From 29037b49952dd95a08639b27b08c8a8e68a13026 Mon Sep 17 00:00:00 2001 From: ryexandra <68085235+ryexandra@users.noreply.github.com> Date: Tue, 14 Jul 2020 07:17:25 -0600 Subject: Security/fix permission bugs (#966) * secure the `EditPost` API endpoint * Check user is moderator in BanFromCommunity * secure the `EditComment` API endpoint * pass orig `read` prob when not explicitly updating it. * Block random users from adding mods. * use cleaner logic from `EditPost` * prevent editing a community by a mod from transfering ownership to them * secure `read` action in `EditPrivateMessage` * Add check in UserMention * only let the indended recipient mark as read * simplify booleans to satisfy clippy * requested changes + cargo +nightly fmt * fix to pass federation tests for deleting comments and posts Co-authored-by: chiminh Co-authored-by: Hex Bear --- server/src/apub/mod.rs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'server/src/apub/mod.rs') diff --git a/server/src/apub/mod.rs b/server/src/apub/mod.rs index 499f0352..cfb539fb 100644 --- a/server/src/apub/mod.rs +++ b/server/src/apub/mod.rs @@ -19,7 +19,8 @@ use crate::{ blocking, request::{retry, RecvError}, routes::webfinger::WebFingerResponse, - DbPool, LemmyError, + DbPool, + LemmyError, }; use activitystreams::object::Page; use activitystreams_ext::{Ext1, Ext2}; -- cgit v1.2.3