From af9dfdce6b502d3a33db7a496879dda56719f56e Mon Sep 17 00:00:00 2001
From: Ivan Tashkinov <ivantashkinov@gmail.com>
Date: Sun, 17 May 2020 08:46:43 +0300
Subject: MediaController OAuth scope assignments fix. Typo fix (`def
 get_media` instead of `def show`).

---
 lib/pleroma/web/mastodon_api/controllers/media_controller.ex | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'lib')

diff --git a/lib/pleroma/web/mastodon_api/controllers/media_controller.ex b/lib/pleroma/web/mastodon_api/controllers/media_controller.ex
index a21233393..afa8b2ea2 100644
--- a/lib/pleroma/web/mastodon_api/controllers/media_controller.ex
+++ b/lib/pleroma/web/mastodon_api/controllers/media_controller.ex
@@ -14,7 +14,8 @@ defmodule Pleroma.Web.MastodonAPI.MediaController do
   plug(Pleroma.Web.ApiSpec.CastAndValidate)
   plug(:put_view, Pleroma.Web.MastodonAPI.StatusView)
 
-  plug(OAuthScopesPlug, %{scopes: ["write:media"]})
+  plug(OAuthScopesPlug, %{scopes: ["read:media"]} when action == :show)
+  plug(OAuthScopesPlug, %{scopes: ["write:media"]} when action != :show)
 
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.MediaOperation
 
@@ -65,6 +66,7 @@ defmodule Pleroma.Web.MastodonAPI.MediaController do
 
   def update(conn, data), do: show(conn, data)
 
+  # TODO: clarify: is the access to non-owned objects granted intentionally?
   @doc "GET /api/v1/media/:id"
   def show(conn, %{id: id}) do
     with %Object{data: data, id: object_id} <- Object.get_by_id(id) do
@@ -74,5 +76,5 @@ defmodule Pleroma.Web.MastodonAPI.MediaController do
     end
   end
 
-  def get_media(_conn, _data), do: {:error, :bad_request}
+  def show(_conn, _data), do: {:error, :bad_request}
 end
-- 
cgit v1.2.3


From 9b765652649f8b6110bd70aa90b148a90057ff6a Mon Sep 17 00:00:00 2001
From: Ivan Tashkinov <ivantashkinov@gmail.com>
Date: Mon, 18 May 2020 09:51:53 +0300
Subject: MediaController: enforced owner-only access in :show action. Improved
 error response on denied access (now 403). Adjusted tests.

---
 lib/pleroma/object.ex                                     | 15 ++++++++++-----
 .../web/mastodon_api/controllers/fallback_controller.ex   |  4 ++++
 .../web/mastodon_api/controllers/media_controller.ex      |  8 ++++----
 3 files changed, 18 insertions(+), 9 deletions(-)

(limited to 'lib')

diff --git a/lib/pleroma/object.ex b/lib/pleroma/object.ex
index e678fd415..ab16bf2db 100644
--- a/lib/pleroma/object.ex
+++ b/lib/pleroma/object.ex
@@ -138,12 +138,17 @@ defmodule Pleroma.Object do
 
   def normalize(_, _, _), do: nil
 
-  # Owned objects can only be mutated by their owner
-  def authorize_mutation(%Object{data: %{"actor" => actor}}, %User{ap_id: ap_id}),
-    do: actor == ap_id
+  # Owned objects can only be accessed by their owner
+  def authorize_access(%Object{data: %{"actor" => actor}}, %User{ap_id: ap_id}) do
+    if actor == ap_id do
+      :ok
+    else
+      {:error, :forbidden}
+    end
+  end
 
-  # Legacy objects can be mutated by anybody
-  def authorize_mutation(%Object{}, %User{}), do: true
+  # Legacy objects can be accessed by anybody
+  def authorize_access(%Object{}, %User{}), do: :ok
 
   @spec get_cached_by_ap_id(String.t()) :: Object.t() | nil
   def get_cached_by_ap_id(ap_id) do
diff --git a/lib/pleroma/web/mastodon_api/controllers/fallback_controller.ex b/lib/pleroma/web/mastodon_api/controllers/fallback_controller.ex
index 0a257f604..8af557b61 100644
--- a/lib/pleroma/web/mastodon_api/controllers/fallback_controller.ex
+++ b/lib/pleroma/web/mastodon_api/controllers/fallback_controller.ex
@@ -20,6 +20,10 @@ defmodule Pleroma.Web.MastodonAPI.FallbackController do
     render_error(conn, :not_found, "Record not found")
   end
 
+  def call(conn, {:error, :forbidden}) do
+    render_error(conn, :forbidden, "Access denied")
+  end
+
   def call(conn, {:error, error_message}) do
     conn
     |> put_status(:bad_request)
diff --git a/lib/pleroma/web/mastodon_api/controllers/media_controller.ex b/lib/pleroma/web/mastodon_api/controllers/media_controller.ex
index afa8b2ea2..513de279f 100644
--- a/lib/pleroma/web/mastodon_api/controllers/media_controller.ex
+++ b/lib/pleroma/web/mastodon_api/controllers/media_controller.ex
@@ -56,7 +56,7 @@ defmodule Pleroma.Web.MastodonAPI.MediaController do
   @doc "PUT /api/v1/media/:id"
   def update(%{assigns: %{user: user}, body_params: %{description: description}} = conn, %{id: id}) do
     with %Object{} = object <- Object.get_by_id(id),
-         true <- Object.authorize_mutation(object, user),
+         :ok <- Object.authorize_access(object, user),
          {:ok, %Object{data: data}} <- Object.update_data(object, %{"name" => description}) do
       attachment_data = Map.put(data, "id", object.id)
 
@@ -66,10 +66,10 @@ defmodule Pleroma.Web.MastodonAPI.MediaController do
 
   def update(conn, data), do: show(conn, data)
 
-  # TODO: clarify: is the access to non-owned objects granted intentionally?
   @doc "GET /api/v1/media/:id"
-  def show(conn, %{id: id}) do
-    with %Object{data: data, id: object_id} <- Object.get_by_id(id) do
+  def show(%{assigns: %{user: user}} = conn, %{id: id}) do
+    with %Object{data: data, id: object_id} = object <- Object.get_by_id(id),
+         :ok <- Object.authorize_access(object, user) do
       attachment_data = Map.put(data, "id", object_id)
 
       render(conn, "attachment.json", %{attachment: attachment_data})
-- 
cgit v1.2.3