diff options
Diffstat (limited to 'internal/api')
| -rw-r--r-- | internal/api/activitypub/users/userget_test.go | 6 | ||||
| -rw-r--r-- | internal/api/client/accounts/accountdelete.go | 10 | ||||
| -rw-r--r-- | internal/api/client/bookmarks/bookmarks_test.go | 2 | ||||
| -rw-r--r-- | internal/api/client/statuses/statusfave_test.go | 2 | ||||
| -rw-r--r-- | internal/api/model/account.go | 3 |
5 files changed, 11 insertions, 12 deletions
diff --git a/internal/api/activitypub/users/userget_test.go b/internal/api/activitypub/users/userget_test.go index 0da308684..ac8b2c0eb 100644 --- a/internal/api/activitypub/users/userget_test.go +++ b/internal/api/activitypub/users/userget_test.go @@ -30,7 +30,6 @@ import ( "github.com/superseriousbusiness/activity/streams" "github.com/superseriousbusiness/activity/streams/vocab" "github.com/superseriousbusiness/gotosocial/internal/api/activitypub/users" - apimodel "github.com/superseriousbusiness/gotosocial/internal/api/model" "github.com/superseriousbusiness/gotosocial/testrig" ) @@ -98,10 +97,7 @@ func (suite *UserGetTestSuite) TestGetUserPublicKeyDeleted() { userModule := users.New(suite.processor) targetAccount := suite.testAccounts["local_account_1"] - suite.processor.Account().DeleteLocal(context.Background(), suite.testAccounts["local_account_1"], &apimodel.AccountDeleteRequest{ - Password: "password", - DeleteOriginID: targetAccount.ID, - }) + suite.processor.Account().DeleteSelf(context.Background(), suite.testAccounts["local_account_1"]) // wait for the account delete to be processed if !testrig.WaitFor(func() bool { diff --git a/internal/api/client/accounts/accountdelete.go b/internal/api/client/accounts/accountdelete.go index 02a75b670..242902cab 100644 --- a/internal/api/client/accounts/accountdelete.go +++ b/internal/api/client/accounts/accountdelete.go @@ -26,6 +26,7 @@ import ( apiutil "github.com/superseriousbusiness/gotosocial/internal/api/util" "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/oauth" + "golang.org/x/crypto/bcrypt" ) // AccountDeletePOSTHandler swagger:operation POST /api/v1/accounts/delete accountDelete @@ -77,15 +78,20 @@ func (m *Module) AccountDeletePOSTHandler(c *gin.Context) { return } + // Self account delete requires password to ensure it's for real. if form.Password == "" { err = errors.New("no password provided in account delete request") apiutil.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGetV1) return } - form.DeleteOriginID = authed.Account.ID + if err := bcrypt.CompareHashAndPassword([]byte(authed.User.EncryptedPassword), []byte(form.Password)); err != nil { + err = errors.New("invalid password provided in account delete request") + apiutil.ErrorHandler(c, gtserror.NewErrorForbidden(err, err.Error()), m.processor.InstanceGetV1) + return + } - if errWithCode := m.processor.Account().DeleteLocal(c.Request.Context(), authed.Account, form); errWithCode != nil { + if errWithCode := m.processor.Account().DeleteSelf(c.Request.Context(), authed.Account); errWithCode != nil { apiutil.ErrorHandler(c, errWithCode, m.processor.InstanceGetV1) return } diff --git a/internal/api/client/bookmarks/bookmarks_test.go b/internal/api/client/bookmarks/bookmarks_test.go index df9d83339..6f20c4762 100644 --- a/internal/api/client/bookmarks/bookmarks_test.go +++ b/internal/api/client/bookmarks/bookmarks_test.go @@ -275,7 +275,7 @@ func (suite *BookmarkTestSuite) TestGetBookmarksNone() { testUser := suite.testUsers["local_account_1"] // Remove all bookmarks for this account. - if err := suite.db.DeleteWhere(context.Background(), []db.Where{{Key: "account_id", Value: testAccount.ID}}, &[]*gtsmodel.StatusBookmark{}); err != nil { + if err := suite.db.DeleteStatusBookmarks(context.Background(), "", testAccount.ID); err != nil { suite.FailNow(err.Error()) } diff --git a/internal/api/client/statuses/statusfave_test.go b/internal/api/client/statuses/statusfave_test.go index 6b6890c42..ebe4603a8 100644 --- a/internal/api/client/statuses/statusfave_test.go +++ b/internal/api/client/statuses/statusfave_test.go @@ -123,7 +123,7 @@ func (suite *StatusFaveTestSuite) TestPostUnfaveable() { defer result.Body.Close() b, err := ioutil.ReadAll(result.Body) assert.NoError(suite.T(), err) - assert.Equal(suite.T(), `{"error":"Forbidden"}`, string(b)) + assert.Equal(suite.T(), `{"error":"Forbidden: status is not faveable"}`, string(b)) } func TestStatusFaveTestSuite(t *testing.T) { diff --git a/internal/api/model/account.go b/internal/api/model/account.go index b4b325983..36138a618 100644 --- a/internal/api/model/account.go +++ b/internal/api/model/account.go @@ -206,9 +206,6 @@ type AccountFollowRequest struct { type AccountDeleteRequest struct { // Password of the account's user, for confirmation. Password string `form:"password" json:"password" xml:"password"` - // The origin of the delete account request. - // Can be the ID of the account owner, or the ID of an admin account. - DeleteOriginID string `form:"-" json:"-" xml:"-"` } // AccountRole models the role of an account. |