Page MenuHomePhorge
Files F85629601

No OneTemporary
Actions

Size
5 KB
Referenced Files
None
Subscribers
None

View Options

diff --git a/lib/pleroma/web/embed_controller.ex b/lib/pleroma/web/embed_controller.ex
index 91bd79766..cffd6e29f 100644
--- a/lib/pleroma/web/embed_controller.ex
+++ b/lib/pleroma/web/embed_controller.ex
@@ -1,42 +1,51 @@
# Pleroma: A lightweight social networking server
# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Pleroma.Web.EmbedController do
use Pleroma.Web, :controller
alias Pleroma.Activity
alias Pleroma.Object
alias Pleroma.User
alias Pleroma.Web.ActivityPub.Visibility
- plug(:put_layout, :embed)
-
def show(conn, %{"id" => id}) do
- with %Activity{local: true} = activity <-
- Activity.get_by_id_with_object(id),
- true <- Visibility.visible_for_user?(activity.object, nil) do
+ with {:activity, %Activity{} = activity} <-
+ {:activity, Activity.get_by_id_with_object(id)},
+ {:local, true} <- {:local, activity.local},
+ {:visible, true} <- {:visible, Visibility.visible_for_user?(activity, nil)} do
{:ok, author} = User.get_or_fetch(activity.object.data["actor"])
conn
|> delete_resp_header("x-frame-options")
|> delete_resp_header("content-security-policy")
+ |> put_view(Pleroma.Web.EmbedView)
|> render("show.html",
activity: activity,
author: User.sanitize_html(author),
counts: get_counts(activity)
)
+ else
+ {:activity, _} ->
+ render_error(conn, :not_found, "Post not found")
+
+ {:local, false} ->
+ render_error(conn, :unauthorized, "Federated posts cannot be embedded")
+
+ {:visible, false} ->
+ render_error(conn, :unauthorized, "Not authorized to view this post")
end
end
defp get_counts(%Activity{} = activity) do
%Object{data: data} = Object.normalize(activity, fetch: false)
%{
likes: Map.get(data, "like_count", 0),
replies: Map.get(data, "repliesCount", 0),
announces: Map.get(data, "announcement_count", 0)
}
end
end
diff --git a/lib/pleroma/web/views/embed_view.ex b/lib/pleroma/web/views/embed_view.ex
index 81e196730..913d717be 100644
--- a/lib/pleroma/web/views/embed_view.ex
+++ b/lib/pleroma/web/views/embed_view.ex
@@ -1,71 +1,74 @@
# Pleroma: A lightweight social networking server
# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Pleroma.Web.EmbedView do
use Pleroma.Web, :view
alias Calendar.Strftime
alias Pleroma.Activity
alias Pleroma.Emoji.Formatter
alias Pleroma.Object
alias Pleroma.User
alias Pleroma.Web.Gettext
alias Pleroma.Web.MediaProxy
alias Pleroma.Web.Metadata.Utils
alias Pleroma.Web.Router.Helpers
- use Phoenix.HTML
+ import Phoenix.HTML
defdelegate full_nickname(user), to: User
@media_types ["image", "audio", "video"]
defp fetch_media_type(%{"mediaType" => mediaType}) do
Utils.fetch_media_type(@media_types, mediaType)
end
defp open_content? do
Pleroma.Config.get(
[:frontend_configurations, :collapse_message_with_subjects],
true
)
end
defp status_title(%Activity{object: %Object{data: %{"name" => name}}}) when is_binary(name),
do: name
defp status_title(%Activity{object: %Object{data: %{"summary" => summary}}})
when is_binary(summary),
do: summary
defp status_title(_), do: nil
defp activity_content(%Activity{object: %Object{data: %{"content" => content}}}) do
content |> Pleroma.HTML.filter_tags() |> raw()
end
defp activity_content(_), do: nil
defp activity_url(%User{local: true}, activity) do
Helpers.o_status_url(Pleroma.Web.Endpoint, :notice, activity)
end
defp activity_url(%User{local: false}, %Activity{object: %Object{data: data}}) do
data["url"] || data["external_url"] || data["id"]
end
- defp attachments(%Activity{object: %Object{data: %{"attachment" => attachments}}}) do
+ defp attachments(%Activity{object: %Object{data: %{"attachment" => attachments}}})
+ when is_list(attachments) do
attachments
end
+ defp attachments(_), do: []
+
defp sensitive?(%Activity{object: %Object{data: %{"sensitive" => sensitive}}}) do
sensitive
end
defp published(%Activity{object: %Object{data: %{"published" => published}}}) do
published
|> NaiveDateTime.from_iso8601!()
|> Strftime.strftime!("%B %d, %Y, %l:%M %p")
end
end
diff --git a/test/pleroma/web/embed_controller_test.exs b/test/pleroma/web/embed_controller_test.exs
new file mode 100644
index 000000000..caf328cc5
--- /dev/null
+++ b/test/pleroma/web/embed_controller_test.exs
@@ -0,0 +1,44 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.EmbedControllerTest do
+ use Pleroma.Web.ConnCase, async: true
+ import Pleroma.Factory
+
+ test "/embed", %{conn: conn} do
+ activity = insert(:note_activity)
+
+ resp =
+ conn
+ |> get("/embed/#{activity.id}")
+ |> response(200)
+
+ object = Pleroma.Object.get_by_ap_id(activity.data["object"])
+
+ assert String.contains?(resp, object.data["content"])
+ end
+
+ test "/embed with a restricted post", %{conn: conn} do
+ activity = insert(:note_activity)
+ clear_config([:restrict_unauthenticated, :activities, :local], true)
+
+ conn
+ |> get("/embed/#{activity.id}")
+ |> response(401)
+ end
+
+ test "/embed with a private post", %{conn: conn} do
+ user = insert(:user)
+
+ {:ok, activity} =
+ Pleroma.Web.CommonAPI.post(user, %{
+ status: "Mega ultra chicken status: #fried",
+ visibility: "private"
+ })
+
+ conn
+ |> get("/embed/#{activity.id}")
+ |> response(401)
+ end
+end

File Metadata

Mime Type
text/x-diff
Expires
Sun, Aug 9, 1:16 AM (1 d, 22 h)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
1724094
Default Alt Text
(5 KB)

Event Timeline