eightball/PluralKit
1
0
Fork 0
mirror of https://github.com/PluralKit/PluralKit.git synced 2026-02-04 04:56:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(bot): respect member/group name/desc privacy in search

Browse source
This commit is contained in:
Petal Ladenson 2024-10-04 10:49:10 -06:00 • committed by GitHub
parent 42235cef9c
commit 5f644ab17a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
8 changed files with 42 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

4
PluralKit.Bot/Commands/GroupMember.cs
View file

@ -54,7 +54,7 @@ public class GroupMember
public async Task ListMemberGroups(Context ctx, PKMember target)
{
var targetSystem = await ctx.Repository.GetSystem(target.System);
var opts = ctx.ParseListOptions(ctx.DirectLookupContextFor(target.System));
var opts = ctx.ParseListOptions(ctx.DirectLookupContextFor(target.System), ctx.LookupContextFor(target.System));
opts.MemberFilter = target.Id;
var title = new StringBuilder($"Groups containing {target.Name} (`{target.DisplayHid(ctx.Config)}`) in ");
@ -141,7 +141,7 @@ public class GroupMember
var targetSystem = await GetGroupSystem(ctx, target);
ctx.CheckSystemPrivacy(targetSystem.Id, target.ListPrivacy);
var opts = ctx.ParseListOptions(ctx.DirectLookupContextFor(target.System));
var opts = ctx.ParseListOptions(ctx.DirectLookupContextFor(target.System), ctx.LookupContextFor(target.System));
opts.GroupFilter = target.Id;
var title = new StringBuilder($"Members of {target.DisplayName ?? target.Name} (`{target.DisplayHid(ctx.Config)}`) in ");

2
PluralKit.Bot/Commands/Groups.cs
View file

@ -468,7 +468,7 @@ public class Groups
// - ParseListOptions checks list access privacy and sets the privacy filter (which members show up in list)
// - RenderGroupList checks the indivual privacy for each member (NameFor, etc)
// the own system is always allowed to look up their list
var opts = ctx.ParseListOptions(ctx.DirectLookupContextFor(system.Id));
var opts = ctx.ParseListOptions(ctx.DirectLookupContextFor(system.Id), ctx.LookupContextFor(system.Id));
await ctx.RenderGroupList(
ctx.LookupContextFor(system.Id),
system.Id,

7
PluralKit.Bot/Commands/Lists/ContextListExt.cs
View file

@ -11,7 +11,7 @@ namespace PluralKit.Bot;
public static class ContextListExt
{
public static ListOptions ParseListOptions(this Context ctx, LookupContext lookupCtx)
public static ListOptions ParseListOptions(this Context ctx, LookupContext directLookupCtx, LookupContext lookupContext)
{
var p = new ListOptions();
@ -55,10 +55,13 @@ public static class ContextListExt
if (ctx.MatchFlag("private-only", "po")) p.PrivacyFilter = PrivacyLevel.Private;
// PERM CHECK: If we're trying to access non-public members of another system, error
if (p.PrivacyFilter != PrivacyLevel.Public && lookupCtx != LookupContext.ByOwner)
if (p.PrivacyFilter != PrivacyLevel.Public && directLookupCtx != LookupContext.ByOwner)
// TODO: should this just return null instead of throwing or something? >.>
throw Errors.NotOwnInfo;
//this is for searching
p.Context = lookupContext;
// Additional fields to include in the search results
if (ctx.MatchFlag("with-last-switch", "with-last-fronted", "with-last-front", "wls", "wlf"))
p.IncludeLastSwitch = true;

4
PluralKit.Bot/Commands/Lists/ListOptions.cs
View file

@ -28,6 +28,7 @@ public class ListOptions
public bool Reverse { get; set; }
public PrivacyLevel? PrivacyFilter { get; set; } = PrivacyLevel.Public;
public LookupContext Context { get; set; } = LookupContext.ByNonOwner;
public GroupId? GroupFilter { get; set; }
public MemberId? MemberFilter { get; set; }
public string? Search { get; set; }
@ -99,7 +100,8 @@ public class ListOptions
GroupFilter = GroupFilter,
MemberFilter = MemberFilter,
Search = Search,
SearchDescription = SearchDescription
SearchDescription = SearchDescription,
Context = Context
};
}

2
PluralKit.Bot/Commands/Random.cs
View file

@ -67,7 +67,7 @@ public class Random
{
ctx.CheckSystemPrivacy(group.System, group.ListPrivacy);
var opts = ctx.ParseListOptions(ctx.DirectLookupContextFor(group.System));
var opts = ctx.ParseListOptions(ctx.DirectLookupContextFor(group.System), ctx.LookupContextFor(group.System));
opts.GroupFilter = group.Id;
var members = await ctx.Database.Execute(conn => conn.QueryMemberList(group.System, opts.ToQueryOptions()));

2
PluralKit.Bot/Commands/SystemList.cs
View file

@ -17,7 +17,7 @@ public class SystemList
// - ParseListOptions checks list access privacy and sets the privacy filter (which members show up in list)
// - RenderMemberList checks the indivual privacy for each member (NameFor, etc)
// the own system is always allowed to look up their list
var opts = ctx.ParseListOptions(ctx.DirectLookupContextFor(target.Id));
var opts = ctx.ParseListOptions(ctx.DirectLookupContextFor(target.Id), ctx.LookupContextFor(target.Id));
await ctx.RenderMemberList(
ctx.LookupContextFor(target.Id),
target.Id,

6
PluralKit.Core/Database/Views/DatabaseViewsExt.cs
View file

@ -24,7 +24,8 @@ public static class DatabaseViewsExt
static string Filter(string column) =>
$"(position(lower(@filter) in lower(coalesce({column}, ''))) > 0)";
query.Append($" and ({Filter("name")} or {Filter("display_name")}");
var nameColumn = opts.Context == LookupContext.ByOwner ? "name" : "public_name";
query.Append($" and ({Filter(nameColumn)} or {Filter("display_name")}");
if (opts.SearchDescription)
{
// We need to account for the possibility of description privacy when searching
@ -60,7 +61,8 @@ public static class DatabaseViewsExt
static string Filter(string column) =>
$"(position(lower(@filter) in lower(coalesce({column}, ''))) > 0)";
query.Append($" and ({Filter("name")} or {Filter("display_name")}");
var nameColumn = opts.Context == LookupContext.ByOwner ? "name" : "public_name";
query.Append($" and ({Filter(nameColumn)} or {Filter("display_name")}");
if (opts.SearchDescription)
{
// We need to account for the possibility of description privacy when searching

27
PluralKit.Core/Database/Views/views.sql
View file

@ -30,7 +30,15 @@ select members.*,
-- Privacy '1' = public; just return description as normal
when members.description_privacy = 1 then members.description
-- Any other privacy (rn just '2'), return null description (missing case = null in SQL)
end as public_description
end as public_description,
-- Extract member name as seen by "the public"
case
-- Privacy '1' = public; just return name as normal
when members.name_privacy = 1 then members.name
-- Any other privacy (rn just '2'), return display name
else members.display_name
end as public_name
from members;
create view group_list as
@ -48,5 +56,20 @@ select groups.*,
inner join members on group_members.member_id = members.id
where
group_members.group_id = groups.id
) as total_member_count
) as total_member_count,
-- Extract group description as seen by "the public"
case
-- Privacy '1' = public; just return description as normal
when groups.description_privacy = 1 then groups.description
-- Any other privacy (rn just '2'), return null description (missing case = null in SQL)
end as public_description,
-- Extract member name as seen by "the public"
case
-- Privacy '1' = public; just return name as normal
when groups.name_privacy = 1 then groups.name
-- Any other privacy (rn just '2'), return display name
else groups.display_name
end as public_name
from groups;