Verify remote user name and media url

2018-12-02 19:07:36 +01:00
parent 449641d158
commit ed71d24fe9
2 changed files with 33 additions and 22 deletions
@@ -131,19 +131,23 @@ impl Media {
            .expect("Media::delete: database entry deletion error");
    }

-    pub fn save_remote(conn: &Connection, url: String, user: &User) -> Media {
-        Media::insert(
-            conn,
-            NewMedia {
-                file_path: String::new(),
-                alt_text: String::new(),
-                is_remote: true,
-                remote_url: Some(url),
-                sensitive: false,
-                content_warning: None,
-                owner_id: user.id,
-            },
-        )
+    pub fn save_remote(conn: &Connection, url: String, user: &User) -> Result<Media, ()> {
+        if url.contains(&['<', '>', '"'][..]) {
+            Err(())
+        } else {
+            Ok(Media::insert(
+                conn,
+                NewMedia {
+                    file_path: String::new(),
+                    alt_text: String::new(),
+                    is_remote: true,
+                    remote_url: Some(url),
+                    sensitive: false,
+                    content_warning: None,
+                    owner_id: user.id,
+                },
+            ))
+        }
    }

    pub fn set_owner(&self, conn: &Connection, user: &User) {
@@ -177,7 +181,7 @@ impl Media {
            NewMedia {
                file_path: path.to_str()?.to_string(),
                alt_text: image.object_props.content_string().ok()?,
-                is_remote: true,
+                is_remote: false,
                remote_url: None,
                sensitive: image.object_props.summary_string().is_ok(),
                content_warning: image.object_props.summary_string().ok(),