pleroma

commit: 05879a3b3ef656fd167e40e0a62c7a3c9f41facd
parent c91ca482c2df85006d1967591730407230448316
Author: Haelwenn <contact+git.pleroma.social@hacktivis.me>
Date:   Thu,  3 Dec 2020 01:28:54 +0000

Merge branch '2339-local-remote-mixup' into 'develop'

User: Don't allow local users in remote changesets

Closes #2339

See merge request pleroma/pleroma!3185
Diffstat:
M
lib/pleroma/user.ex
12
++++++++++++
M
test/pleroma/user_test.exs
7
+++++++
M
test/pleroma/web/activity_pub/side_effects_test.exs
2
+-

3 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
@@ -473,6 +473,18 @@ defmodule Pleroma.User do
     |> validate_length(:bio, max: bio_limit)
     |> validate_length(:name, max: name_limit)
     |> validate_fields(true)
+    |> validate_non_local()
+  end
+
+  defp validate_non_local(cng) do
+    local? = get_field(cng, :local)
+
+    if local? do
+      cng
+      |> add_error(:local, "User is local, can't update with this changeset.")
+    else
+      cng
+    end
   end
 
   def update_changeset(struct, params \\ %{}) do
diff --git a/test/pleroma/user_test.exs b/test/pleroma/user_test.exs
@@ -895,6 +895,13 @@ defmodule Pleroma.UserTest do
         refute cs.valid?
       end)
     end
+
+    test "it is invalid given a local user" do
+      user = insert(:user)
+      cs = User.remote_user_changeset(user, %{name: "tom from myspace"})
+
+      refute cs.valid?
+    end
   end
 
   describe "followers and friends" do
diff --git a/test/pleroma/web/activity_pub/side_effects_test.exs b/test/pleroma/web/activity_pub/side_effects_test.exs
@@ -108,7 +108,7 @@ defmodule Pleroma.Web.ActivityPub.SideEffectsTest do
 
   describe "update users" do
     setup do
-      user = insert(:user)
+      user = insert(:user, local: false)
       {:ok, update_data, []} = Builder.update(user, %{"id" => user.ap_id, "name" => "new name!"})
       {:ok, update, _meta} = ActivityPub.persist(update_data, local: true)