Handle HTML is comments

2 files changed, 4 insertions, 14 deletions

diff --git a/server/helpers/custom-validators/activitypub/video-comments.ts b/server/helpers/custom-validators/activitypub/video-comments.ts
index 6928aced3..ce1209035 100644
--- a/server/helpers/custom-validators/activitypub/video-comments.ts
+++ b/server/helpers/custom-validators/activitypub/video-comments.ts
@@ -1,7 +1,6 @@
 import * as validator from 'validator'
 import { exists, isDateValid } from '../misc'
 import { isActivityPubUrlValid, isBaseActivityValid } from './misc'
-import * as sanitizeHtml from 'sanitize-html'
 
 function isVideoCommentCreateActivityValid (activity: any) {
   return isBaseActivityValid(activity, 'Create') &&
@@ -11,7 +10,6 @@ function isVideoCommentCreateActivityValid (activity: any) {
 function isVideoCommentObjectValid (comment: any) {
   return comment.type === 'Note' &&
     isActivityPubUrlValid(comment.id) &&
-    sanitizeCommentHTML(comment) &&
     isCommentContentValid(comment.content) &&
     isActivityPubUrlValid(comment.inReplyTo) &&
     isDateValid(comment.published) &&
@@ -31,15 +29,6 @@ export {
 
 // ---------------------------------------------------------------------------
 
-function sanitizeCommentHTML (comment: any) {
-  return sanitizeHtml(comment.content, {
-    allowedTags: [ 'b', 'i', 'em', 'span', 'a' ],
-    allowedAttributes: {
-      'a': [ 'href' ]
-    }
-  })
-}
-
 function isCommentContentValid (content: any) {
   return exists(content) && validator.isLength('' + content, { min: 1 })
 }
diff --git a/server/lib/activitypub/process/process-delete.ts b/server/lib/activitypub/process/process-delete.ts
index 01751422d..07e6a0075 100644
--- a/server/lib/activitypub/process/process-delete.ts
+++ b/server/lib/activitypub/process/process-delete.ts
@@ -11,8 +11,9 @@ import { getOrCreateActorAndServerAndModel } from '../actor'
 
 async function processDeleteActivity (activity: ActivityDelete) {
   const actor = await getOrCreateActorAndServerAndModel(activity.actor)
+  const objectUrl = typeof activity.object === 'string' ? activity.object : activity.object.id
 
-  if (actor.url === activity.object) {
+  if (actor.url === objectUrl) {
     if (actor.type === 'Person') {
       if (!actor.Account) throw new Error('Actor ' + actor.url + ' is a person but we cannot find it in database.')
 
@@ -25,14 +26,14 @@ async function processDeleteActivity (activity: ActivityDelete) {
   }
 
   {
-    const videoCommentInstance = await VideoCommentModel.loadByUrlAndPopulateAccount(activity.object)
+    const videoCommentInstance = await VideoCommentModel.loadByUrlAndPopulateAccount(objectUrl)
     if (videoCommentInstance) {
       return processDeleteVideoComment(actor, videoCommentInstance)
     }
   }
 
   {
-    const videoInstance = await VideoModel.loadByUrlAndPopulateAccount(activity.object)
+    const videoInstance = await VideoModel.loadByUrlAndPopulateAccount(objectUrl)
     if (videoInstance) {
       return processDeleteVideo(actor, videoInstance)
     }