            raise ArgumentError,
+              message:
+                "Poll options cannot be longer than #{limits.max_option_chars} characters each"
+          end
+
+          {%{
+             "name" => option,
+             "type" => "Note",
+             "replies" => %{"type" => "Collection", "totalItems" => 0}
+           }, Map.merge(emoji, Formatter.get_emoji_map(option))}
+        end)
+
+      case expires_in do
+        expires_in when expires_in > max_expiration ->
+          raise ArgumentError, message: "Expiration date is too far in the future"
+
+        expires_in when expires_in < min_expiration ->
+          raise ArgumentError, message: "Expiration date is too soon"
+
+        _ ->
+          :noop
       end
 
-    {poll, mentions, tags}
+      end_time =
+        NaiveDateTime.utc_now()
+        |> NaiveDateTime.add(expires_in)
+        |> NaiveDateTime.to_iso8601()
+
+      poll =
+        if Pleroma.Web.ControllerHelper.truthy_param?(data["poll"]["multiple"]) do
+          %{"type" => "Question", "anyOf" => poll, "closed" => end_time}
+        else
+          %{"type" => "Question", "oneOf" => poll, "closed" => end_time}
+        end
+
+      {poll, emoji}
+    rescue
+      e in ArgumentError -> e.message
+    end
+  end
+
+  def make_poll_data(%{"poll" => _}) do
+    "Invalid poll"
   end
 
-  def make_poll_data(data, mentions, tags) do
-    IO.inspect(data, label: "data")
-    {%{}, mentions, tags}
+  def make_poll_data(_data) do
+    {%{}, %{}}
   end
 
   def make_content_html(
@@ -266,16 +287,16 @@ defmodule Pleroma.Web.CommonAPI.Utils do
         tags,
         cw \\ nil,
         cc \\ [],
+        sensitive \\ false,
         merge \\ %{}
       ) do
-    IO.inspect(merge, label: "merge")
-
     object = %{
       "type" => "Note",
       "to" => to,
       "cc" => cc,
       "content" => content_html,
       "summary" => cw,
+      "sensitive" => !Enum.member?(["false", "False", "0", false], sensitive),
       "context" => context,
       "attachment" => attachments,
       "actor" => actor,
@@ -283,13 +304,11 @@ defmodule Pleroma.Web.CommonAPI.Utils do
     }
 
     object =
-      if in_reply_to do
-        in_reply_to_object = Object.normalize(in_reply_to)
-
-        object
-        |> Map.put("inReplyTo", in_reply_to_object.data["id"])
+      with false <- is_nil(in_reply_to),
+           %Object{} = in_reply_to_object <- Object.normalize(in_reply_to) do
+        Map.put(object, "inReplyTo", in_reply_to_object.data["id"])
       else
-        object
+        _ -> object
       end
 
     Map.merge(object, merge)