plugins-nextcloud-mirror/spreed
1
0
Fork 0
mirror of https://github.com/nextcloud/spreed.git synced 2025-12-18 05:20:50 +01:00
Code Projects Releases Activity

fix(ban): Validate actor types on banning

Browse source 
Signed-off-by: Joas Schilling <coding@schilljs.com>
This commit is contained in:
Joas Schilling 2024-07-17 15:04:27 +02:00
parent 12cf1bb53c
commit 41def0b6c2
No known key found for this signature in database
GPG key ID: 74434EFE0D2E2205
6 changed files with 10 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
lib/Controller/BanController.php
View file

@ -10,7 +10,6 @@ declare(strict_types=1);
namespace OCA\Talk\Controller;
use OCA\Talk\Middleware\Attribute\RequireModeratorParticipant;
use OCA\Talk\Model\Attendee;
use OCA\Talk\Model\Ban;
use OCA\Talk\ResponseDefinitions;
use OCA\Talk\Service\BanService;
@ -38,8 +37,7 @@ class BanController extends AEnvironmentAwareController {
*
* Required capability: `ban-v1`
*
* @param 'users'|'groups'|'guests'|'circles'|'emails'|'federated_users'|'phones'|'ip' $actorType Type of actor to ban, or `ip` when banning a clients remote address
* @psalm-param Attendee::ACTOR_*|'ip' $actorType Type of actor to ban, or `ip` when banning a clients remote address
* @param 'users'|'guests'|'ip' $actorType Type of actor to ban, or `ip` when banning a clients remote address
* @param string $actorId Actor ID or the IP address or range in case of type `ip`
* @param string $internalNote Optional internal note (max. 4000 characters)
* @return DataResponse<Http::STATUS_OK, TalkBan, array{}>|DataResponse<Http::STATUS_BAD_REQUEST, array{error: 'bannedActor'|'internalNote'|'moderator'|'self'}, array{}>

8
lib/Service/BanService.php
View file

@ -34,10 +34,16 @@ class BanService {
* @throws \InvalidArgumentException
*/
public function createBan(Room $room, string $moderatorActorType, string $moderatorActorId, string $moderatorDisplayname, string $bannedActorType, string $bannedActorId, DateTime $bannedTime, string $internalNote): Ban {
if (empty($bannedActorId) || empty($bannedActorType)) {
if (!in_array($bannedActorType, ['users', 'guests', 'ip'], true)) {
throw new \InvalidArgumentException('bannedActor');
}
if (empty($bannedActorId)) {
throw new \InvalidArgumentException('bannedActor');
}
// Fix missing IP and range validation
if (strlen($internalNote) > Ban::NOTE_MAX_LENGTH) {
throw new \InvalidArgumentException('internalNote');
}

5
openapi-full.json
View file

@ -1990,12 +1990,7 @@
"type": "string",
"enum": [
"users",
"groups",
"guests",
"circles",
"emails",
"federated_users",
"phones",
"ip"
]
}

5
openapi.json
View file

@ -1877,12 +1877,7 @@
"type": "string",
"enum": [
"users",
"groups",
"guests",
"circles",
"emails",
"federated_users",
"phones",
"ip"
]
}

2
src/types/openapi/openapi-full.ts
View file

@ -2388,7 +2388,7 @@ export interface operations {
parameters: {
query: {
/** @description Type of actor to ban, or `ip` when banning a clients remote address */
actorType: "users" | "groups" | "guests" | "circles" | "emails" | "federated_users" | "phones" | "ip";
actorType: "users" | "guests" | "ip";
/** @description Actor ID or the IP address or range in case of type `ip` */
actorId: string;
/** @description Optional internal note (max. 4000 characters) */

2
src/types/openapi/openapi.ts
View file

@ -1873,7 +1873,7 @@ export interface operations {
parameters: {
query: {
/** @description Type of actor to ban, or `ip` when banning a clients remote address */
actorType: "users" | "groups" | "guests" | "circles" | "emails" | "federated_users" | "phones" | "ip";
actorType: "users" | "guests" | "ip";
/** @description Actor ID or the IP address or range in case of type `ip` */
actorId: string;
/** @description Optional internal note (max. 4000 characters) */