notfire/Iceshrimp.NET
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[backend/api] Prevent moderation actions on the authenticated user

Browse source
This commit is contained in:
Laura Hausmann 2024-10-11 19:38:30 +02:00
parent 5005d81ee7
commit 0496df2c9e
No known key found for this signature in database
GPG key ID: D044E84C5BE01605
1 changed files with 13 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
Iceshrimp.Backend/Controllers/Web/ModerationController.cs
View file

@ -34,9 +34,12 @@ public class ModerationController(DatabaseContext db, NoteService noteSvc, UserS
var user = await db.Users.IncludeCommonProperties().FirstOrDefaultAsync(p => p.Id == id && !p.IsSystemUser) ??
throw GracefulException.NotFound("User not found");
if (user == HttpContext.GetUserOrFail())
throw GracefulException.BadRequest("You cannot suspend yourself.");
await userSvc.SuspendUserAsync(user);
}
[HttpPost("users/{id}/unsuspend")]
[ProducesResults(HttpStatusCode.OK)]
[ProducesErrors(HttpStatusCode.NotFound)]
@ -44,10 +47,13 @@ public class ModerationController(DatabaseContext db, NoteService noteSvc, UserS
{
var user = await db.Users.IncludeCommonProperties().FirstOrDefaultAsync(p => p.Id == id && !p.IsSystemUser) ??
throw GracefulException.NotFound("User not found");
if (user == HttpContext.GetUserOrFail())
throw GracefulException.BadRequest("You cannot unsuspend yourself.");
await userSvc.UnsuspendUserAsync(user);
}
[HttpPost("users/{id}/delete")]
[ProducesResults(HttpStatusCode.OK)]
[ProducesErrors(HttpStatusCode.NotFound)]
@ -56,9 +62,12 @@ public class ModerationController(DatabaseContext db, NoteService noteSvc, UserS
var user = await db.Users.IncludeCommonProperties().FirstOrDefaultAsync(p => p.Id == id && !p.IsSystemUser) ??
throw GracefulException.NotFound("User not found");
if (user == HttpContext.GetUserOrFail())
throw GracefulException.BadRequest("You cannot delete yourself.");
await userSvc.DeleteUserAsync(user);
}
[HttpPost("users/{id}/purge")]
[ProducesResults(HttpStatusCode.OK)]
[ProducesErrors(HttpStatusCode.NotFound)]