From dfb552abfc62d57221e9333d23dc4db33bc1a23d Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Thu, 10 Jun 2021 00:38:22 -0400
Subject: [PATCH] prevent locked templates/models from being edited by non-mods

---
 .../endpoints/tts/edit_tts_model.rs           | 19 ++++++-------------
 .../endpoints/w2l/delete_w2l_template.rs      | 14 +++++++++++++-
 2 files changed, 19 insertions(+), 14 deletions(-)

diff --git a/src/http_server/endpoints/tts/edit_tts_model.rs b/src/http_server/endpoints/tts/edit_tts_model.rs
index 2b4a4d2be8..d4e69aa756 100644
--- a/src/http_server/endpoints/tts/edit_tts_model.rs
+++ b/src/http_server/endpoints/tts/edit_tts_model.rs
@@ -126,22 +126,15 @@ pub async fn edit_tts_model_handler(
   };
 
   // NB: Second set of permission checks
-  let mut editor_is_original_user = false;
-  let mut editor_is_moderator = false;
+  let is_author = model_record.creator_user_token == user_session.user_token;
+  let is_mod = user_session.can_edit_other_users_tts_models ;
 
-  if model_record.creator_user_token == user_session.user_token {
-    editor_is_original_user = true;
-  }
-
-  if user_session.can_edit_other_users_tts_models {
-    editor_is_moderator = true;
-  }
-
-  if !editor_is_original_user && !editor_is_moderator {
+  if !is_author && !is_mod {
+    warn!("user is not allowed to edit model: {}", user_session.user_token);
     return Err(EditTtsModelError::NotAuthorized);
   }
 
-  if !editor_is_moderator {
+  if !is_mod {
     if model_record.is_locked_from_user_modification || model_record.is_mod_disabled {
       return Err(EditTtsModelError::NotAuthorized);
     }
@@ -174,7 +167,7 @@ pub async fn edit_tts_model_handler(
 
   let ip_address = get_request_ip(&http_request);
 
-  let query_result = if editor_is_original_user {
+  let query_result = if is_author {
     // We need to store the IP address details.
     sqlx::query!(
         r#"
diff --git a/src/http_server/endpoints/w2l/delete_w2l_template.rs b/src/http_server/endpoints/w2l/delete_w2l_template.rs
index 203dd96468..5656bcb0e8 100644
--- a/src/http_server/endpoints/w2l/delete_w2l_template.rs
+++ b/src/http_server/endpoints/w2l/delete_w2l_template.rs
@@ -110,9 +110,13 @@ pub async fn delete_w2l_template_handler(
     }
   };
 
+  // NB: First permission check.
+  // Only mods should see deleted models (both user_* and mod_* deleted).
+  let is_mod_that_can_see_deleted = user_session.can_delete_other_users_w2l_templates;
+
   let template_query_result = select_w2l_template_by_token(
     &path.slug,
-    true, // Only mods can perform this action
+    is_mod_that_can_see_deleted,
     &server_state.mysql_pool,
   ).await;
 
@@ -125,6 +129,7 @@ pub async fn delete_w2l_template_handler(
     Ok(Some(template)) => template,
   };
 
+  // NB: Second set of permission checks
   let is_author = w2l_template.creator_user_token == user_session.user_token;
   let is_mod = user_session.can_delete_other_users_w2l_templates;
 
@@ -133,6 +138,12 @@ pub async fn delete_w2l_template_handler(
     return Err(DeleteW2lTemplateError::NotAuthorized);
   }
 
+  if !is_mod {
+    if w2l_template.is_locked_from_user_modification || w2l_template.is_mod_disabled {
+      return Err(DeleteW2lTemplateError::NotAuthorized);
+    }
+  }
+
   let ip_address = get_request_ip(&http_request);
 
   let query_result = if request.set_delete {
@@ -151,6 +162,7 @@ pub async fn delete_w2l_template_handler(
     }
   } else {
     if is_author {
+      // NB: Technically only mods can see their own templates here
       user_undelete_template(
         &path.slug,
         &user_session.user_token,