specter/mastodon
1
0
Fork 0
forked from fedi/mastodon
Code Pull requests Activity

Change REST API to return empty data for suspended accounts (#14765)

Browse source
This commit is contained in:
Eugen Rochko 2020-09-11 15:16:29 +02:00 committed by GitHub
parent e6d67f85e2
commit e6b272e5c9
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
22 changed files with 79 additions and 30 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
app/controllers/activitypub/outboxes_controller.rb
View file

@ -57,9 +57,8 @@ class ActivityPub::OutboxesController < ActivityPub::BaseController
def set_statuses
return unless page_requested?
@statuses = @account.statuses.permitted_for(@account, signed_request_account)
@statuses = cache_collection_paginated_by_id(
@statuses,
@account.statuses.permitted_for(@account, signed_request_account),
Status,
LIMIT,
params_slice(:max_id, :min_id, :since_id)

2
app/controllers/api/v1/accounts/featured_tags_controller.rb
View file

@ -17,6 +17,6 @@ class Api::V1::Accounts::FeaturedTagsController < Api::BaseController
end
def set_featured_tags
@featured_tags = @account.featured_tags
@featured_tags = @account.suspended? ? @account.featured_tags : []
end
end

2
app/controllers/api/v1/accounts/follower_accounts_controller.rb
View file

@ -25,7 +25,7 @@ class Api::V1::Accounts::FollowerAccountsController < Api::BaseController
end
def hide_results?
(@account.hides_followers? && current_account&.id != @account.id) || (current_account && @account.blocking?(current_account))
@account.suspended? || (@account.hides_followers? && current_account&.id != @account.id) || (current_account && @account.blocking?(current_account))
end
def default_accounts

2
app/controllers/api/v1/accounts/following_accounts_controller.rb
View file

@ -25,7 +25,7 @@ class Api::V1::Accounts::FollowingAccountsController < Api::BaseController
end
def hide_results?
(@account.hides_following? && current_account&.id != @account.id) || (current_account && @account.blocking?(current_account))
@account.suspended? || (@account.hides_following? && current_account&.id != @account.id) || (current_account && @account.blocking?(current_account))
end
def default_accounts

2
app/controllers/api/v1/accounts/identity_proofs_controller.rb
View file

@ -5,7 +5,7 @@ class Api::V1::Accounts::IdentityProofsController < Api::BaseController
before_action :set_account
def index
@proofs = @account.identity_proofs.active
@proofs = @account.suspended? ? [] : @account.identity_proofs.active
render json: @proofs, each_serializer: REST::IdentityProofSerializer
end

2
app/controllers/api/v1/accounts/lists_controller.rb
View file

@ -6,7 +6,7 @@ class Api::V1::Accounts::ListsController < Api::BaseController
before_action :set_account
def index
@lists = @account.lists.where(account: current_account)
@lists = @account.suspended? ? [] : @account.lists.where(account: current_account)
render json: @lists, each_serializer: REST::ListSerializer
end

2
app/controllers/api/v1/accounts/relationships_controller.rb
View file

@ -5,7 +5,7 @@ class Api::V1::Accounts::RelationshipsController < Api::BaseController
before_action :require_user!
def index
accounts = Account.where(id: account_ids).select('id')
accounts = Account.without_suspended.where(id: account_ids).select('id')
# .where doesn't guarantee that our results are in the same order
# we requested them, so return the "right" order to the requestor.
@accounts = accounts.index_by(&:id).values_at(*account_ids).compact

2
app/controllers/api/v1/accounts/statuses_controller.rb
View file

@ -18,7 +18,7 @@ class Api::V1::Accounts::StatusesController < Api::BaseController
end
def load_statuses
cached_account_statuses
@account.suspended? ? [] : cached_account_statuses
end
def cached_account_statuses

5
app/controllers/api/v1/accounts_controller.rb
View file

@ -9,7 +9,6 @@ class Api::V1::AccountsController < Api::BaseController
before_action :require_user!, except: [:show, :create]
before_action :set_account, except: [:create]
before_action :check_account_suspension, only: [:show]
before_action :check_enabled_registrations, only: [:create]
skip_before_action :require_authenticated_user!, only: :create
@ -73,10 +72,6 @@ class Api::V1::AccountsController < Api::BaseController
AccountRelationshipsPresenter.new([@account.id], current_user.account_id, options)
end
def check_account_suspension
gone if @account.suspended?
end
def account_params
params.permit(:username, :email, :password, :agreement, :locale, :reason)
end

2
app/controllers/api/v1/blocks_controller.rb
View file

@ -18,6 +18,8 @@ class Api::V1::BlocksController < Api::BaseController
def paginated_blocks
@paginated_blocks ||= Block.eager_load(target_account: :account_stat)
.joins(:target_account)
.merge(Account.without_suspended)
.where(account: current_account)
.paginate_by_max_id(
limit_param(DEFAULT_ACCOUNTS_LIMIT),

2
app/controllers/api/v1/endorsements_controller.rb
View file

@ -25,7 +25,7 @@ class Api::V1::EndorsementsController < Api::BaseController
end
def endorsed_accounts
current_account.endorsed_accounts.includes(:account_stat)
current_account.endorsed_accounts.includes(:account_stat).without_suspended
end
def insert_pagination_headers

2
app/controllers/api/v1/follow_requests_controller.rb
View file

@ -37,7 +37,7 @@ class Api::V1::FollowRequestsController < Api::BaseController
end
def default_accounts
Account.includes(:follow_requests, :account_stat).references(:follow_requests)
Account.without_suspended.includes(:follow_requests, :account_stat).references(:follow_requests)
end
def paginated_follow_requests

4
app/controllers/api/v1/lists/accounts_controller.rb
View file

@ -37,9 +37,9 @@ class Api::V1::Lists::AccountsController < Api::BaseController
def load_accounts
if unlimited?
@list.accounts.includes(:account_stat).all
@list.accounts.without_suspended.includes(:account_stat).all
else
@list.accounts.includes(:account_stat).paginate_by_max_id(limit_param(DEFAULT_ACCOUNTS_LIMIT), params[:max_id], params[:since_id])
@list.accounts.without_suspended.includes(:account_stat).paginate_by_max_id(limit_param(DEFAULT_ACCOUNTS_LIMIT), params[:max_id], params[:since_id])
end
end

2
app/controllers/api/v1/mutes_controller.rb
View file

@ -18,6 +18,8 @@ class Api::V1::MutesController < Api::BaseController
def paginated_mutes
@paginated_mutes ||= Mute.eager_load(:target_account)
.joins(:target_account)
.merge(Account.without_suspended)
.where(account: current_account)
.paginate_by_max_id(
limit_param(DEFAULT_ACCOUNTS_LIMIT),

4
app/controllers/api/v1/notifications_controller.rb
View file

@ -14,7 +14,7 @@ class Api::V1::NotificationsController < Api::BaseController
end
def show
@notification = current_account.notifications.find(params[:id])
@notification = current_account.notifications.without_suspended.find(params[:id])
render json: @notification, serializer: REST::NotificationSerializer
end
@ -40,7 +40,7 @@ class Api::V1::NotificationsController < Api::BaseController
end
def browserable_account_notifications
current_account.notifications.browserable(exclude_types, from_account)
current_account.notifications.without_suspended.browserable(exclude_types, from_account)
end
def target_statuses_from_notifications

1
app/controllers/api/v1/statuses/favourited_by_accounts_controller.rb
View file

@ -22,6 +22,7 @@ class Api::V1::Statuses::FavouritedByAccountsController < Api::BaseController
def default_accounts
Account
.without_suspended
.includes(:favourites, :account_stat)
.references(:favourites)
.where(favourites: { status_id: @status.id })

2
app/controllers/api/v1/statuses/reblogged_by_accounts_controller.rb
View file

@ -21,7 +21,7 @@ class Api::V1::Statuses::RebloggedByAccountsController < Api::BaseController
end
def default_accounts
Account.includes(:statuses, :account_stat).references(:statuses)
Account.without_suspended.includes(:statuses, :account_stat).references(:statuses)
end
def paginated_statuses

3
app/models/notification.rb
View file

@ -41,8 +41,11 @@ class Notification < ApplicationRecord
validates :account_id, uniqueness: { scope: [:activity_type, :activity_id] }
validates :activity_type, inclusion: { in: TYPE_CLASS_MAP.values }
scope :without_suspended, -> { joins(:from_account).merge(Account.without_suspended) }
scope :browserable, ->(exclude_types = [], account_id = nil) {
types = TYPE_CLASS_MAP.values - activity_types_from_types(exclude_types)
if account_id.nil?
where(activity_type: types)
else

2
app/policies/status_policy.rb
View file

@ -12,6 +12,8 @@ class StatusPolicy < ApplicationPolicy
end
def show?
return false if author.suspended?
if requires_mention?
owned? || mention_exists?
elsif private?

55
app/serializers/rest/account_serializer.rb
View file

@ -8,8 +8,11 @@ class REST::AccountSerializer < ActiveModel::Serializer
:followers_count, :following_count, :statuses_count, :last_status_at
has_one :moved_to_account, key: :moved, serializer: REST::AccountSerializer, if: :moved_and_not_nested?
has_many :emojis, serializer: REST::CustomEmojiSerializer
attribute :suspended, if: :suspended?
class FieldSerializer < ActiveModel::Serializer
attributes :name, :value, :verified_at
@ -29,7 +32,7 @@ class REST::AccountSerializer < ActiveModel::Serializer
end
def note
Formatter.instance.simplified_format(object)
object.suspended? ? '' : Formatter.instance.simplified_format(object)
end
def url
@ -37,26 +40,60 @@ class REST::AccountSerializer < ActiveModel::Serializer
end
def avatar
full_asset_url(object.avatar_original_url)
full_asset_url(object.suspended? ? object.avatar.default_url : object.avatar_original_url)
end
def avatar_static
full_asset_url(object.avatar_static_url)
full_asset_url(object.suspended? ? object.avatar.default_url : object.avatar_static_url)
end
def header
full_asset_url(object.header_original_url)
full_asset_url(object.suspended? ? object.header.default_url : object.header_original_url)
end
def header_static
full_asset_url(object.header_static_url)
end
def moved_and_not_nested?
object.moved? && object.moved_to_account.moved_to_account_id.nil?
full_asset_url(object.suspended? ? object.header.default_url : object.header_static_url)
end
def last_status_at
object.last_status_at&.to_date&.iso8601
end
def display_name
object.suspended? ? '' : object.display_name
end
def locked
object.suspended? ? false : object.locked
end
def bot
object.suspended? ? false : object.bot
end
def discoverable
object.suspended? ? false : object.discoverable
end
def moved_to_account
object.suspended? ? nil : object.moved_to_account
end
def emojis
object.suspended? ? [] : object.emojis
end
def fields
object.suspended? ? [] : object.fields
end
def suspended
object.suspended?
end
delegate :suspended?, to: :object
def moved_and_not_nested?
object.moved? && object.moved_to_account.moved_to_account_id.nil?
end
end

4
lib/paperclip/attachment_extensions.rb
View file

@ -35,6 +35,10 @@ module Paperclip
formats.include?(other_extension.delete('.')) && File.basename(other_filename, other_extension) == File.basename(original_filename, File.extname(original_filename))
end
def default_url(style_name = default_style)
@url_generator.for_as_default(style_name)
end
end
end

4
lib/paperclip/url_generator_extensions.rb
View file

@ -11,6 +11,10 @@ module Paperclip
Addressable::URI.parse(url).normalize.to_str.gsub(escape_regex) { |m| "%#{m.ord.to_s(16).upcase}" }
end
end
def for_as_default(style_name)
attachment_options[:interpolator].interpolate(default_url, @attachment, style_name)
end
end
end