FediMovies/fedimovies
1
1
Fork 0
Code Issues 3 Pull requests Projects Releases Packages Activity

Verify owner of attachments when creating post

Browse source
This commit is contained in:
silverpill 2021-09-25 21:51:28 +00:00
parent 283c426c49
commit 7fbd889946
1 changed files with 11 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
src/models/posts/queries.rs
View file

@ -99,19 +99,21 @@ pub async fn create_post(
).await?; ).await?;
let db_post: DbPost = post_row.try_get("post")?; let db_post: DbPost = post_row.try_get("post")?;
// Create links to attachments // Create links to attachments
let attachment_rows = transaction.query( let attachments_rows = transaction.query(
" "
UPDATE media_attachment UPDATE media_attachment
SET post_id = $1 SET post_id = $1
WHERE id = ANY($2) WHERE owner_id = $2 AND id = ANY($3)
RETURNING media_attachment RETURNING media_attachment
", ",
&[&post_id, &data.attachments], &[&post_id, &author_id, &data.attachments],
).await?; ).await?;
let db_attachments: Vec<DbMediaAttachment> = attachment_rows.iter() if attachments_rows.len() != data.attachments.len() {
.map(|row| -> Result<DbMediaAttachment, tokio_postgres::Error> { // Some attachments were not found
row.try_get("media_attachment") return Err(DatabaseError::NotFound("attachment"));
}) }
let db_attachments: Vec<DbMediaAttachment> = attachments_rows.iter()
.map(|row| row.try_get("media_attachment"))
.collect::<Result<_, _>>()?; .collect::<Result<_, _>>()?;
// Update counters // Update counters
let author = update_post_count(&transaction, &db_post.author_id, 1).await?; let author = update_post_count(&transaction, &db_post.author_id, 1).await?;
@ -297,14 +299,14 @@ pub async fn delete_post(
) -> Result<Vec<String>, DatabaseError> { ) -> Result<Vec<String>, DatabaseError> {
let transaction = db_client.transaction().await?; let transaction = db_client.transaction().await?;
// Get list of attached files // Get list of attached files
let attachment_rows = transaction.query( let files_rows = transaction.query(
" "
SELECT file_name SELECT file_name
FROM media_attachment WHERE post_id = $1 FROM media_attachment WHERE post_id = $1
", ",
&[&post_id], &[&post_id],
).await?; ).await?;
let files: Vec<String> = attachment_rows.iter() let files: Vec<String> = files_rows.iter()
.map(|row| row.try_get("file_name")) .map(|row| row.try_get("file_name"))
.collect::<Result<_, _>>()?; .collect::<Result<_, _>>()?;
// Delete post // Delete post