Don't leak unlisted videos in comments feed

[github/Chocobozzz/PeerTube.git] / server / models / utils.ts

diff --git a/server/models/utils.ts b/server/models/utils.ts
index 24890f961e5d1d2738d0148b37d6561469cf445b..06ff058649965d2f1e2d1a2c85ede33245ffe808 100644 (file)
--- a/server/models/utils.ts
+++ b/server/models/utils.ts
@@ -1,9 +1,26 @@
 import { Model, Sequelize } from 'sequelize-typescript'
-import * as validator from 'validator'
+import validator from 'validator'
 import { Col } from 'sequelize/types/lib/utils'
-import { OrderItem, literal } from 'sequelize'
+import { literal, OrderItem } from 'sequelize'
 
-type SortType = { sortModel: any, sortValue: string }
+type Primitive = string | Function | number | boolean | Symbol | undefined | null
+type DeepOmitHelper<T, K extends keyof T> = {
+  [P in K]: // extra level of indirection needed to trigger homomorhic behavior
+  T[P] extends infer TP // distribute over unions
+    ? TP extends Primitive
+      ? TP // leave primitives and functions alone
+      : TP extends any[]
+        ? DeepOmitArray<TP, K> // Array special handling
+        : DeepOmit<TP, K>
+    : never
+}
+type DeepOmit<T, K> = T extends Primitive ? T : DeepOmitHelper<T, Exclude<keyof T, K>>
+
+type DeepOmitArray<T extends any[], K> = {
+  [P in keyof T]: DeepOmit<T[P], K>
+}
+
+type SortType = { sortModel: string, sortValue: string }
 
 // Translate for example "-name" to [ [ 'name', 'DESC' ], [ 'id', 'ASC' ] ]
 function getSort (value: string, lastSort: OrderItem = [ 'id', 'ASC' ]): OrderItem[] {
@@ -22,6 +39,19 @@ function getSort (value: string, lastSort: OrderItem = [ 'id', 'ASC' ]): OrderIt
   return [ [ finalField, direction ], lastSort ]
 }
 
+function getCommentSort (value: string, lastSort: OrderItem = [ 'id', 'ASC' ]): OrderItem[] {
+  const { direction, field } = buildDirectionAndField(value)
+
+  if (field === 'totalReplies') {
+    return [
+      [ Sequelize.literal('"totalReplies"'), direction ],
+      lastSort
+    ]
+  }
+
+  return getSort(value, lastSort)
+}
+
 function getVideoSort (value: string, lastSort: OrderItem = [ 'id', 'ASC' ]): OrderItem[] {
   const { direction, field } = buildDirectionAndField(value)
 
@@ -51,13 +81,26 @@ function getVideoSort (value: string, lastSort: OrderItem = [ 'id', 'ASC' ]): Or
   return [ firstSort, lastSort ]
 }
 
-function getSortOnModel (model: any, value: string, lastSort: OrderItem = [ 'id', 'ASC' ]): OrderItem[] {
+function getBlacklistSort (model: any, value: string, lastSort: OrderItem = [ 'id', 'ASC' ]): OrderItem[] {
   const [ firstSort ] = getSort(value)
 
-  if (model) return [ [ model, firstSort[0], firstSort[1] ], lastSort ]
+  if (model) return [ [ literal(`"${model}.${firstSort[0]}" ${firstSort[1]}`) ], lastSort ] as any[] // FIXME: typings
   return [ firstSort, lastSort ]
 }
 
+function getFollowsSort (value: string, lastSort: OrderItem = [ 'id', 'ASC' ]): OrderItem[] {
+  const { direction, field } = buildDirectionAndField(value)
+
+  if (field === 'redundancyAllowed') {
+    return [
+      [ 'ActorFollowing', 'Server', 'redundancyAllowed', direction ],
+      lastSort
+    ]
+  }
+
+  return getSort(value, lastSort)
+}
+
 function isOutdated (model: { createdAt: Date, updatedAt: Date }, refreshInterval: number) {
   const now = Date.now()
   const createdAtTime = model.createdAt.getTime()
@@ -113,7 +156,7 @@ function buildServerIdsFollowedBy (actorId: any) {
     'SELECT "actor"."serverId" FROM "actorFollow" ' +
     'INNER JOIN "actor" ON actor.id = "actorFollow"."targetActorId" ' +
     'WHERE "actorFollow"."actorId" = ' + actorIdNumber +
-  ')'
+    ')'
 }
 
 function buildWhereIdOrUUID (id: number | string) {
@@ -130,8 +173,11 @@ function parseAggregateResult (result: any) {
 }
 
 const createSafeIn = (model: typeof Model, stringArr: (string | number)[]) => {
-  return stringArr.map(t => model.sequelize.escape('' + t))
-                  .join(', ')
+  return stringArr.map(t => {
+    return t === null
+      ? null
+      : model.sequelize.escape('' + t)
+  }).join(', ')
 }
 
 function buildLocalAccountIdsIn () {
@@ -146,16 +192,33 @@ function buildLocalActorIdsIn () {
   )
 }
 
+function buildDirectionAndField (value: string) {
+  let field: string
+  let direction: 'ASC' | 'DESC'
+
+  if (value.substring(0, 1) === '-') {
+    direction = 'DESC'
+    field = value.substring(1)
+  } else {
+    direction = 'ASC'
+    field = value
+  }
+
+  return { direction, field }
+}
+
 // ---------------------------------------------------------------------------
 
 export {
+  DeepOmit,
   buildBlockedAccountSQL,
   buildLocalActorIdsIn,
   SortType,
   buildLocalAccountIdsIn,
   getSort,
+  getCommentSort,
   getVideoSort,
-  getSortOnModel,
+  getBlacklistSort,
   createSimilarityAttribute,
   throwIfNotValid,
   buildServerIdsFollowedBy,
@@ -163,6 +226,8 @@ export {
   buildWhereIdOrUUID,
   isOutdated,
   parseAggregateResult,
+  getFollowsSort,
+  buildDirectionAndField,
   createSafeIn
 }
 
@@ -175,18 +240,3 @@ function searchTrigramNormalizeValue (value: string) {
 function searchTrigramNormalizeCol (col: string) {
   return Sequelize.fn('lower', Sequelize.fn('immutable_unaccent', Sequelize.col(col)))
 }
-
-function buildDirectionAndField (value: string) {
-  let field: string
-  let direction: 'ASC' | 'DESC'
-
-  if (value.substring(0, 1) === '-') {
-    direction = 'DESC'
-    field = value.substring(1)
-  } else {
-    direction = 'ASC'
-    field = value
-  }
-
-  return { direction, field }
-}