skorotkiewicz/rDrama
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix bug that could put comments in wrong submissions

Browse source 
this could let users bypass exiles or other checks

see also: Aevann1/rDrama@d61eda8
This commit is contained in:
justcool393 2022-10-30 18:17:35 -07:00 • committed by GitHub
parent 08a98429e0
commit 0d4662588e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 17 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

32
files/routes/comments.py
View file

@ -152,25 +152,27 @@ def post_pid_comment_cid(cid, pid=None, anything=None, v=None, sub=None):
def api_comment(v): def api_comment(v):
if v.is_suspended: return {"error": "You can't perform this action while banned."}, 403 if v.is_suspended: return {"error": "You can't perform this action while banned."}, 403
parent_submission = request.values.get("submission").strip()
parent_fullname = request.values.get("parent_fullname").strip() parent_fullname = request.values.get("parent_fullname").strip()
parent_level = int(request.values.get("parent_level").strip())
parent_post = get_post(parent_submission, v=v) if len(parent_fullname) < 3: abort(400)
sub = parent_post.sub id = parent_fullname[2:]
if sub and v.exiled_from(sub): return {"error": f"You're exiled from /h/{sub}"}, 403 parent = None
parent_post = None
if parent_post.club and not (v and (v.paid_dues or v.id == parent_post.author_id)): abort(403) parent_comment_id = None
sub = None
if parent_fullname.startswith("t2_"): if parent_fullname.startswith("t2_"):
parent = parent_post parent = get_post(id, v=v)
parent_comment_id = None parent_post = parent
level = 1
elif parent_fullname.startswith("t3_"): elif parent_fullname.startswith("t3_"):
parent = get_comment(parent_fullname.split("_")[1], v=v) parent = get_comment(id, v=v)
parent_post = get_post(parent.parent_submission, v=v) if parent.parent_submission else None
parent_comment_id = parent.id parent_comment_id = parent.id
level = parent.level + 1
else: abort(400) else: abort(400)
if not parent_post: abort(404) # don't allow sending comments to the ether
level = 1 if isinstance(parent, Submission) else parent.level + 1
sub = parent_post.sub
if sub and v.exiled_from(sub): return {"error": f"You're exiled from /h/{sub}"}, 403
body = request.values.get("body", "").strip()[:10000] body = request.values.get("body", "").strip()[:10000]
@ -245,7 +247,7 @@ def api_comment(v):
existing = g.db.query(Comment.id).filter(Comment.author_id == v.id, existing = g.db.query(Comment.id).filter(Comment.author_id == v.id,
Comment.deleted_utc == 0, Comment.deleted_utc == 0,
Comment.parent_comment_id == parent_comment_id, Comment.parent_comment_id == parent_comment_id,
Comment.parent_submission == parent_submission, Comment.parent_submission == parent_post.id,
Comment.body_html == body_html Comment.body_html == body_html
).one_or_none() ).one_or_none()
if existing: return {"error": f"You already made that comment: /comment/{existing.id}"}, 409 if existing: return {"error": f"You already made that comment: /comment/{existing.id}"}, 409
@ -298,7 +300,7 @@ def api_comment(v):
is_filtered = v.should_comments_be_filtered() is_filtered = v.should_comments_be_filtered()
c = Comment(author_id=v.id, c = Comment(author_id=v.id,
parent_submission=parent_submission, parent_submission=parent_post.id,
parent_comment_id=parent_comment_id, parent_comment_id=parent_comment_id,
level=level, level=level,
over_18=parent_post.over_18 or request.values.get("over_18")=="true", over_18=parent_post.over_18 or request.values.get("over_18")=="true",
@ -344,7 +346,7 @@ def api_comment(v):
g.db.commit() g.db.commit()
if request.headers.get("Authorization"): return c.json if request.headers.get("Authorization"): return c.json
return {"comment": render_template("comments.html", v=v, comments=[c], ajax=True, parent_level=parent_level)} return {"comment": render_template("comments.html", v=v, comments=[c], ajax=True, parent_level=level)}
def comment_on_publish(comment): def comment_on_publish(comment):