Merge branch '2339-local-remote-mixup' into 'develop'

User: Don't allow local users in remote changesets

Closes #2339

See merge request pleroma/pleroma!3185
This commit is contained in:
Haelwenn 2020-12-03 01:28:54 +00:00
commit 05879a3b3e
3 changed files with 20 additions and 1 deletions

View File

@ -473,6 +473,18 @@ def remote_user_changeset(struct \\ %User{local: false}, params) do
|> validate_length(:bio, max: bio_limit)
|> validate_length(:name, max: name_limit)
|> validate_fields(true)
|> validate_non_local()
end
defp validate_non_local(cng) do
local? = get_field(cng, :local)
if local? do
cng
|> add_error(:local, "User is local, can't update with this changeset.")
else
cng
end
end
def update_changeset(struct, params \\ %{}) do

View File

@ -895,6 +895,13 @@ test "it has required fields" do
refute cs.valid?
end)
end
test "it is invalid given a local user" do
user = insert(:user)
cs = User.remote_user_changeset(user, %{name: "tom from myspace"})
refute cs.valid?
end
end
describe "followers and friends" do

View File

@ -108,7 +108,7 @@ test "it blocks but does not unfollow if the relevant setting is set", %{
describe "update users" do
setup do
user = insert(:user)
user = insert(:user, local: false)
{:ok, update_data, []} = Builder.update(user, %{"id" => user.ap_id, "name" => "new name!"})
{:ok, update, _meta} = ActivityPub.persist(update_data, local: true)