rDrama
/
rDrama
9
10
Fork 7
Code Issues Pull Requests Packages Releases Wiki Activity

security: don't leak post contents to embeds and other stuff for removed/deleted posts

remotes/1693176582716663532/tmp_refs/heads/watchparty
justcool393 2022-10-04 16:48:01 -07:00 committed by GitHub
parent 775686028b
commit 31725a0684
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
files/classes/submission.py
View File

@ -334,6 +334,8 @@ class Submission(Base):
@lazy
def realbody(self, v, listing=False):
if self.club and not (v and (v.paid_dues or v.id == self.author_id)): return f"<p>{CC} ONLY</p>"
if self.deleted_utc != 0 and not (v and (v.admin_level >= 2) or v.id == self.author.id): return "[Deleted by user]"
if self.is_banned and not (v and v.admin_level >= 2): return "[Removed by admins]";
body = self.body_html or ""
@ -401,6 +403,8 @@ class Submission(Base):
@lazy
def plainbody(self, v):
if self.deleted_utc != 0 and not (v and (v.admin_level >= 2) or v.id == self.author.id): return "[Deleted by user]"
if self.is_banned and not (v and v.admin_level >= 2): return "[Removed by admins]"
if self.club and not (v and (v.paid_dues or v.id == self.author_id)): return f"<p>{CC} ONLY</p>"
body = self.body