forked from rDrama/rDrama
security: don't leak comment contents for removed/deleted comments
parent
31725a0684
commit
93fb4f40d6
|
@ -330,6 +330,8 @@ class Comment(Base):
|
||||||
def realbody(self, v):
|
def realbody(self, v):
|
||||||
if self.post and self.post.club and not (v and (v.paid_dues or v.id in [self.author_id, self.post.author_id] or (self.parent_comment and v.id == self.parent_comment.author_id))):
|
if self.post and self.post.club and not (v and (v.paid_dues or v.id in [self.author_id, self.post.author_id] or (self.parent_comment and v.id == self.parent_comment.author_id))):
|
||||||
return f"<p>{CC} ONLY</p>"
|
return f"<p>{CC} ONLY</p>"
|
||||||
|
if self.deleted_utc != 0 and not (v and (v.admin_level >= 2) or v.id == self.author.id): return "[Deleted by user]"
|
||||||
|
if self.is_banned and not (v and v.admin_level >= 2): return "[Removed by admins]";
|
||||||
|
|
||||||
body = self.body_html or ""
|
body = self.body_html or ""
|
||||||
|
|
||||||
|
@ -395,6 +397,8 @@ class Comment(Base):
|
||||||
def plainbody(self, v):
|
def plainbody(self, v):
|
||||||
if self.post and self.post.club and not (v and (v.paid_dues or v.id in [self.author_id, self.post.author_id] or (self.parent_comment and v.id == self.parent_comment.author_id))):
|
if self.post and self.post.club and not (v and (v.paid_dues or v.id in [self.author_id, self.post.author_id] or (self.parent_comment and v.id == self.parent_comment.author_id))):
|
||||||
return f"{CC} ONLY"
|
return f"{CC} ONLY"
|
||||||
|
if self.deleted_utc != 0 and not (v and (v.admin_level >= 2) or v.id == self.author.id): return "[Deleted by user]"
|
||||||
|
if self.is_banned and not (v and v.admin_level >= 2): return "[Removed by admins]";
|
||||||
|
|
||||||
body = self.body
|
body = self.body
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue