From 29037b49952dd95a08639b27b08c8a8e68a13026 Mon Sep 17 00:00:00 2001 From: ryexandra <68085235+ryexandra@users.noreply.github.com> Date: Tue, 14 Jul 2020 07:17:25 -0600 Subject: Security/fix permission bugs (#966) * secure the `EditPost` API endpoint * Check user is moderator in BanFromCommunity * secure the `EditComment` API endpoint * pass orig `read` prob when not explicitly updating it. * Block random users from adding mods. * use cleaner logic from `EditPost` * prevent editing a community by a mod from transfering ownership to them * secure `read` action in `EditPrivateMessage` * Add check in UserMention * only let the indended recipient mark as read * simplify booleans to satisfy clippy * requested changes + cargo +nightly fmt * fix to pass federation tests for deleting comments and posts Co-authored-by: chiminh Co-authored-by: Hex Bear --- server/lemmy_utils/src/settings.rs | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'server/lemmy_utils') diff --git a/server/lemmy_utils/src/settings.rs b/server/lemmy_utils/src/settings.rs index 0607974f..097063b6 100644 --- a/server/lemmy_utils/src/settings.rs +++ b/server/lemmy_utils/src/settings.rs @@ -1,7 +1,6 @@ use config::{Config, ConfigError, Environment, File}; use serde::Deserialize; -use std::{fs, io::Error, net::IpAddr, sync::RwLock}; -use std::env; +use std::{env, fs, io::Error, net::IpAddr, sync::RwLock}; static CONFIG_FILE_DEFAULTS: &str = "config/defaults.hjson"; static CONFIG_FILE: &str = "config/config.hjson"; -- cgit v1.2.3