utils: fix another possible leak with private S3 backends using mediaproxy

[akkoma] / lib / pleroma / web / common_api / utils.ex

diff --git a/lib/pleroma/web/common_api/utils.ex b/lib/pleroma/web/common_api/utils.ex
index 9c99513714c93e44e7b979c38b0101676213c8de..ed1fe1ad9dda979d1ba9098eb128c6b4c805239f 100644 (file)
--- a/lib/pleroma/web/common_api/utils.ex
+++ b/lib/pleroma/web/common_api/utils.ex
@@ -1,6 +1,8 @@
 defmodule Pleroma.Web.CommonAPI.Utils do
   alias Pleroma.{Repo, Object, Formatter, Activity}
   alias Pleroma.Web.ActivityPub.Utils
+  alias Pleroma.Web.Endpoint
+  alias Pleroma.Web.MediaProxy
   alias Pleroma.User
   alias Calendar.Strftime
   alias Comeonin.Pbkdf2
@@ -9,11 +11,12 @@ defmodule Pleroma.Web.CommonAPI.Utils do
   def get_by_id_or_ap_id(id) do
     activity = Repo.get(Activity, id) || Activity.get_create_activity_by_object_ap_id(id)
 
-    if activity.data["type"] == "Create" do
-      activity
-    else
-      Activity.get_create_activity_by_object_ap_id(activity.data["object"])
-    end
+    activity &&
+      if activity.data["type"] == "Create" do
+        activity
+      else
+        Activity.get_create_activity_by_object_ap_id(activity.data["object"])
+      end
   end
 
   def get_replied_to_activity(id) when not is_nil(id) do
@@ -61,10 +64,16 @@ defmodule Pleroma.Web.CommonAPI.Utils do
     end
   end
 
-  def make_content_html(status, mentions, attachments, tags, no_attachment_links \\ false) do
+  def make_content_html(
+        status,
+        mentions,
+        attachments,
+        tags,
+        content_type,
+        no_attachment_links \\ false
+      ) do
     status
-    |> String.replace("\r", "")
-    |> format_input(mentions, tags)
+    |> format_input(mentions, tags, content_type)
     |> maybe_add_attachments(attachments, no_attachment_links)
   end
 
@@ -82,6 +91,7 @@ defmodule Pleroma.Web.CommonAPI.Utils do
       Enum.map(attachments, fn
         %{"url" => [%{"href" => href} | _]} ->
           name = URI.decode(Path.basename(href))
+          href = MediaProxy.url(href)
           "<a href=\"#{href}\" class='attachment'>#{shortname(name)}</a>"
 
         _ ->
@@ -91,10 +101,10 @@ defmodule Pleroma.Web.CommonAPI.Utils do
     Enum.join([text | attachment_text], "<br>")
   end
 
-  def format_input(text, mentions, tags) do
+  def format_input(text, mentions, tags, "text/plain") do
     text
-    |> Formatter.html_escape()
-    |> String.replace("\n", "<br>")
+    |> Formatter.html_escape("text/plain")
+    |> String.replace(~r/\r?\n/, "<br>")
     |> (&{[], &1}).()
     |> Formatter.add_links()
     |> Formatter.add_user_links(mentions)
@@ -102,13 +112,33 @@ defmodule Pleroma.Web.CommonAPI.Utils do
     |> Formatter.finalize()
   end
 
+  def format_input(text, mentions, tags, "text/html") do
+    text
+    |> Formatter.html_escape("text/html")
+    |> String.replace(~r/\r?\n/, "<br>")
+    |> (&{[], &1}).()
+    |> Formatter.add_user_links(mentions)
+    |> Formatter.finalize()
+  end
+
+  def format_input(text, mentions, tags, "text/markdown") do
+    text
+    |> Earmark.as_html!()
+    |> Formatter.html_escape("text/html")
+    |> String.replace(~r/\r?\n/, "")
+    |> (&{[], &1}).()
+    |> Formatter.add_user_links(mentions)
+    |> Formatter.add_hashtag_links(tags)
+    |> Formatter.finalize()
+  end
+
   def add_tag_links(text, tags) do
     tags =
       tags
       |> Enum.sort_by(fn {tag, _} -> -String.length(tag) end)
 
     Enum.reduce(tags, text, fn {full, tag}, text ->
-      url = "#<a href='#{Pleroma.Web.base_url()}/tag/#{tag}' rel='tag'>#{tag}</a>"
+      url = "<a href='#{Pleroma.Web.base_url()}/tag/#{tag}' rel='tag'>##{tag}</a>"
       String.replace(text, full, url)
     end)
   end
@@ -195,4 +225,15 @@ defmodule Pleroma.Web.CommonAPI.Utils do
       _ -> {:error, "Invalid password."}
     end
   end
+
+  def emoji_from_profile(%{info: info} = user) do
+    (Formatter.get_emoji(user.bio) ++ Formatter.get_emoji(user.name))
+    |> Enum.map(fn {shortcode, url} ->
+      %{
+        "type" => "Emoji",
+        "icon" => %{"type" => "Image", "url" => "#{Endpoint.url()}#{url}"},
+        "name" => ":#{shortcode}:"
+      }
+    end)
+  end
 end