summary refs log tree commit diff
path: root/src/api/routes
diff options
context:
space:
mode:
authorMadeline <46743919+MaddyUnderStars@users.noreply.github.com>2024-08-22 09:53:34 +1000
committerGitHub <noreply@github.com>2024-08-22 09:53:34 +1000
commitad2dda63c9969f18caa4cf78ce45ebf3fd5dc28c (patch)
tree4e01535ebb34c7c215293953ac58407e84332dae /src/api/routes
parentre-add CDN TODO comment (diff)
parentMerge pull request #1193 from DEVTomatoCake/fix/forgot-password-security (diff)
downloadserver-ts-ad2dda63c9969f18caa4cf78ce45ebf3fd5dc28c.tar.xz
Merge branch 'master' into fix/widget.json-channel-ordering-deleted-channels
Diffstat (limited to 'src/api/routes')
-rw-r--r--src/api/routes/auth/forgot.ts66
-rw-r--r--src/api/routes/channels/#channel_id/pins.ts32
-rw-r--r--src/api/routes/guilds/#guild_id/widget.json.ts14
-rw-r--r--src/api/routes/guilds/#guild_id/widget.png.ts20
4 files changed, 65 insertions, 67 deletions
diff --git a/src/api/routes/auth/forgot.ts b/src/api/routes/auth/forgot.ts

index 6fa86021c..d5a8a2f40 100644 --- a/src/api/routes/auth/forgot.ts +++ b/src/api/routes/auth/forgot.ts
@@ -1,31 +1,24 @@ /* Spacebar: A FOSS re-implementation and extension of the Discord.com backend. Copyright (C) 2023 Spacebar and Spacebar Contributors - + This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. - + This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details. - + You should have received a copy of the GNU Affero General Public License along with this program. If not, see <https://www.gnu.org/licenses/>. */ import { getIpAdress, route, verifyCaptcha } from "@spacebar/api"; -import { - Config, - Email, - FieldErrors, - ForgotPasswordSchema, - User, -} from "@spacebar/util"; +import { Config, Email, ForgotPasswordSchema, User } from "@spacebar/util"; import { Request, Response, Router } from "express"; -import { HTTPError } from "lambert-server"; const router = Router(); router.post( @@ -37,9 +30,6 @@ router.post( 400: { body: "APIErrorOrCaptchaResponse", }, - 500: { - body: "APIErrorResponse", - }, }, }), async (req: Request, res: Response) => { @@ -71,50 +61,20 @@ router.post( } } - const user = await User.findOneOrFail({ - where: [{ phone: login }, { email: login }], - select: ["username", "id", "disabled", "deleted", "email"], - relations: ["security_keys"], - }).catch(() => { - throw FieldErrors({ - login: { - message: req.t("auth:password_reset.EMAIL_DOES_NOT_EXIST"), - code: "EMAIL_DOES_NOT_EXIST", - }, - }); - }); + res.sendStatus(204); - if (!user.email) - throw FieldErrors({ - login: { - message: - "This account does not have an email address associated with it.", - code: "NO_EMAIL", - }, - }); - - if (user.deleted) - return res.status(400).json({ - message: "This account is scheduled for deletion.", - code: 20011, - }); - - if (user.disabled) - return res.status(400).json({ - message: req.t("auth:login.ACCOUNT_DISABLED"), - code: 20013, - }); + const user = await User.findOne({ + where: [{ phone: login }, { email: login }], + select: ["username", "id", "email"], + }).catch(() => {}); - return await Email.sendResetPassword(user, user.email) - .then(() => { - return res.sendStatus(204); - }) - .catch((e) => { + if (user && user.email) { + Email.sendResetPassword(user, user.email).catch((e) => { console.error( - `Failed to send password reset email to ${user.username}#${user.discriminator}: ${e}`, + `Failed to send password reset email to ${user.username}#${user.discriminator} (${user.id}): ${e}`, ); - throw new HTTPError("Failed to send password reset email", 500); }); + } }, ); diff --git a/src/api/routes/channels/#channel_id/pins.ts b/src/api/routes/channels/#channel_id/pins.ts
index 1e1da018f..d43db6ecc 100644 --- a/src/api/routes/channels/#channel_id/pins.ts +++ b/src/api/routes/channels/#channel_id/pins.ts
@@ -23,7 +23,9 @@ import { DiscordApiErrors, emitEvent, Message, + MessageCreateEvent, MessageUpdateEvent, + User, } from "@spacebar/util"; import { Request, Response, Router } from "express"; @@ -61,6 +63,30 @@ router.put( message.pinned = true; + const author = await User.getPublicUser(req.user_id); + + const systemPinMessage = Message.create({ + timestamp: new Date(), + type: 6, + guild_id: message.guild_id, + channel_id: message.channel_id, + author, + message_reference: { + message_id: message.id, + channel_id: message.channel_id, + guild_id: message.guild_id, + }, + reactions: [], + attachments: [], + embeds: [], + sticker_items: [], + edited_timestamp: undefined, + mentions: [], + mention_channels: [], + mention_roles: [], + mention_everyone: false, + }); + await Promise.all([ message.save(), emitEvent({ @@ -77,6 +103,12 @@ router.put( last_pin_timestamp: undefined, }, } as ChannelPinsUpdateEvent), + systemPinMessage.save(), + emitEvent({ + event: "MESSAGE_CREATE", + channel_id: message.channel_id, + data: systemPinMessage, + } as MessageCreateEvent), ]); res.sendStatus(204); diff --git a/src/api/routes/guilds/#guild_id/widget.json.ts b/src/api/routes/guilds/#guild_id/widget.json.ts
index 12b31b888..0ee3640d5 100644 --- a/src/api/routes/guilds/#guild_id/widget.json.ts +++ b/src/api/routes/guilds/#guild_id/widget.json.ts
@@ -17,9 +17,15 @@ */ import { random, route } from "@spacebar/api"; -import { Channel, Guild, Invite, Member, Permissions } from "@spacebar/util"; +import { + Channel, + DiscordApiErrors, + Guild, + Invite, + Member, + Permissions, +} from "@spacebar/util"; import { Request, Response, Router } from "express"; -import { HTTPError } from "lambert-server"; const router: Router = Router(); @@ -46,14 +52,14 @@ router.get( }), async (req: Request, res: Response) => { const { guild_id } = req.params; - + const guild = await Guild.findOneOrFail({ where: { id: guild_id }, select: { channel_ordering: true, }, }); - if (!guild.widget_enabled) throw new HTTPError("Widget Disabled", 404); + if (!guild.widget_enabled) throw DiscordApiErrors.EMBED_DISABLED; // Fetch existing widget invite for widget channel let invite = await Invite.findOne({ diff --git a/src/api/routes/guilds/#guild_id/widget.png.ts b/src/api/routes/guilds/#guild_id/widget.png.ts
index c9ba8afce..c42b33e07 100644 --- a/src/api/routes/guilds/#guild_id/widget.png.ts +++ b/src/api/routes/guilds/#guild_id/widget.png.ts
@@ -1,17 +1,17 @@ /* Spacebar: A FOSS re-implementation and extension of the Discord.com backend. Copyright (C) 2023 Spacebar and Spacebar Contributors - + This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. - + This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details. - + You should have received a copy of the GNU Affero General Public License along with this program. If not, see <https://www.gnu.org/licenses/>. */ @@ -19,11 +19,12 @@ /* eslint-disable @typescript-eslint/no-explicit-any */ import { route } from "@spacebar/api"; -import { Guild } from "@spacebar/util"; +import { DiscordApiErrors, Guild } from "@spacebar/util"; import { Request, Response, Router } from "express"; import fs from "fs"; import { HTTPError } from "lambert-server"; import path from "path"; +import { storage } from "../../../../cdn/util/Storage"; const router: Router = Router(); @@ -48,10 +49,10 @@ router.get( const { guild_id } = req.params; const guild = await Guild.findOneOrFail({ where: { id: guild_id } }); - if (!guild.widget_enabled) throw new HTTPError("Unknown Guild", 404); + if (!guild.widget_enabled) throw DiscordApiErrors.EMBED_DISABLED; // Fetch guild information - const icon = guild.icon; + const icon = "avatars/" + guild_id + "/" + guild.icon; const name = guild.name; const presence = guild.presence_count + " ONLINE"; @@ -69,8 +70,7 @@ router.get( } // Setup canvas - const { createCanvas } = require("canvas"); - const { loadImage } = require("canvas"); + const { createCanvas, loadImage } = require("canvas"); const sizeOf = require("image-size"); // TODO: Widget style templates need Spacebar branding @@ -211,8 +211,8 @@ async function drawIcon( scale: number, icon: string, ) { - const img = new (require("canvas").Image)(); - img.src = icon; + const { loadImage } = require("canvas"); + const img = await loadImage(await storage.get(icon)); // Do some canvas clipping magic! canvas.save();