Merge branch 'check-attachment-attribution' into 'develop'
Prevent users from attaching other users' attachments See merge request pleroma/pleroma!3947
This commit is contained in:
commit
a94cf2ad4f
|
@ -0,0 +1 @@
|
|||
CommonAPI: Prevent users from accessing media of other users by creating a status with reused attachment ID
|
|
@ -40,7 +40,11 @@ defp with_media_attachments(
|
|||
%{changes: %{params: %{"media_ids" => media_ids} = params}} = changeset
|
||||
)
|
||||
when is_list(media_ids) do
|
||||
media_attachments = Utils.attachments_from_ids(%{media_ids: media_ids})
|
||||
media_attachments =
|
||||
Utils.attachments_from_ids(
|
||||
%{media_ids: media_ids},
|
||||
User.get_cached_by_id(changeset.data.user_id)
|
||||
)
|
||||
|
||||
params =
|
||||
params
|
||||
|
|
|
@ -33,6 +33,7 @@ def block(blocker, blocked) do
|
|||
|
||||
def post_chat_message(%User{} = user, %User{} = recipient, content, opts \\ []) do
|
||||
with maybe_attachment <- opts[:media_id] && Object.get_by_id(opts[:media_id]),
|
||||
:ok <- validate_chat_attachment_attribution(maybe_attachment, user),
|
||||
:ok <- validate_chat_content_length(content, !!maybe_attachment),
|
||||
{_, {:ok, chat_message_data, _meta}} <-
|
||||
{:build_object,
|
||||
|
@ -71,6 +72,17 @@ defp format_chat_content(content) do
|
|||
text
|
||||
end
|
||||
|
||||
defp validate_chat_attachment_attribution(nil, _), do: :ok
|
||||
|
||||
defp validate_chat_attachment_attribution(attachment, user) do
|
||||
with :ok <- Object.authorize_access(attachment, user) do
|
||||
:ok
|
||||
else
|
||||
e ->
|
||||
e
|
||||
end
|
||||
end
|
||||
|
||||
defp validate_chat_content_length(_, true), do: :ok
|
||||
defp validate_chat_content_length(nil, false), do: {:error, :no_content}
|
||||
|
||||
|
|
|
@ -111,7 +111,7 @@ defp full_payload(%{status: status, summary: summary} = draft) do
|
|||
end
|
||||
|
||||
defp attachments(%{params: params} = draft) do
|
||||
attachments = Utils.attachments_from_ids(params)
|
||||
attachments = Utils.attachments_from_ids(params, draft.user)
|
||||
draft = %__MODULE__{draft | attachments: attachments}
|
||||
|
||||
case Utils.validate_attachments_count(attachments) do
|
||||
|
|
|
@ -23,21 +23,21 @@ defmodule Pleroma.Web.CommonAPI.Utils do
|
|||
require Logger
|
||||
require Pleroma.Constants
|
||||
|
||||
def attachments_from_ids(%{media_ids: ids, descriptions: desc}) do
|
||||
attachments_from_ids_descs(ids, desc)
|
||||
def attachments_from_ids(%{media_ids: ids, descriptions: desc}, user) do
|
||||
attachments_from_ids_descs(ids, desc, user)
|
||||
end
|
||||
|
||||
def attachments_from_ids(%{media_ids: ids}) do
|
||||
attachments_from_ids_no_descs(ids)
|
||||
def attachments_from_ids(%{media_ids: ids}, user) do
|
||||
attachments_from_ids_no_descs(ids, user)
|
||||
end
|
||||
|
||||
def attachments_from_ids(_), do: []
|
||||
def attachments_from_ids(_, _), do: []
|
||||
|
||||
def attachments_from_ids_no_descs([]), do: []
|
||||
def attachments_from_ids_no_descs([], _), do: []
|
||||
|
||||
def attachments_from_ids_no_descs(ids) do
|
||||
def attachments_from_ids_no_descs(ids, user) do
|
||||
Enum.map(ids, fn media_id ->
|
||||
case get_attachment(media_id) do
|
||||
case get_attachment(media_id, user) do
|
||||
%Object{data: data} -> data
|
||||
_ -> nil
|
||||
end
|
||||
|
@ -45,22 +45,23 @@ def attachments_from_ids_no_descs(ids) do
|
|||
|> Enum.reject(&is_nil/1)
|
||||
end
|
||||
|
||||
def attachments_from_ids_descs([], _), do: []
|
||||
def attachments_from_ids_descs([], _, _), do: []
|
||||
|
||||
def attachments_from_ids_descs(ids, descs_str) do
|
||||
def attachments_from_ids_descs(ids, descs_str, user) do
|
||||
{_, descs} = Jason.decode(descs_str)
|
||||
|
||||
Enum.map(ids, fn media_id ->
|
||||
with %Object{data: data} <- get_attachment(media_id) do
|
||||
with %Object{data: data} <- get_attachment(media_id, user) do
|
||||
Map.put(data, "name", descs[media_id])
|
||||
end
|
||||
end)
|
||||
|> Enum.reject(&is_nil/1)
|
||||
end
|
||||
|
||||
defp get_attachment(media_id) do
|
||||
defp get_attachment(media_id, user) do
|
||||
with %Object{data: data} = object <- Repo.get(Object, media_id),
|
||||
%{"type" => type} when type in Pleroma.Constants.upload_object_types() <- data do
|
||||
%{"type" => type} when type in Pleroma.Constants.upload_object_types() <- data,
|
||||
:ok <- Object.authorize_access(object, user) do
|
||||
object
|
||||
else
|
||||
_ -> nil
|
||||
|
|
|
@ -586,46 +586,61 @@ test "returns recipients when object not found" do
|
|||
end
|
||||
end
|
||||
|
||||
describe "attachments_from_ids_descs/2" do
|
||||
describe "attachments_from_ids_descs/3" do
|
||||
test "returns [] when attachment ids is empty" do
|
||||
assert Utils.attachments_from_ids_descs([], "{}") == []
|
||||
assert Utils.attachments_from_ids_descs([], "{}", nil) == []
|
||||
end
|
||||
|
||||
test "returns list attachments with desc" do
|
||||
object = insert(:attachment)
|
||||
user = insert(:user)
|
||||
object = insert(:attachment, %{user: user})
|
||||
desc = Jason.encode!(%{object.id => "test-desc"})
|
||||
|
||||
assert Utils.attachments_from_ids_descs(["#{object.id}", "34"], desc) == [
|
||||
assert Utils.attachments_from_ids_descs(["#{object.id}", "34"], desc, user) == [
|
||||
Map.merge(object.data, %{"name" => "test-desc"})
|
||||
]
|
||||
end
|
||||
end
|
||||
|
||||
describe "attachments_from_ids/1" do
|
||||
describe "attachments_from_ids/2" do
|
||||
test "returns attachments with descs" do
|
||||
object = insert(:attachment)
|
||||
user = insert(:user)
|
||||
object = insert(:attachment, %{user: user})
|
||||
desc = Jason.encode!(%{object.id => "test-desc"})
|
||||
|
||||
assert Utils.attachments_from_ids(%{
|
||||
media_ids: ["#{object.id}"],
|
||||
descriptions: desc
|
||||
}) == [
|
||||
assert Utils.attachments_from_ids(
|
||||
%{
|
||||
media_ids: ["#{object.id}"],
|
||||
descriptions: desc
|
||||
},
|
||||
user
|
||||
) == [
|
||||
Map.merge(object.data, %{"name" => "test-desc"})
|
||||
]
|
||||
end
|
||||
|
||||
test "returns attachments without descs" do
|
||||
object = insert(:attachment)
|
||||
assert Utils.attachments_from_ids(%{media_ids: ["#{object.id}"]}) == [object.data]
|
||||
user = insert(:user)
|
||||
object = insert(:attachment, %{user: user})
|
||||
assert Utils.attachments_from_ids(%{media_ids: ["#{object.id}"]}, user) == [object.data]
|
||||
end
|
||||
|
||||
test "returns [] when not pass media_ids" do
|
||||
assert Utils.attachments_from_ids(%{}) == []
|
||||
assert Utils.attachments_from_ids(%{}, nil) == []
|
||||
end
|
||||
|
||||
test "returns [] when media_ids not belong to current user" do
|
||||
user = insert(:user)
|
||||
user2 = insert(:user)
|
||||
|
||||
object = insert(:attachment, %{user: user})
|
||||
|
||||
assert Utils.attachments_from_ids(%{media_ids: ["#{object.id}"]}, user2) == []
|
||||
end
|
||||
|
||||
test "checks that the object is of upload type" do
|
||||
object = insert(:note)
|
||||
assert Utils.attachments_from_ids(%{media_ids: ["#{object.id}"]}) == []
|
||||
assert Utils.attachments_from_ids(%{media_ids: ["#{object.id}"]}, nil) == []
|
||||
end
|
||||
end
|
||||
|
||||
|
|
|
@ -279,6 +279,24 @@ test "it reject messages via MRF" do
|
|||
assert {:reject, "[KeywordPolicy] Matches with rejected keyword"} ==
|
||||
CommonAPI.post_chat_message(author, recipient, "GNO/Linux")
|
||||
end
|
||||
|
||||
test "it reject messages with attachments not belonging to user" do
|
||||
author = insert(:user)
|
||||
not_author = insert(:user)
|
||||
recipient = author
|
||||
|
||||
attachment = insert(:attachment, %{user: not_author})
|
||||
|
||||
{:error, message} =
|
||||
CommonAPI.post_chat_message(
|
||||
author,
|
||||
recipient,
|
||||
"123",
|
||||
media_id: attachment.id
|
||||
)
|
||||
|
||||
assert message == :forbidden
|
||||
end
|
||||
end
|
||||
|
||||
describe "unblocking" do
|
||||
|
|
|
@ -48,7 +48,7 @@ test "A scheduled activity with a media attachment" do
|
|||
id: to_string(scheduled_activity.id),
|
||||
media_attachments:
|
||||
%{media_ids: [upload.id]}
|
||||
|> Utils.attachments_from_ids()
|
||||
|> Utils.attachments_from_ids(user)
|
||||
|> Enum.map(&StatusView.render("attachment.json", %{attachment: &1})),
|
||||
params: %{
|
||||
in_reply_to_id: to_string(activity.id),
|
||||
|
|
|
@ -24,7 +24,7 @@ test "it displays a chat message" do
|
|||
filename: "an_image.jpg"
|
||||
}
|
||||
|
||||
{:ok, upload} = ActivityPub.upload(file, actor: user.ap_id)
|
||||
{:ok, upload} = ActivityPub.upload(file, actor: recipient.ap_id)
|
||||
|
||||
{:ok, activity} =
|
||||
CommonAPI.post_chat_message(user, recipient, "kippis :firefox:", idempotency_key: "123")
|
||||
|
|
Loading…
Reference in New Issue