UA-Fediland/pixelfed
2
0
Fork 0
mirror of https://github.com/pixelfed/pixelfed.git synced 2024-11-14 02:24:31 +00:00
Code Issues Projects Releases Packages Wiki Activity

Fix api endpoints

Browse source
This commit is contained in:
Daniel Supernault 2024-02-09 20:41:12 -07:00
parent 607b239c1a
commit e354750808
No known key found for this signature in database
GPG key ID: 23740873EE6F76A1
3 changed files with 14 additions and 28 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
app/Http/Controllers/Api/BaseApiController.php
View file

@ -56,8 +56,7 @@ class BaseApiController extends Controller
public function notifications(Request $request) public function notifications(Request $request)
{ {
abort_if(!$request->user() || !$request->user()->token(), 403); abort_if(!$request->user(), 403);
abort_unless($request->user()->tokenCan('read'), 403);
$pid = $request->user()->profile_id; $pid = $request->user()->profile_id;
$limit = $request->input('limit', 20); $limit = $request->input('limit', 20);
@ -99,8 +98,7 @@ class BaseApiController extends Controller
public function avatarUpdate(Request $request) public function avatarUpdate(Request $request)
{ {
abort_if(!$request->user() || !$request->user()->token(), 403); abort_if(!$request->user(), 403);
abort_unless($request->user()->tokenCan('write'), 403);
$this->validate($request, [ $this->validate($request, [
'upload' => 'required|mimetypes:image/jpeg,image/jpg,image/png|max:'.config('pixelfed.max_avatar_size'), 'upload' => 'required|mimetypes:image/jpeg,image/jpg,image/png|max:'.config('pixelfed.max_avatar_size'),
@ -137,8 +135,7 @@ class BaseApiController extends Controller
public function verifyCredentials(Request $request) public function verifyCredentials(Request $request)
{ {
abort_if(!$request->user() || !$request->user()->token(), 403); abort_if(!$request->user(), 403);
abort_unless($request->user()->tokenCan('read'), 403);
$user = $request->user(); $user = $request->user();
if ($user->status != null) { if ($user->status != null) {
@ -151,8 +148,7 @@ class BaseApiController extends Controller
public function accountLikes(Request $request) public function accountLikes(Request $request)
{ {
abort_if(!$request->user() || !$request->user()->token(), 403); abort_if(!$request->user(), 403);
abort_unless($request->user()->tokenCan('read'), 403);
$this->validate($request, [ $this->validate($request, [
'page' => 'sometimes|int|min:1|max:20', 'page' => 'sometimes|int|min:1|max:20',
@ -180,8 +176,7 @@ class BaseApiController extends Controller
public function archive(Request $request, $id) public function archive(Request $request, $id)
{ {
abort_if(!$request->user() || !$request->user()->token(), 403); abort_if(!$request->user(), 403);
abort_unless($request->user()->tokenCan('write'), 403);
$status = Status::whereNull('in_reply_to_id') $status = Status::whereNull('in_reply_to_id')
->whereNull('reblog_of_id') ->whereNull('reblog_of_id')
@ -209,8 +204,7 @@ class BaseApiController extends Controller
public function unarchive(Request $request, $id) public function unarchive(Request $request, $id)
{ {
abort_if(!$request->user() || !$request->user()->token(), 403); abort_if(!$request->user(), 403);
abort_unless($request->user()->tokenCan('write'), 403);
$status = Status::whereNull('in_reply_to_id') $status = Status::whereNull('in_reply_to_id')
->whereNull('reblog_of_id') ->whereNull('reblog_of_id')
@ -237,8 +231,7 @@ class BaseApiController extends Controller
public function archivedPosts(Request $request) public function archivedPosts(Request $request)
{ {
abort_if(!$request->user() || !$request->user()->token(), 403); abort_if(!$request->user(), 403);
abort_unless($request->user()->tokenCan('read'), 403);
$statuses = Status::whereProfileId($request->user()->profile_id) $statuses = Status::whereProfileId($request->user()->profile_id)
->whereScope('archived') ->whereScope('archived')

9
app/Http/Controllers/Api/V1/DomainBlockController.php
View file

@ -23,8 +23,7 @@ class DomainBlockController extends Controller
public function index(Request $request) public function index(Request $request)
{ {
abort_if(!$request->user() || !$request->user()->token(), 403); abort_if(!$request->user(), 403);
abort_unless($request->user()->tokenCan('read'), 403);
$this->validate($request, [ $this->validate($request, [
'limit' => 'sometimes|integer|min:1|max:200' 'limit' => 'sometimes|integer|min:1|max:200'
@ -54,8 +53,7 @@ class DomainBlockController extends Controller
public function store(Request $request) public function store(Request $request)
{ {
abort_if(!$request->user() || !$request->user()->token(), 403); abort_if(!$request->user(), 403);
abort_unless($request->user()->tokenCan('write'), 403);
$this->validate($request, [ $this->validate($request, [
'domain' => 'required|active_url|min:1|max:120' 'domain' => 'required|active_url|min:1|max:120'
@ -102,8 +100,7 @@ class DomainBlockController extends Controller
public function delete(Request $request) public function delete(Request $request)
{ {
abort_if(!$request->user() || !$request->user()->token(), 403); abort_if(!$request->user(), 403);
abort_unless($request->user()->tokenCan('write'), 403);
$this->validate($request, [ $this->validate($request, [
'domain' => 'required|min:1|max:120' 'domain' => 'required|min:1|max:120'

12
app/Http/Controllers/Api/V1/TagsController.php
View file

@ -47,8 +47,7 @@ class TagsController extends Controller
*/ */
public function followHashtag(Request $request, $id) public function followHashtag(Request $request, $id)
{ {
abort_if(!$request->user() || !$request->user()->token(), 403); abort_if(!$request->user(), 403);
abort_unless($request->user()->tokenCan('follow'), 403);
$pid = $request->user()->profile_id; $pid = $request->user()->profile_id;
$account = AccountService::get($pid); $account = AccountService::get($pid);
@ -90,8 +89,7 @@ class TagsController extends Controller
*/ */
public function unfollowHashtag(Request $request, $id) public function unfollowHashtag(Request $request, $id)
{ {
abort_if(!$request->user() || !$request->user()->token(), 403); abort_if(!$request->user(), 403);
abort_unless($request->user()->tokenCan('follow'), 403);
$pid = $request->user()->profile_id; $pid = $request->user()->profile_id;
$account = AccountService::get($pid); $account = AccountService::get($pid);
@ -136,8 +134,7 @@ class TagsController extends Controller
*/ */
public function getHashtag(Request $request, $id) public function getHashtag(Request $request, $id)
{ {
abort_if(!$request->user() || !$request->user()->token(), 403); abort_if(!$request->user(), 403);
abort_unless($request->user()->tokenCan('read'), 403);
$pid = $request->user()->profile_id; $pid = $request->user()->profile_id;
$account = AccountService::get($pid); $account = AccountService::get($pid);
@ -177,8 +174,7 @@ class TagsController extends Controller
*/ */
public function getFollowedTags(Request $request) public function getFollowedTags(Request $request)
{ {
abort_if(!$request->user() || !$request->user()->token(), 403); abort_if(!$request->user(), 403);
abort_unless($request->user()->tokenCan('read'), 403);
$account = AccountService::get($request->user()->profile_id); $account = AccountService::get($request->user()->profile_id);