From 3455871f40c36818bc6ea5192cc7021b4e363e4d Mon Sep 17 00:00:00 2001 From: Hypolite Petovan Date: Wed, 11 May 2022 09:00:19 -0400 Subject: [PATCH 1/2] [advancedcontentfilter] Use a random item to validate fields on rule save - Remove hard-coded list of allowed fields --- .../advancedcontentfilter.php | 77 ++++++++++--------- 1 file changed, 42 insertions(+), 35 deletions(-) diff --git a/advancedcontentfilter/advancedcontentfilter.php b/advancedcontentfilter/advancedcontentfilter.php index 3fe6884ea..fecf9563b 100644 --- a/advancedcontentfilter/advancedcontentfilter.php +++ b/advancedcontentfilter/advancedcontentfilter.php @@ -91,6 +91,10 @@ function advancedcontentfilter_dbstructure_definition(App $a, &$database) ]; } +/** + * @param array $item Prepared by either Model\Item::prepareBody or advancedcontentfilter_prepare_item_row + * @return array + */ function advancedcontentfilter_get_filter_fields(array $item) { $vars = []; @@ -262,30 +266,20 @@ function advancedcontentfilter_build_fields($data) } if (!empty($data['expression'])) { - $allowed_keys = [ - 'author_id', 'author_link', 'author_name', 'author_avatar', - 'owner_id', 'owner_link', 'owner_name', 'owner_avatar', - 'contact_id', 'uid', 'id', 'parent', 'uri', - 'thr_parent', 'parent_uri', - 'content_warning', - 'commented', 'created', 'edited', 'received', - 'verb', 'object_type', 'postopts', 'plink', 'guid', 'wall', 'private', 'starred', - 'title', 'body', - 'file', 'event_id', 'location', 'coord', 'app', 'attach', - 'rendered_hash', 'rendered_html', 'object', - 'allow_cid', 'allow_gid', 'deny_cid', 'deny_gid', - 'item_id', 'item_network', 'author_thumb', 'owner_thumb', - 'network', 'url', 'name', 'writable', 'self', - 'cid', 'alias', - 'event_created', 'event_edited', 'event_start', 'event_finish', 'event_summary', - 'event_desc', 'event_location', 'event_type', 'event_nofinish', 'event_ignore', - 'children', 'pagedrop', 'tags', 'hashtags', 'mentions', - 'attachments', - ]; + // Using a dummy item to validate the field existence + $condition = ["(`uid` = ? OR `uid` = 0)", local_user()]; + $params = ['order' => ['uid' => true]]; + $item_row = Post::selectFirstForUser(local_user(), [], $condition, $params); + + if (!DBA::isResult($item_row)) { + throw new HTTPException\NotFoundException(DI::l10n()->t('This addon requires this node having at least one post')); + } $expressionLanguage = new ExpressionLanguage\ExpressionLanguage(); - - $parsedExpression = $expressionLanguage->parse($data['expression'], $allowed_keys); + $parsedExpression = $expressionLanguage->parse( + $data['expression'], + array_keys(advancedcontentfilter_get_filter_fields(advancedcontentfilter_prepare_item_row($item_row))) + ); $serialized = serialize($parsedExpression->getNodes()); @@ -430,23 +424,36 @@ function advancedcontentfilter_get_variables_guid(ServerRequestInterface $reques $condition = ["`guid` = ? AND (`uid` = ? OR `uid` = 0)", $args['guid'], local_user()]; $params = ['order' => ['uid' => true]]; - $item = Post::selectFirstForUser(local_user(), [], $condition, $params); + $item_row = Post::selectFirstForUser(local_user(), [], $condition, $params); - if (!DBA::isResult($item)) { + if (!DBA::isResult($item_row)) { throw new HTTPException\NotFoundException(DI::l10n()->t('Unknown post with guid: %s', $args['guid'])); } - $tags = Tag::populateFromItem($item); - - $item['tags'] = $tags['tags']; - $item['hashtags'] = $tags['hashtags']; - $item['mentions'] = $tags['mentions']; - - $attachments = Post\Media::splitAttachments($item['uri-id'], $item['guid'] ?? ''); - - $item['attachments'] = $attachments; - - $return = advancedcontentfilter_get_filter_fields($item); + $return = advancedcontentfilter_get_filter_fields(advancedcontentfilter_prepare_item_row($item_row)); return json_encode(['variables' => str_replace('\\\'', '\'', var_export($return, true))]); } + +/** + * This mimimcs the processing performed in Model\Item::prepareBody + * + * @param array $item_row + * @return array + * @throws HTTPException\InternalServerErrorException + * @throws ImagickException + */ +function advancedcontentfilter_prepare_item_row(array $item_row): array +{ + $tags = Tag::populateFromItem($item_row); + + $item_row['tags'] = $tags['tags']; + $item_row['hashtags'] = $tags['hashtags']; + $item_row['mentions'] = $tags['mentions']; + + $attachments = Post\Media::splitAttachments($item_row['uri-id'], $item_row['guid'] ?? ''); + + $item_row['attachments'] = $attachments; + + return $item_row; +} From 444330d91f530a3d5635496ac73e8c327e1137cd Mon Sep 17 00:00:00 2001 From: Hypolite Petovan Date: Wed, 11 May 2022 09:00:41 -0400 Subject: [PATCH 2/2] [advancedcontentfilter] Update main translation file after string was added --- advancedcontentfilter/lang/C/messages.po | 30 ++++++++++++++---------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/advancedcontentfilter/lang/C/messages.po b/advancedcontentfilter/lang/C/messages.po index 742647b96..68b42ed30 100644 --- a/advancedcontentfilter/lang/C/messages.po +++ b/advancedcontentfilter/lang/C/messages.po @@ -8,7 +8,7 @@ msgid "" msgstr "" "Project-Id-Version: \n" "Report-Msgid-Bugs-To: \n" -"POT-Creation-Date: 2021-11-21 19:13-0500\n" +"POT-Creation-Date: 2022-05-11 08:54-0400\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" @@ -112,42 +112,46 @@ msgstr "" msgid "Cancel" msgstr "" -#: advancedcontentfilter.php:312 advancedcontentfilter.php:323 -#: advancedcontentfilter.php:334 advancedcontentfilter.php:370 -#: advancedcontentfilter.php:401 advancedcontentfilter.php:424 +#: advancedcontentfilter.php:295 +msgid "This addon requires this node having at least one post" +msgstr "" + +#: advancedcontentfilter.php:325 advancedcontentfilter.php:336 +#: advancedcontentfilter.php:347 advancedcontentfilter.php:383 +#: advancedcontentfilter.php:414 advancedcontentfilter.php:437 msgid "You must be logged in to use this method" msgstr "" -#: advancedcontentfilter.php:338 advancedcontentfilter.php:374 -#: advancedcontentfilter.php:405 +#: advancedcontentfilter.php:351 advancedcontentfilter.php:387 +#: advancedcontentfilter.php:418 msgid "Invalid form security token, please refresh the page." msgstr "" -#: advancedcontentfilter.php:350 +#: advancedcontentfilter.php:363 msgid "The rule name and expression are required." msgstr "" -#: advancedcontentfilter.php:364 +#: advancedcontentfilter.php:377 msgid "Rule successfully added" msgstr "" -#: advancedcontentfilter.php:378 advancedcontentfilter.php:409 +#: advancedcontentfilter.php:391 advancedcontentfilter.php:422 msgid "Rule doesn't exist or doesn't belong to you." msgstr "" -#: advancedcontentfilter.php:395 +#: advancedcontentfilter.php:408 msgid "Rule successfully updated" msgstr "" -#: advancedcontentfilter.php:418 +#: advancedcontentfilter.php:431 msgid "Rule successfully deleted" msgstr "" -#: advancedcontentfilter.php:428 +#: advancedcontentfilter.php:441 msgid "Missing argument: guid." msgstr "" -#: advancedcontentfilter.php:436 +#: advancedcontentfilter.php:449 #, php-format msgid "Unknown post with guid: %s" msgstr ""