oscar-surf/misskey
oscar-surf/misskey
0
0
Fork 0
Code Issues Pull Requests Packages Releases 2 Activity

fix(backend): 一部policyがリモートユーザーに適用されない問題を修正 (MisskeyIO#693)

Browse Source
This commit is contained in:
まっちゃとーにゅ 2024-08-14 10:17:33 +09:00 committed by GitHub
parent cd2c14d205
commit 1c58ea0253
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
packages/backend/src/core/NoteCreateService.ts
View File

@ -253,6 +253,11 @@ export class NoteCreateService implements OnApplicationShutdown {
const meta = await this.metaService.fetch();
const policies = await this.roleService.getUserPolicies(user.id);
if (!policies.canCreateContent) {
this.logger.error('Request rejected because user has no permission to create content', { user: user.id, note: data });
throw new IdentifiableError('5b1c2b67-50a6-4a8a-a59c-0ede40890de3', 'User has no permission to create content.');
}
if (data.visibility === 'public' && data.channel == null) {
const sensitiveWords = meta.sensitiveWords;
if (this.utilityService.isKeyWordIncluded(data.cw ?? this.utilityService.concatNoteContentsForKeyWordCheck({ text: data.text, pollChoices: data.poll?.choices }), sensitiveWords)) {

5
packages/backend/src/core/ReactionService.ts
View File

@ -116,8 +116,13 @@ export class ReactionService {
if (!await this.noteEntityService.isVisibleForMe(note, user.id)) {
throw new IdentifiableError('68e9d2d1-48bf-42c2-b90a-b20e09fd3d48', 'Note not accessible for you.');
}
const policies = await this.roleService.getUserPolicies(user.id);
if (!policies.canUpdateContent) {
throw new IdentifiableError('cf63c2de-0df1-4db5-9fff-b2110b6e5450', 'User has no permission to update content.');
}
let reaction = _reaction ?? FALLBACK;
if (note.reactionAcceptance === 'likeOnly' || !policies.canUseReaction || ((note.reactionAcceptance === 'likeOnlyForRemote' || note.reactionAcceptance === 'nonSensitiveOnlyForLocalLikeOnlyForRemote') && (user.host != null))) {
reaction = '\u2764';