security: fix mute bypass

modmail: constantify user ID
pull/20/head
justcool393 2022-11-17 16:50:06 -06:00
parent 12881388d6
commit 255d5b2453
8 changed files with 21 additions and 20 deletions

View File

@ -584,7 +584,7 @@ class User(Base):
Notification.user_id == self.id,
Comment.is_banned == False,
Comment.deleted_utc == 0,
not_(and_(Comment.sentto == 2, User.is_muted)),
not_(and_(Comment.sentto == MODMAIL_ID, User.is_muted)),
))
if not self.can_see_shadowbanned:
@ -980,7 +980,7 @@ class User(Base):
if not other.parent_submission:
if not user: return False
if not other.sentto: return True # handled by Notification
if other.sentto == 2: return user.admin_level >= PERMS['VIEW_MODMAIL'] # type: ignore
if other.sentto == MODMAIL_ID: return user.admin_level >= PERMS['VIEW_MODMAIL'] # type: ignore
if other.sentto != user.id: return user.admin_level >= PERMS['POST_COMMENT_MODERATION'] # type: ignore
if other.parent_submission and other.post.sub and not cls.can_see(user, other.post.subr): return False
# if other.parent_submission and not cls.can_see(user, other.post): return False

View File

@ -429,6 +429,7 @@ MOM_ID = 0
DONGER_ID = 0
GEESE_ID = 0
BLACKJACKBTZ_ID = 0
MODMAIL_ID = 2
POLL_THREAD = 0
POLL_BET_COINS = 200

View File

@ -44,7 +44,7 @@ def timestamp(timestamp):
@app.context_processor
def inject_constants():
return {"environ":environ, "SITE":SITE, "SITE_NAME":SITE_NAME, "SITE_FULL":SITE_FULL,
"AUTOJANNY_ID":AUTOJANNY_ID, "PUSHER_ID":PUSHER_ID,
"AUTOJANNY_ID":AUTOJANNY_ID, "MODMAIL_ID":MODMAIL_ID, "PUSHER_ID":PUSHER_ID,
"CC":CC, "CC_TITLE":CC_TITLE, "listdir":listdir, "os_path":path, "AEVANN_ID":AEVANN_ID,
"PIZZASHILL_ID":PIZZASHILL_ID, "DEFAULT_COLOR":DEFAULT_COLOR,
"COLORS":COLORS, "time":time, "PERMS":PERMS, "FEATURES":FEATURES,

View File

@ -272,8 +272,8 @@ def notifications(v):
Comment.is_banned == False,
Comment.deleted_utc == 0,
Comment.body_html.notlike('%<p>New site mention%<a href="https://old.reddit.com/r/%'),
or_(Comment.sentto == None, Comment.sentto == 2),
not_(and_(Comment.sentto == 2, User.is_muted)),
or_(Comment.sentto == None, Comment.sentto == MODMAIL_ID),
not_(and_(Comment.sentto == MODMAIL_ID, User.is_muted)),
)
if v.admin_level < PERMS['USER_SHADOWBAN']:

View File

@ -52,7 +52,6 @@ def rescind(v, aid):
@is_not_permabanned
@ratelimit_user()
def request_api_keys(v):
new_app = OauthApp(
app_name=request.values.get('name').replace('<','').replace('>',''),
redirect_uri=request.values.get('redirect_uri'),
@ -63,15 +62,13 @@ def request_api_keys(v):
g.db.add(new_app)
body = f"@{v.username} has requested API keys for `{request.values.get('name')}`. You can approve or deny the request [here](/admin/apps)."
body_html = sanitize(body)
new_comment = Comment(author_id=AUTOJANNY_ID,
parent_submission=None,
level=1,
body_html=body_html,
sentto=2,
sentto=MODMAIL_ID,
distinguish_level=6,
is_bot=True
)

View File

@ -228,7 +228,7 @@ def submit_contact(v):
parent_submission=None,
level=1,
body_html=body_html,
sentto=2
sentto=MODMAIL_ID
)
g.db.add(new_comment)
g.db.flush()

View File

@ -421,6 +421,9 @@ def unsubscribe(v, post_id):
def message2(v, username):
user = get_user(username, v=v, include_blocks=True, include_shadowbanned=False)
if user.id == MODMAIL_ID:
abort(403, "Please use /contact to contact the admins")
if hasattr(user, 'is_blocking') and user.is_blocking:
abort(403, f"You're blocking @{user.username}")
@ -493,12 +496,12 @@ def messagereply(v):
parent = get_comment(id, v=v)
user_id = parent.author.id
if v.is_suspended_permanently and parent.sentto != 2:
abort(400, "You are permabanned and may not reply to messages.")
elif v.is_muted and parent.sentto == 2:
abort(400, "You are forbidden from replying to modmail.")
if v.is_suspended_permanently and parent.sentto != MODMAIL_ID:
abort(403, "You are permabanned and may not reply to messages.")
elif v.is_muted and parent.sentto == MODMAIL_ID:
abort(403, "You are forbidden from replying to modmail.")
if parent.sentto == 2: user_id = None
if parent.sentto == MODMAIL_ID: user_id = None
elif v.id == user_id: user_id = parent.sentto
if user_id:
@ -509,7 +512,7 @@ def messagereply(v):
and hasattr(user, 'is_blocked') and user.is_blocked):
abort(403, f"You're blocked by @{user.username}")
if parent.sentto == 2:
if parent.sentto == MODMAIL_ID:
body += process_files(request.files, v)
body = body.strip()
@ -548,7 +551,7 @@ def messagereply(v):
top_comment = c.top_comment(g.db)
if top_comment.sentto == 2:
if top_comment.sentto == MODMAIL_ID:
admins = g.db.query(User.id).filter(User.admin_level >= PERMS['NOTIFICATIONS_MODMAIL'], User.id != v.id)
if SITE == 'watchpeopledie.tv':
admins = admins.filter(User.id != AEVANN_ID)

View File

@ -93,7 +93,7 @@
{% elif c.author_id==AUTOJANNY_ID %}
<span class="font-weight-bold">Notification</span>
{% else %}
{% if c.sentto == 2 %}
{% if c.sentto == MODMAIL_ID %}
<span class="font-weight-bold">Sent to admins</span>
{% else %}
<span class="font-weight-bold">Sent to @{{c.senttouser.username}}</span>
@ -566,7 +566,7 @@
</div>
{% if request.path.startswith('/notifications') and c.level == 1 and c.sentto and not c.parent_submission and c.author_id != AUTOJANNY_ID %}
{% if (v and v.admin_level >= PERMS['USER_BAN']) and (c.sentto == 2) %}
{% if (v and v.admin_level >= PERMS['USER_BAN']) and (c.sentto == MODMAIL_ID) %}
<button type="button" class="btn btn-danger mr-3 {% if c.author.is_muted %}d-none{% endif %}" id="mute-user-{{c.id}}" onclick="postToastSwitch(this,'/mute_user/{{c.author.id}}','mute-user-{{c.id}}','unmute-user-{{c.id}}','d-none')">Mute</button>
<button type="button" class="btn btn-primary mr-3 {% if not c.author.is_muted %}d-none{% endif %}" id="unmute-user-{{c.id}}" onclick="postToastSwitch(this,'/unmute_user/{{c.author.id}}','mute-user-{{c.id}}','unmute-user-{{c.id}}','d-none')">Unmute</button>
{% endif %}
@ -581,7 +581,7 @@
<div class="comment-format" id="comment-format-bar-{{c.id}}">
<div onclick="loadEmojis('reply-form-body-{{c.id}}')" class="btn btn-secondary m-0 mt-3 mr-1" aria-hidden="true" data-bs-toggle="modal" data-bs-target="#emojiModal" data-bs-toggle="tooltip" data-bs-placement="bottom" title="Add Emoji"><i class="fas fa-smile-beam"></i></div>
{% if c.sentto == 2 %}
{% if c.sentto == MODMAIL_ID %}
<label class="btn btn-secondary m-0 mt-3" for="file-upload">
<div id="filename"><i class="fas fa-file"></i></div>
<input autocomplete="off" id="file-upload" accept="image/*, video/*, audio/*" type="file" name="file" multiple="multiple" {% if g.is_tor %}disabled{% endif %} onchange="changename('filename','file-upload')" hidden>