ProjectLighthouse/ProjectLighthouse.Servers.Website/Pages/Moderation/NewCasePage.cshtml.cs
koko 2a85b6a136
Disallow moderators/administrators from issuing cases against each other (#781)
* Disallow moderators/administrators from issuing cases against each other

* Resolve suggestions from reviewers

* Only request user from db if id is valid
2023-06-05 21:45:25 +00:00

76 lines
No EOL
2.6 KiB
C#

using LBPUnion.ProjectLighthouse.Database;
using LBPUnion.ProjectLighthouse.Localization.StringLists;
using LBPUnion.ProjectLighthouse.Servers.Website.Pages.Layouts;
using LBPUnion.ProjectLighthouse.Types.Entities.Moderation;
using LBPUnion.ProjectLighthouse.Types.Entities.Profile;
using LBPUnion.ProjectLighthouse.Types.Moderation.Cases;
using Microsoft.AspNetCore.Mvc;
using Microsoft.EntityFrameworkCore;
namespace LBPUnion.ProjectLighthouse.Servers.Website.Pages.Moderation;
public class NewCasePage : BaseLayout
{
public NewCasePage(DatabaseContext database) : base(database)
{}
public CaseType Type { get; set; }
public int AffectedId { get; set; }
public string? Error { get; private set; }
public IActionResult OnGet([FromQuery] CaseType? type, [FromQuery] int? affectedId)
{
UserEntity? user = this.Database.UserFromWebRequest(this.Request);
if (user == null || !user.IsModerator) return this.Redirect("/login");
if (type == null) return this.BadRequest();
if (affectedId == null) return this.BadRequest();
this.Type = type.Value;
this.AffectedId = affectedId.Value;
return this.Page();
}
public async Task<IActionResult> OnPost(CaseType? type, string? reason, string? modNotes, DateTime expires, int? affectedId)
{
UserEntity? user = this.Database.UserFromWebRequest(this.Request);
if (user == null || !user.IsModerator) return this.Redirect("/login");
if (type == null) return this.BadRequest();
if (affectedId == null) return this.BadRequest();
reason ??= string.Empty;
modNotes ??= string.Empty;
// if id is invalid then return bad request
if (!await type.Value.IsIdValid((int)affectedId, this.Database)) return this.BadRequest();
UserEntity? affectedUserEntity =
await this.Database.Users.FirstOrDefaultAsync(u => u.UserId == affectedId.Value);
if (affectedUserEntity?.IsModerator ?? false)
{
this.Error = this.Translate(ErrorStrings.ActionNoPermission);
return this.Page();
}
ModerationCaseEntity @case = new()
{
Type = type.Value,
Reason = reason,
ModeratorNotes = modNotes,
ExpiresAt = expires,
CreatedAt = DateTime.Now,
CreatorId = user.UserId,
CreatorUsername = user.Username,
AffectedId = affectedId.Value,
};
this.Database.Cases.Add(@case);
await this.Database.SaveChangesAsync();
return this.Redirect("/moderation/cases/0");
}
}