149d80a07d
* Initial plan * Initial analysis of inline chat moderation 500 error issue Co-authored-by: gabek <414923+gabek@users.noreply.github.com> * Fix inline chat moderation 500 errors by supporting Authorization header tokens - Modified RequireUserModerationScopeAccesstoken middleware to check both Authorization header (Bearer tokens) and URL query parameters - This fixes the issue where inline chat moderation from the web UI was failing with 500 errors - Maintains backward compatibility with existing code that uses query parameter tokens - The fix aligns the chat endpoint behavior with the integrations endpoint which already supported Bearer tokens Addresses the wiring issue between OpenAPI spec and API implementation identified in issue comments. Co-authored-by: gabek <414923+gabek@users.noreply.github.com> * Fix inline chat moderation 500 errors by adding nil pointer checks Co-authored-by: gabek <414923+gabek@users.noreply.github.com> * Fix nil pointer vulnerabilities across all OpenAPI endpoints Co-authored-by: gabek <414923+gabek@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: gabek <414923+gabek@users.noreply.github.com>
103 lines
2.5 KiB
Go
103 lines
2.5 KiB
Go
package admin
|
|
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
"net/http"
|
|
"os"
|
|
"path/filepath"
|
|
|
|
"github.com/owncast/owncast/config"
|
|
"github.com/owncast/owncast/utils"
|
|
"github.com/owncast/owncast/webserver/handlers/generated"
|
|
webutils "github.com/owncast/owncast/webserver/utils"
|
|
)
|
|
|
|
// UploadCustomEmoji allows POSTing a new custom emoji to the server.
|
|
func UploadCustomEmoji(w http.ResponseWriter, r *http.Request) {
|
|
if !requirePOST(w, r) {
|
|
return
|
|
}
|
|
|
|
emoji := new(generated.UploadCustomEmojiJSONBody)
|
|
|
|
if err := json.NewDecoder(r.Body).Decode(emoji); err != nil {
|
|
webutils.WriteSimpleResponse(w, false, err.Error())
|
|
return
|
|
}
|
|
|
|
if emoji.Data == nil {
|
|
webutils.WriteSimpleResponse(w, false, "data field is required")
|
|
return
|
|
}
|
|
|
|
if emoji.Name == nil {
|
|
webutils.WriteSimpleResponse(w, false, "name field is required")
|
|
return
|
|
}
|
|
|
|
bytes, _, err := utils.DecodeBase64Image(*emoji.Data)
|
|
if err != nil {
|
|
webutils.WriteSimpleResponse(w, false, err.Error())
|
|
return
|
|
}
|
|
|
|
// Prevent path traversal attacks
|
|
emojiFileName := filepath.Base(*emoji.Name)
|
|
targetPath := filepath.Join(config.CustomEmojiPath, emojiFileName)
|
|
|
|
err = os.MkdirAll(config.CustomEmojiPath, 0o700)
|
|
if err != nil {
|
|
webutils.WriteSimpleResponse(w, false, err.Error())
|
|
return
|
|
}
|
|
|
|
if utils.DoesFileExists(targetPath) {
|
|
webutils.WriteSimpleResponse(w, false, fmt.Sprintf("An emoji with the name %q already exists", emojiFileName))
|
|
return
|
|
}
|
|
|
|
if err = os.WriteFile(targetPath, bytes, 0o600); err != nil {
|
|
webutils.WriteSimpleResponse(w, false, err.Error())
|
|
return
|
|
}
|
|
|
|
webutils.WriteSimpleResponse(w, true, fmt.Sprintf("Emoji %q has been uploaded", emojiFileName))
|
|
}
|
|
|
|
// DeleteCustomEmoji deletes a custom emoji.
|
|
func DeleteCustomEmoji(w http.ResponseWriter, r *http.Request) {
|
|
if !requirePOST(w, r) {
|
|
return
|
|
}
|
|
|
|
type deleteEmoji struct {
|
|
Name string `json:"name"`
|
|
}
|
|
|
|
emoji := new(deleteEmoji)
|
|
|
|
if err := json.NewDecoder(r.Body).Decode(emoji); err != nil {
|
|
webutils.WriteSimpleResponse(w, false, err.Error())
|
|
return
|
|
}
|
|
|
|
targetPath := filepath.Join(config.CustomEmojiPath, emoji.Name)
|
|
|
|
if !filepath.IsLocal(targetPath) {
|
|
webutils.WriteSimpleResponse(w, false, "Emoji path is not valid")
|
|
return
|
|
}
|
|
|
|
if err := os.Remove(targetPath); err != nil {
|
|
if os.IsNotExist(err) {
|
|
webutils.WriteSimpleResponse(w, false, fmt.Sprintf("Emoji %q doesn't exist", emoji.Name))
|
|
} else {
|
|
webutils.WriteSimpleResponse(w, false, err.Error())
|
|
}
|
|
return
|
|
}
|
|
|
|
webutils.WriteSimpleResponse(w, true, fmt.Sprintf("Emoji %q has been deleted", emoji.Name))
|
|
}
|