diff options
Diffstat (limited to 'internal/api/client')
| -rw-r--r-- | internal/api/client/accounts/accountdelete.go | 10 | ||||
| -rw-r--r-- | internal/api/client/bookmarks/bookmarks_test.go | 2 | ||||
| -rw-r--r-- | internal/api/client/statuses/statusfave_test.go | 2 |
3 files changed, 10 insertions, 4 deletions
diff --git a/internal/api/client/accounts/accountdelete.go b/internal/api/client/accounts/accountdelete.go index 02a75b670..242902cab 100644 --- a/internal/api/client/accounts/accountdelete.go +++ b/internal/api/client/accounts/accountdelete.go @@ -26,6 +26,7 @@ import ( apiutil "github.com/superseriousbusiness/gotosocial/internal/api/util" "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/oauth" + "golang.org/x/crypto/bcrypt" ) // AccountDeletePOSTHandler swagger:operation POST /api/v1/accounts/delete accountDelete @@ -77,15 +78,20 @@ func (m *Module) AccountDeletePOSTHandler(c *gin.Context) { return } + // Self account delete requires password to ensure it's for real. if form.Password == "" { err = errors.New("no password provided in account delete request") apiutil.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGetV1) return } - form.DeleteOriginID = authed.Account.ID + if err := bcrypt.CompareHashAndPassword([]byte(authed.User.EncryptedPassword), []byte(form.Password)); err != nil { + err = errors.New("invalid password provided in account delete request") + apiutil.ErrorHandler(c, gtserror.NewErrorForbidden(err, err.Error()), m.processor.InstanceGetV1) + return + } - if errWithCode := m.processor.Account().DeleteLocal(c.Request.Context(), authed.Account, form); errWithCode != nil { + if errWithCode := m.processor.Account().DeleteSelf(c.Request.Context(), authed.Account); errWithCode != nil { apiutil.ErrorHandler(c, errWithCode, m.processor.InstanceGetV1) return } diff --git a/internal/api/client/bookmarks/bookmarks_test.go b/internal/api/client/bookmarks/bookmarks_test.go index df9d83339..6f20c4762 100644 --- a/internal/api/client/bookmarks/bookmarks_test.go +++ b/internal/api/client/bookmarks/bookmarks_test.go @@ -275,7 +275,7 @@ func (suite *BookmarkTestSuite) TestGetBookmarksNone() { testUser := suite.testUsers["local_account_1"] // Remove all bookmarks for this account. - if err := suite.db.DeleteWhere(context.Background(), []db.Where{{Key: "account_id", Value: testAccount.ID}}, &[]*gtsmodel.StatusBookmark{}); err != nil { + if err := suite.db.DeleteStatusBookmarks(context.Background(), "", testAccount.ID); err != nil { suite.FailNow(err.Error()) } diff --git a/internal/api/client/statuses/statusfave_test.go b/internal/api/client/statuses/statusfave_test.go index 6b6890c42..ebe4603a8 100644 --- a/internal/api/client/statuses/statusfave_test.go +++ b/internal/api/client/statuses/statusfave_test.go @@ -123,7 +123,7 @@ func (suite *StatusFaveTestSuite) TestPostUnfaveable() { defer result.Body.Close() b, err := ioutil.ReadAll(result.Body) assert.NoError(suite.T(), err) - assert.Equal(suite.T(), `{"error":"Forbidden"}`, string(b)) + assert.Equal(suite.T(), `{"error":"Forbidden: status is not faveable"}`, string(b)) } func TestStatusFaveTestSuite(t *testing.T) { |