diff --git a/app/Http/Controllers/Api/ApiV1Controller.php b/app/Http/Controllers/Api/ApiV1Controller.php index 2da53762a..2041e341c 100644 --- a/app/Http/Controllers/Api/ApiV1Controller.php +++ b/app/Http/Controllers/Api/ApiV1Controller.php @@ -1665,7 +1665,7 @@ class ApiV1Controller extends Controller 'statuses' => [ 'characters_reserved_per_url' => 23, 'max_characters' => (int) config_cache('pixelfed.max_caption_length'), - 'max_media_attachments' => (int) config('pixelfed.max_album_length'), + 'max_media_attachments' => (int) config_cache('pixelfed.max_album_length'), ], ], ]; @@ -3308,9 +3308,9 @@ class ApiV1Controller extends Controller abort_unless($request->user()->tokenCan('write'), 403); $this->validate($request, [ - 'status' => 'nullable|string|max:' . config_cache('pixelfed.max_caption_length'), + 'status' => 'nullable|string|max:'.(int) config_cache('pixelfed.max_caption_length'), 'in_reply_to_id' => 'nullable', - 'media_ids' => 'sometimes|array|max:'.config_cache('pixelfed.max_album_length'), + 'media_ids' => 'sometimes|array|max:'.(int) config_cache('pixelfed.max_album_length'), 'sensitive' => 'nullable', 'visibility' => 'string|in:private,unlisted,public', 'spoiler_text' => 'sometimes|max:140', @@ -3436,7 +3436,7 @@ class ApiV1Controller extends Controller $mimes = []; foreach ($ids as $k => $v) { - if ($k + 1 > config_cache('pixelfed.max_album_length')) { + if ($k + 1 > (int) config_cache('pixelfed.max_album_length')) { continue; } $m = Media::whereUserId($user->id)->whereNull('status_id')->findOrFail($v); diff --git a/app/Http/Requests/Status/StoreStatusEditRequest.php b/app/Http/Requests/Status/StoreStatusEditRequest.php index aa9364ca6..e8e2d22f5 100644 --- a/app/Http/Requests/Status/StoreStatusEditRequest.php +++ b/app/Http/Requests/Status/StoreStatusEditRequest.php @@ -2,10 +2,10 @@ namespace App\Http\Requests\Status; -use Illuminate\Foundation\Http\FormRequest; use App\Media; use App\Status; use Closure; +use Illuminate\Foundation\Http\FormRequest; class StoreStatusEditRequest extends FormRequest { @@ -14,24 +14,25 @@ class StoreStatusEditRequest extends FormRequest */ public function authorize(): bool { - $profile = $this->user()->profile; - if($profile->status != null) { - return false; - } - if($profile->unlisted == true && $profile->cw == true) { - return false; - } - $types = [ - "photo", - "photo:album", - "photo:video:album", - "reply", - "text", - "video", - "video:album" - ]; - $scopes = ['public', 'unlisted', 'private']; - $status = Status::whereNull('reblog_of_id')->whereIn('type', $types)->whereIn('scope', $scopes)->find($this->route('id')); + $profile = $this->user()->profile; + if ($profile->status != null) { + return false; + } + if ($profile->unlisted == true && $profile->cw == true) { + return false; + } + $types = [ + 'photo', + 'photo:album', + 'photo:video:album', + 'reply', + 'text', + 'video', + 'video:album', + ]; + $scopes = ['public', 'unlisted', 'private']; + $status = Status::whereNull('reblog_of_id')->whereIn('type', $types)->whereIn('scope', $scopes)->find($this->route('id')); + return $status && $this->user()->profile_id === $status->profile_id; } @@ -47,18 +48,18 @@ class StoreStatusEditRequest extends FormRequest 'spoiler_text' => 'nullable|string|max:140', 'sensitive' => 'sometimes|boolean', 'media_ids' => [ - 'nullable', - 'required_without:status', - 'array', - 'max:' . config('pixelfed.max_album_length'), - function (string $attribute, mixed $value, Closure $fail) { - Media::whereProfileId($this->user()->profile_id) - ->where(function($query) { - return $query->whereNull('status_id') - ->orWhere('status_id', '=', $this->route('id')); - }) - ->findOrFail($value); - }, + 'nullable', + 'required_without:status', + 'array', + 'max:'.(int) config_cache('pixelfed.max_album_length'), + function (string $attribute, mixed $value, Closure $fail) { + Media::whereProfileId($this->user()->profile_id) + ->where(function ($query) { + return $query->whereNull('status_id') + ->orWhere('status_id', '=', $this->route('id')); + }) + ->findOrFail($value); + }, ], 'location' => 'sometimes|nullable', 'location.id' => 'sometimes|integer|min:1|max:128769',