No OneTemporary
Actions

Size

19 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/lib/pleroma/object.ex b/lib/pleroma/object.ex
	index e678fd415..ab16bf2db 100644
	--- a/lib/pleroma/object.ex
	+++ b/lib/pleroma/object.ex
	@@ -1,329 +1,334 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Object do
	use Ecto.Schema

	import Ecto.Query
	import Ecto.Changeset

	alias Pleroma.Activity
	alias Pleroma.Object
	alias Pleroma.Object.Fetcher
	alias Pleroma.ObjectTombstone
	alias Pleroma.Repo
	alias Pleroma.User

	require Logger

	@type t() :: %__MODULE__{}

	@derive {Jason.Encoder, only: [:data]}

	schema "objects" do
	field(:data, :map)

	timestamps()
	end

	def with_joined_activity(query, activity_type \\ "Create", join_type \\ :inner) do
	object_position = Map.get(query.aliases, :object, 0)

	join(query, join_type, [{object, object_position}], a in Activity,
	on:
	fragment(
	"COALESCE(?->'object'->>'id', ?->>'object') = (? ->> 'id') AND (?->>'type' = ?) ",
	a.data,
	a.data,
	object.data,
	a.data,
	^activity_type
	),
	as: :object_activity
	)
	end

	def create(data) do
	Object.change(%Object{}, %{data: data})
	\|> Repo.insert()
	end

	def change(struct, params \\ %{}) do
	struct
	\|> cast(params, [:data])
	\|> validate_required([:data])
	\|> unique_constraint(:ap_id, name: :objects_unique_apid_index)
	end

	def get_by_id(nil), do: nil
	def get_by_id(id), do: Repo.get(Object, id)

	def get_by_id_and_maybe_refetch(id, opts \\ []) do
	%{updated_at: updated_at} = object = get_by_id(id)

	if opts[:interval] &&
	NaiveDateTime.diff(NaiveDateTime.utc_now(), updated_at) > opts[:interval] do
	case Fetcher.refetch_object(object) do
	{:ok, %Object{} = object} ->
	object

	e ->
	Logger.error("Couldn't refresh #{object.data["id"]}:\n#{inspect(e)}")
	object
	end
	else
	object
	end
	end

	def get_by_ap_id(nil), do: nil

	def get_by_ap_id(ap_id) do
	Repo.one(from(object in Object, where: fragment("(?)->>'id' = ?", object.data, ^ap_id)))
	end

	@doc """
	Get a single attachment by it's name and href
	"""
	@spec get_attachment_by_name_and_href(String.t(), String.t()) :: Object.t() \| nil
	def get_attachment_by_name_and_href(name, href) do
	query =
	from(o in Object,
	where: fragment("(?)->>'name' = ?", o.data, ^name),
	where: fragment("(?)->>'href' = ?", o.data, ^href)
	)

	Repo.one(query)
	end

	defp warn_on_no_object_preloaded(ap_id) do
	"Object.normalize() called without preloaded object (#{inspect(ap_id)}). Consider preloading the object"
	\|> Logger.debug()

	Logger.debug("Backtrace: #{inspect(Process.info(:erlang.self(), :current_stacktrace))}")
	end

	def normalize(_, fetch_remote \\ true, options \\ [])

	# If we pass an Activity to Object.normalize(), we can try to use the preloaded object.
	# Use this whenever possible, especially when walking graphs in an O(N) loop!
	def normalize(%Object{} = object, _, _), do: object
	def normalize(%Activity{object: %Object{} = object}, _, _), do: object

	# A hack for fake activities
	def normalize(%Activity{data: %{"object" => %{"fake" => true} = data}}, _, _) do
	%Object{id: "pleroma:fake_object_id", data: data}
	end

	# No preloaded object
	def normalize(%Activity{data: %{"object" => %{"id" => ap_id}}}, fetch_remote, _) do
	warn_on_no_object_preloaded(ap_id)
	normalize(ap_id, fetch_remote)
	end

	# No preloaded object
	def normalize(%Activity{data: %{"object" => ap_id}}, fetch_remote, _) do
	warn_on_no_object_preloaded(ap_id)
	normalize(ap_id, fetch_remote)
	end

	# Old way, try fetching the object through cache.
	def normalize(%{"id" => ap_id}, fetch_remote, _), do: normalize(ap_id, fetch_remote)
	def normalize(ap_id, false, _) when is_binary(ap_id), do: get_cached_by_ap_id(ap_id)

	def normalize(ap_id, true, options) when is_binary(ap_id) do
	Fetcher.fetch_object_from_id!(ap_id, options)
	end

	def normalize(_, _, _), do: nil

	- # Owned objects can only be mutated by their owner
	- def authorize_mutation(%Object{data: %{"actor" => actor}}, %User{ap_id: ap_id}),
	- do: actor == ap_id
	+ # Owned objects can only be accessed by their owner
	+ def authorize_access(%Object{data: %{"actor" => actor}}, %User{ap_id: ap_id}) do
	+ if actor == ap_id do
	+ :ok
	+ else
	+ {:error, :forbidden}
	+ end
	+ end

	- # Legacy objects can be mutated by anybody
	- def authorize_mutation(%Object{}, %User{}), do: true
	+ # Legacy objects can be accessed by anybody
	+ def authorize_access(%Object{}, %User{}), do: :ok

	@spec get_cached_by_ap_id(String.t()) :: Object.t() \| nil
	def get_cached_by_ap_id(ap_id) do
	key = "object:#{ap_id}"

	with {:ok, nil} <- Cachex.get(:object_cache, key),
	object when not is_nil(object) <- get_by_ap_id(ap_id),
	{:ok, true} <- Cachex.put(:object_cache, key, object) do
	object
	else
	{:ok, object} -> object
	nil -> nil
	end
	end

	def context_mapping(context) do
	Object.change(%Object{}, %{data: %{"id" => context}})
	end

	def make_tombstone(%Object{data: %{"id" => id, "type" => type}}, deleted \\ DateTime.utc_now()) do
	%ObjectTombstone{
	id: id,
	formerType: type,
	deleted: deleted
	}
	\|> Map.from_struct()
	end

	def swap_object_with_tombstone(object) do
	tombstone = make_tombstone(object)

	object
	\|> Object.change(%{data: tombstone})
	\|> Repo.update()
	end

	def delete(%Object{data: %{"id" => id}} = object) do
	with {:ok, _obj} = swap_object_with_tombstone(object),
	deleted_activity = Activity.delete_all_by_object_ap_id(id),
	{:ok, true} <- Cachex.del(:object_cache, "object:#{id}"),
	{:ok, _} <- Cachex.del(:web_resp_cache, URI.parse(id).path) do
	with true <- Pleroma.Config.get([:instance, :cleanup_attachments]) do
	{:ok, _} =
	Pleroma.Workers.AttachmentsCleanupWorker.enqueue("cleanup_attachments", %{
	"object" => object
	})
	end

	{:ok, object, deleted_activity}
	end
	end

	def prune(%Object{data: %{"id" => id}} = object) do
	with {:ok, object} <- Repo.delete(object),
	{:ok, true} <- Cachex.del(:object_cache, "object:#{id}"),
	{:ok, _} <- Cachex.del(:web_resp_cache, URI.parse(id).path) do
	{:ok, object}
	end
	end

	def set_cache(%Object{data: %{"id" => ap_id}} = object) do
	Cachex.put(:object_cache, "object:#{ap_id}", object)
	{:ok, object}
	end

	def update_and_set_cache(changeset) do
	with {:ok, object} <- Repo.update(changeset) do
	set_cache(object)
	end
	end

	def increase_replies_count(ap_id) do
	Object
	\|> where([o], fragment("?->>'id' = ?::text", o.data, ^to_string(ap_id)))
	\|> update([o],
	set: [
	data:
	fragment(
	"""
	safe_jsonb_set(?, '{repliesCount}',
	(coalesce((?->>'repliesCount')::int, 0) + 1)::varchar::jsonb, true)
	""",
	o.data,
	o.data
	)
	]
	)
	\|> Repo.update_all([])
	\|> case do
	{1, [object]} -> set_cache(object)
	_ -> {:error, "Not found"}
	end
	end

	def decrease_replies_count(ap_id) do
	Object
	\|> where([o], fragment("?->>'id' = ?::text", o.data, ^to_string(ap_id)))
	\|> update([o],
	set: [
	data:
	fragment(
	"""
	safe_jsonb_set(?, '{repliesCount}',
	(greatest(0, (?->>'repliesCount')::int - 1))::varchar::jsonb, true)
	""",
	o.data,
	o.data
	)
	]
	)
	\|> Repo.update_all([])
	\|> case do
	{1, [object]} -> set_cache(object)
	_ -> {:error, "Not found"}
	end
	end

	def increase_vote_count(ap_id, name, actor) do
	with %Object{} = object <- Object.normalize(ap_id),
	"Question" <- object.data["type"] do
	multiple = Map.has_key?(object.data, "anyOf")

	options =
	(object.data["anyOf"] \|\| object.data["oneOf"] \|\| [])
	\|> Enum.map(fn
	%{"name" => ^name} = option ->
	Kernel.update_in(option["replies"]["totalItems"], &(&1 + 1))

	option ->
	option
	end)

	voters = [actor \| object.data["voters"] \|\| []] \|> Enum.uniq()

	data =
	if multiple do
	Map.put(object.data, "anyOf", options)
	else
	Map.put(object.data, "oneOf", options)
	end
	\|> Map.put("voters", voters)

	object
	\|> Object.change(%{data: data})
	\|> update_and_set_cache()
	else
	_ -> :noop
	end
	end

	@doc "Updates data field of an object"
	def update_data(%Object{data: data} = object, attrs \\ %{}) do
	object
	\|> Object.change(%{data: Map.merge(data \|\| %{}, attrs)})
	\|> Repo.update()
	end

	def local?(%Object{data: %{"id" => id}}) do
	String.starts_with?(id, Pleroma.Web.base_url() <> "/")
	end

	def replies(object, opts \\ []) do
	object = Object.normalize(object)

	query =
	Object
	\|> where(
	[o],
	fragment("(?)->>'inReplyTo' = ?", o.data, ^object.data["id"])
	)
	\|> order_by([o], asc: o.id)

	if opts[:self_only] do
	actor = object.data["actor"]
	where(query, [o], fragment("(?)->>'actor' = ?", o.data, ^actor))
	else
	query
	end
	end

	def self_replies(object, opts \\ []),
	do: replies(object, Keyword.put(opts, :self_only, true))
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/fallback_controller.ex b/lib/pleroma/web/mastodon_api/controllers/fallback_controller.ex
	index 0a257f604..8af557b61 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/fallback_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/fallback_controller.ex
	@@ -1,34 +1,38 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.FallbackController do
	use Pleroma.Web, :controller

	def call(conn, {:error, %Ecto.Changeset{} = changeset}) do
	error_message =
	changeset
	\|> Ecto.Changeset.traverse_errors(fn {message, _opt} -> message end)
	\|> Enum.map_join(", ", fn {_k, v} -> v end)

	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: error_message})
	end

	def call(conn, {:error, :not_found}) do
	render_error(conn, :not_found, "Record not found")
	end

	+ def call(conn, {:error, :forbidden}) do
	+ render_error(conn, :forbidden, "Access denied")
	+ end
	+
	def call(conn, {:error, error_message}) do
	conn
	\|> put_status(:bad_request)
	\|> json(%{error: error_message})
	end

	def call(conn, _) do
	conn
	\|> put_status(:internal_server_error)
	\|> json(dgettext("errors", "Something went wrong"))
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/media_controller.ex b/lib/pleroma/web/mastodon_api/controllers/media_controller.ex
	index afa8b2ea2..513de279f 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/media_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/media_controller.ex
	@@ -1,80 +1,80 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.MediaController do
	use Pleroma.Web, :controller

	alias Pleroma.Object
	alias Pleroma.Plugs.OAuthScopesPlug
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)
	plug(Pleroma.Web.ApiSpec.CastAndValidate)
	plug(:put_view, Pleroma.Web.MastodonAPI.StatusView)

	plug(OAuthScopesPlug, %{scopes: ["read:media"]} when action == :show)
	plug(OAuthScopesPlug, %{scopes: ["write:media"]} when action != :show)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.MediaOperation

	@doc "POST /api/v1/media"
	def create(%{assigns: %{user: user}, body_params: %{file: file} = data} = conn, _) do
	with {:ok, object} <-
	ActivityPub.upload(
	file,
	actor: User.ap_id(user),
	description: Map.get(data, :description)
	) do
	attachment_data = Map.put(object.data, "id", object.id)

	render(conn, "attachment.json", %{attachment: attachment_data})
	end
	end

	def create(_conn, _data), do: {:error, :bad_request}

	@doc "POST /api/v2/media"
	def create2(%{assigns: %{user: user}, body_params: %{file: file} = data} = conn, _) do
	with {:ok, object} <-
	ActivityPub.upload(
	file,
	actor: User.ap_id(user),
	description: Map.get(data, :description)
	) do
	attachment_data = Map.put(object.data, "id", object.id)

	conn
	\|> put_status(202)
	\|> render("attachment.json", %{attachment: attachment_data})
	end
	end

	def create2(_conn, _data), do: {:error, :bad_request}

	@doc "PUT /api/v1/media/:id"
	def update(%{assigns: %{user: user}, body_params: %{description: description}} = conn, %{id: id}) do
	with %Object{} = object <- Object.get_by_id(id),
	- true <- Object.authorize_mutation(object, user),
	+ :ok <- Object.authorize_access(object, user),
	{:ok, %Object{data: data}} <- Object.update_data(object, %{"name" => description}) do
	attachment_data = Map.put(data, "id", object.id)

	render(conn, "attachment.json", %{attachment: attachment_data})
	end
	end

	def update(conn, data), do: show(conn, data)

	- # TODO: clarify: is the access to non-owned objects granted intentionally?
	@doc "GET /api/v1/media/:id"
	- def show(conn, %{id: id}) do
	- with %Object{data: data, id: object_id} <- Object.get_by_id(id) do
	+ def show(%{assigns: %{user: user}} = conn, %{id: id}) do
	+ with %Object{data: data, id: object_id} = object <- Object.get_by_id(id),
	+ :ok <- Object.authorize_access(object, user) do
	attachment_data = Map.put(data, "id", object_id)

	render(conn, "attachment.json", %{attachment: attachment_data})
	end
	end

	def show(_conn, _data), do: {:error, :bad_request}
	end
	diff --git a/test/web/mastodon_api/controllers/media_controller_test.exs b/test/web/mastodon_api/controllers/media_controller_test.exs
	index 98ec239b1..906fd940f 100644
	--- a/test/web/mastodon_api/controllers/media_controller_test.exs
	+++ b/test/web/mastodon_api/controllers/media_controller_test.exs
	@@ -1,136 +1,146 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.MediaControllerTest do
	use Pleroma.Web.ConnCase

	alias Pleroma.Object
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub

	describe "Upload media" do
	setup do: oauth_access(["write:media"])

	setup do
	image = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	[image: image]
	end

	setup do: clear_config([:media_proxy])
	setup do: clear_config([Pleroma.Upload])

	test "/api/v1/media", %{conn: conn, image: image} do
	desc = "Description of the image"

	media =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/v1/media", %{"file" => image, "description" => desc})
	\|> json_response_and_validate_schema(:ok)

	assert media["type"] == "image"
	assert media["description"] == desc
	assert media["id"]

	object = Object.get_by_id(media["id"])
	assert object.data["actor"] == User.ap_id(conn.assigns[:user])
	end

	test "/api/v2/media", %{conn: conn, user: user, image: image} do
	desc = "Description of the image"

	response =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/v2/media", %{"file" => image, "description" => desc})
	\|> json_response_and_validate_schema(202)

	assert media_id = response["id"]

	%{conn: conn} = oauth_access(["read:media"], user: user)

	media =
	conn
	\|> get("/api/v1/media/#{media_id}")
	\|> json_response_and_validate_schema(200)

	assert media["type"] == "image"
	assert media["description"] == desc
	assert media["id"]
	- object = Object.get_by_id(media["id"])

	- # TODO: clarify: if this EP allows access to non-owned objects, the following may be false:
	- assert object.data["actor"] == User.ap_id(conn.assigns[:user])
	+ object = Object.get_by_id(media["id"])
	+ assert object.data["actor"] == user.ap_id
	end
	end

	describe "Update media description" do
	setup do: oauth_access(["write:media"])

	setup %{user: actor} do
	file = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	{:ok, %Object{} = object} =
	ActivityPub.upload(
	file,
	actor: User.ap_id(actor),
	description: "test-m"
	)

	[object: object]
	end

	test "/api/v1/media/:id good request", %{conn: conn, object: object} do
	media =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> put("/api/v1/media/#{object.id}", %{"description" => "test-media"})
	\|> json_response_and_validate_schema(:ok)

	assert media["description"] == "test-media"
	assert refresh_record(object).data["name"] == "test-media"
	end
	end

	- describe "Get media by id" do
	+ describe "Get media by id (/api/v1/media/:id)" do
	setup do: oauth_access(["read:media"])

	setup %{user: actor} do
	file = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	{:ok, %Object{} = object} =
	ActivityPub.upload(
	file,
	actor: User.ap_id(actor),
	description: "test-media"
	)

	[object: object]
	end

	- test "/api/v1/media/:id", %{conn: conn, object: object} do
	+ test "it returns media object when requested by owner", %{conn: conn, object: object} do
	media =
	conn
	\|> get("/api/v1/media/#{object.id}")
	\|> json_response_and_validate_schema(:ok)

	assert media["description"] == "test-media"
	assert media["type"] == "image"
	assert media["id"]
	end
	+
	+ test "it returns 403 if media object requested by non-owner", %{object: object, user: user} do
	+ %{conn: conn, user: other_user} = oauth_access(["read:media"])
	+
	+ assert object.data["actor"] == user.ap_id
	+ refute user.id == other_user.id
	+
	+ conn
	+ \|> get("/api/v1/media/#{object.id}")
	+ \|> json_response(403)
	+ end
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Sat, Aug 29, 8:04 AM (1 d, 16 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1736274
Default Alt Text: (19 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions