From e5d8ef83eab056cd180e4c1241e43a6f25e9faf4 Mon Sep 17 00:00:00 2001
From: Thomas Sileo <t@a4.io>
Date: Thu, 15 Aug 2019 17:09:17 +0200
Subject: [PATCH] Hide senstive content and fix image caching

---
 blueprints/admin.py   | 29 ++++++++++++++---------------
 blueprints/tasks.py   | 10 ++--------
 sass/base_theme.scss  | 14 ++++++++++++++
 templates/lookup.html |  7 +++----
 templates/utils.html  | 13 +++++++++++++
 5 files changed, 46 insertions(+), 27 deletions(-)

diff --git a/blueprints/admin.py b/blueprints/admin.py
index 457ffb3..eadf329 100644
--- a/blueprints/admin.py
+++ b/blueprints/admin.py
@@ -167,27 +167,26 @@ def admin_tasks() -> _Response:
     )
 
 
-@blueprint.route("/admin/lookup", methods=["GET", "POST"])
+@blueprint.route("/admin/lookup", methods=["GET"])
 @login_required
 def admin_lookup() -> _Response:
     data = None
     meta = None
-    if request.method == "POST":
-        if request.form.get("url"):
-            data = lookup(request.form.get("url"))  # type: ignore
-            if data:
-                if data.has_type(ap.ActivityType.ANNOUNCE):
-                    meta = dict(
-                        object=data.get_object().to_dict(),
-                        object_actor=data.get_object().get_actor().to_dict(),
-                        actor=data.get_actor().to_dict(),
-                    )
+    if request.args.get("url"):
+        data = lookup(request.args.get("url"))  # type: ignore
+        if data:
+            if data.has_type(ap.ActivityType.ANNOUNCE):
+                meta = dict(
+                    object=data.get_object().to_dict(),
+                    object_actor=data.get_object().get_actor().to_dict(),
+                    actor=data.get_actor().to_dict(),
+                )
 
-                elif data.has_type(ap.ActivityType.QUESTION):
-                    p.push(data.id, "/task/fetch_remote_question")
+            elif data.has_type(ap.ActivityType.QUESTION):
+                p.push(data.id, "/task/fetch_remote_question")
 
-            print(data)
-            app.logger.debug(data.to_dict())
+        print(data)
+        app.logger.debug(data.to_dict())
     return render_template(
         "lookup.html", data=data, meta=meta, url=request.form.get("url")
     )
diff --git a/blueprints/tasks.py b/blueprints/tasks.py
index 154b39a..1354d73 100644
--- a/blueprints/tasks.py
+++ b/blueprints/tasks.py
@@ -243,7 +243,7 @@ def task_cache_attachments() -> _Response:
     iri = task.payload
     try:
         activity = ap.fetch_remote_activity(iri)
-        app.logger.info(f"activity={activity!r}")
+        app.logger.info(f"caching attachment for activity={activity!r}")
         # Generates thumbnails for the actor's icon and the attachments if any
 
         obj = activity.get_object()
@@ -310,13 +310,7 @@ def task_cache_actor() -> _Response:
         if not activity.has_type([ap.ActivityType.CREATE, ap.ActivityType.ANNOUNCE]):
             return ""
 
-        if (
-            activity.has_type(ap.ActivityType.CREATE)
-            and activity.get_object()._data.get("attachment", [])
-        ) or (
-            activity.has_type(ap.ActivityType.ANNOUNCE)
-            and activity.get_object().has_type(ap.ActivityType.VIDEO)
-        ):
+        if activity.get_object()._data.get("attachment", []) or activity.get_object().has_type(ap.ActivityType.VIDEO):
             Tasks.cache_attachments(iri)
 
     except (ActivityGoneError, ActivityNotFoundError):
diff --git a/sass/base_theme.scss b/sass/base_theme.scss
index 03a42a4..d8bf0f9 100644
--- a/sass/base_theme.scss
+++ b/sass/base_theme.scss
@@ -295,6 +295,20 @@ a:hover {
   background: inherit;
   cursor: default;
 }
+.bar-item-reverse {
+  background: $primary-color;
+  color: $background-color;
+  padding: 5px;
+  margin-right: 10px;
+  float: left;
+  border-radius:2px;
+  border: 0;
+}
+.bar-item-reverse:hover {
+  background: $color-menu-background;
+  color: $color-light;
+}
+
 button.bar-item {
   border: 0
 }
diff --git a/templates/lookup.html b/templates/lookup.html
index 52e7b20..07873c2 100644
--- a/templates/lookup.html
+++ b/templates/lookup.html
@@ -6,10 +6,9 @@
 {% include "header.html" %}
 <div style="margin-top:50px;">
 
-<form id="lookup-form" method="POST">
-	 <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
-     <input type="text" name="url" value="{{url or '' }}" placeholder="https://url-of-a-user-or-a-note.tld">
-	<input type="submit" value="Lookup">
+<form id="lookup-form" method="GET">
+ <input type="text" name="url" value="{{url or '' }}" placeholder="https://url-of-a-user-or-a-note.tld">
+<input type="submit" value="Lookup">
 </form>
 
 {% if data %}
diff --git a/templates/utils.html b/templates/utils.html
index 7b4b1bd..64ce7dc 100644
--- a/templates/utils.html
+++ b/templates/utils.html
@@ -151,6 +151,17 @@
 
 	{% if obj.attachment and obj | has_type('Note') %}
 	<div style="padding:20px 0;">
+
+ {% if obj.sensitive and not request.args.get("show_sensitive") == perma_id %}
+ <div style="clear:both">
+ <form action="{{redir}}" class="action-form"  method="GET" style="display:inline-block">
+<input type="hidden" name="show_sensitive" value="{{perma_id}}">
+<input type="hidden" name="url" value="{{obj.id}}">
+<button type="submit" class="bar-item-reverse">display sensitive content</button>
+</form>
+ </div>
+ {% else %}
+
 	{% if obj.attachment | not_only_imgs %}
 	<h3 class="l">Attachments</h3>
 	<ul style="padding:0;">
@@ -167,6 +178,8 @@
 	{% if obj.attachment | not_only_imgs %}
 	</ul>
 	{% endif %}
+
+{% endif %}
 </div>
 	{% endif %}