mirrors/mostlymatter
1
0
Форкнуть 0
Код Задачи Запросы на слияние Действия Пакеты Проекты Релизы Вики Активность

Move the sanitization and validation of CPA values to the model (#30653)

Просмотр исходного кода 
* Move the sanitization and validation of CPA values to the model

* Fix CI

* Use proper IDs instead of strings

---------

Co-authored-by: Miguel de la Cruz <miguel@ctrlz.es>
Co-authored-by: Mattermost Build <build@mattermost.com>
Этот коммит содержится в:
Miguel de la Cruz
2025-04-10 11:31:40 +02:00
коммит произвёл GitHub
родитель c7165c5ff2
Коммит 0c8e30da4d
7 изменённых файлов: 329 добавлений и 303 удалений
Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

104
server/channels/api4/custom_profile_attributes.go
Просмотреть файл

@@ -5,9 +5,7 @@ package api4
import (
"encoding/json"
"fmt"
"net/http"
"net/url"
"strings"
"github.com/mattermost/mattermost/server/public/model"
@@ -202,76 +200,6 @@ func getCPAGroup(c *Context, w http.ResponseWriter, r *http.Request) {
}
}
func sanitizePropertyValue(cpaField *model.CPAField, rawValue json.RawMessage) (json.RawMessage, error) {
fieldType := cpaField.Type
// build a list of existing options so we can check later if the values exist
optionsMap := map[string]struct{}{}
for _, v := range cpaField.Attrs.Options {
optionsMap[v.ID] = struct{}{}
}
switch fieldType {
case model.PropertyFieldTypeText, model.PropertyFieldTypeDate, model.PropertyFieldTypeSelect, model.PropertyFieldTypeUser:
var value string
if err := json.Unmarshal(rawValue, &value); err != nil {
return nil, err
}
value = strings.TrimSpace(value)
if fieldType == model.PropertyFieldTypeText {
if cpaField.Attrs.ValueType == model.CustomProfileAttributesValueTypeEmail && !model.IsValidEmail(value) {
return nil, fmt.Errorf("invalid email")
}
if cpaField.Attrs.ValueType == model.CustomProfileAttributesValueTypeURL {
_, err := url.Parse(value)
if err != nil {
return nil, fmt.Errorf("invalid url: %w", err)
}
}
}
if fieldType == model.PropertyFieldTypeSelect && value != "" {
if _, ok := optionsMap[value]; !ok {
return nil, fmt.Errorf("option \"%s\" does not exist", value)
}
}
if fieldType == model.PropertyFieldTypeUser && value != "" && !model.IsValidId(value) {
return nil, fmt.Errorf("invalid user id")
}
return json.Marshal(value)
case model.PropertyFieldTypeMultiselect, model.PropertyFieldTypeMultiuser:
var values []string
if err := json.Unmarshal(rawValue, &values); err != nil {
return nil, err
}
filteredValues := make([]string, 0, len(values))
for _, v := range values {
trimmed := strings.TrimSpace(v)
if trimmed == "" {
continue
}
if fieldType == model.PropertyFieldTypeMultiselect {
if _, ok := optionsMap[v]; !ok {
return nil, fmt.Errorf("option \"%s\" does not exist", v)
}
}
if fieldType == model.PropertyFieldTypeMultiuser && !model.IsValidId(trimmed) {
return nil, fmt.Errorf("invalid user id: %s", trimmed)
}
filteredValues = append(filteredValues, trimmed)
}
return json.Marshal(filteredValues)
default:
return nil, fmt.Errorf("unknown field type: %s", fieldType)
}
}
func patchCPAValues(c *Context, w http.ResponseWriter, r *http.Request) {
if !model.MinimumEnterpriseLicense(c.App.Channels().License()) {
c.Err = model.NewAppError("Api4.patchCPAValues", "api.custom_profile_attributes.license_error", nil, "", http.StatusForbidden)
@@ -296,39 +224,9 @@ func patchCPAValues(c *Context, w http.ResponseWriter, r *http.Request) {
defer c.LogAuditRec(auditRec)
audit.AddEventParameter(auditRec, "user_id", userID)
// Get all fields at once and build a map for quick lookup
allFields, appErr := c.App.ListCPAFields()
if appErr != nil {
c.Err = appErr
return
}
fieldMap := make(map[string]*model.PropertyField)
for _, field := range allFields {
fieldMap[field.ID] = field
}
results := make(map[string]json.RawMessage, len(updates))
for fieldID, rawValue := range updates {
field, ok := fieldMap[fieldID]
if !ok {
c.Err = model.NewAppError("Api4.patchCPAValues", "api.custom_profile_attributes.field_not_found", nil, "", http.StatusBadRequest)
return
}
cpaField, err := model.NewCPAFieldFromPropertyField(field)
if err != nil {
c.Err = model.NewAppError("Api4.patchCPAValues", "api.custom_profile_attributes.field_conversion_error", nil, "", http.StatusInternalServerError)
return
}
sanitizedValue, err := sanitizePropertyValue(cpaField, rawValue)
if err != nil {
c.SetInvalidParam(fmt.Sprintf("value for field %s: %v", fieldID, err))
return
}
patchedValue, appErr := c.App.PatchCPAValue(userID, fieldID, sanitizedValue)
patchedValue, appErr := c.App.PatchCPAValue(userID, fieldID, rawValue)
if appErr != nil {
c.Err = appErr
return