From fb2a9285d297e457a87049c8d7723ac936cb81be Mon Sep 17 00:00:00 2001
From: trisua <me@trisua.com>
Date: Tue, 20 May 2025 23:30:40 -0400
Subject: [PATCH] fix: don't allow user display name to be over 32 chars

---
 .../public/html/communities/create_post.html  | 135 +-----------------
 crates/app/src/public/html/components.html    | 133 ++++++++++++++++-
 crates/app/src/public/html/misc/requests.html |  11 +-
 crates/app/src/routes/api/v1/auth/profile.rs  |   5 +
 4 files changed, 145 insertions(+), 139 deletions(-)

diff --git a/crates/app/src/public/html/communities/create_post.html b/crates/app/src/public/html/communities/create_post.html
index 5aec044..55e44bc 100644
--- a/crates/app/src/public/html/communities/create_post.html
+++ b/crates/app/src/public/html/communities/create_post.html
@@ -112,21 +112,7 @@
                     <div id="files_list" class="flex gap-2 flex-wrap"></div>
 
                     <div class="flex justify-between gap-2">
-                        <div class="flex gap-2">
-                            {{ components::emoji_picker(element_id="content",
-                            render_dialog=true) }} {% if is_supporter -%} {{
-                            components::file_picker(files_list_id="files_list")
-                            }} {%- endif %}
-
-                            <button
-                                class="small square quaternary"
-                                title="More options"
-                                onclick="document.getElementById('post_options_dialog').showModal()"
-                                type="button"
-                            >
-                                {{ icon "ellipsis" }}
-                            </button>
-                        </div>
+                        {{ components::create_post_options() }}
 
                         <div class="flex gap-2">
                             {% if draft -%}
@@ -199,26 +185,7 @@
 
                             if (res.ok) {
                                 // update settings
-                                if (
-                                    JSON.stringify(
-                                        window.POST_INITIAL_SETTINGS,
-                                    ) !== window.BLANK_INITIAL_SETTINGS
-                                ) {
-                                    await fetch(
-                                        `/api/v1/posts/${res.payload}/context`,
-                                        {
-                                            method: "POST",
-                                            headers: {
-                                                "Content-Type":
-                                                    "application/json",
-                                            },
-                                            body: JSON.stringify({
-                                                context:
-                                                    window.POST_INITIAL_SETTINGS,
-                                            }),
-                                        },
-                                    );
-                                }
+                                await update_settings_maybe(res.payload);
 
                                 // remove draft
                                 // {% if draft -%}
@@ -423,102 +390,4 @@
         window.history.back();
     }
 </script>
-
-<dialog id="post_options_dialog">
-    <div class="inner flex flex-col gap-2">
-        <div id="post_options" class="flex flex-col gap-2"></div>
-
-        <hr />
-
-        <div class="flex justify-between">
-            <div></div>
-
-            <div class="flex gap-2">
-                <button
-                    class="bold red quaternary"
-                    onclick="document.getElementById('post_options_dialog').close()"
-                    type="button"
-                >
-                    {{ icon "x" }} {{ text "dialog:action.close" }}
-                </button>
-            </div>
-        </div>
-
-        <script>
-            setTimeout(() => {
-                window.POST_INITIAL_SETTINGS = {
-                    comments_enabled: true,
-                    reposts_enabled: true,
-                    reactions_enabled: true,
-                    is_nsfw: false,
-                    content_warning: "",
-                    tags: [],
-                };
-
-                window.BLANK_INITIAL_SETTINGS = JSON.stringify(
-                    window.POST_INITIAL_SETTINGS,
-                );
-
-                const settings_fields = [
-                    [
-                        [
-                            "comments_enabled",
-                            "Allow people to comment on your post",
-                        ],
-                        window.POST_INITIAL_SETTINGS.comments_enabled.toString(),
-                        "checkbox",
-                    ],
-                    [
-                        [
-                            "reposts_enabled",
-                            "Allow people to repost/quote your post",
-                        ],
-                        window.POST_INITIAL_SETTINGS.reposts_enabled.toString(),
-                        "checkbox",
-                    ],
-                    [
-                        [
-                            "reactions_enabled",
-                            "Allow people to like/dislike your post",
-                        ],
-                        window.POST_INITIAL_SETTINGS.reactions_enabled.toString(),
-                        "checkbox",
-                    ],
-                    [
-                        ["is_nsfw", "Hide from public timelines"],
-                        window.POST_INITIAL_SETTINGS.is_nsfw.toString(),
-                        "checkbox",
-                    ],
-                    [
-                        ["content_warning", "Content warning"],
-                        window.POST_INITIAL_SETTINGS.content_warning,
-                        "textarea",
-                    ],
-                    [
-                        ["tags", "Tags"],
-                        window.POST_INITIAL_SETTINGS.tags,
-                        "input",
-                        {
-                            embed_html:
-                                '<span class="fade">Tags should be separated by a comma.</span>',
-                        },
-                    ],
-                ];
-
-                trigger("ui::generate_settings_ui", [
-                    document.getElementById("post_options"),
-                    settings_fields,
-                    window.POST_INITIAL_SETTINGS,
-                    {
-                        tags: (new_tags) => {
-                            window.POST_INITIAL_SETTINGS.tags = new_tags
-                                .split(",")
-                                .map((t) => t.trim());
-                        },
-                    },
-                ]);
-            }, 250);
-        </script>
-    </div>
-</dialog>
 {% endblock %}
diff --git a/crates/app/src/public/html/components.html b/crates/app/src/public/html/components.html
index 310af6d..7f6b71d 100644
--- a/crates/app/src/public/html/components.html
+++ b/crates/app/src/public/html/components.html
@@ -1397,4 +1397,135 @@ is_supporter %}
         </a>
     </div>
 </div>
-{%- endif %} {%- endmacro %}
+{%- endif %} {%- endmacro %} {% macro create_post_options() -%}
+<div class="flex gap-2">
+    {{ components::emoji_picker(element_id="content", render_dialog=true) }} {%
+    if is_supporter -%} {{ components::file_picker(files_list_id="files_list")
+    }} {%- endif %}
+
+    <button
+        class="small square quaternary"
+        title="More options"
+        onclick="document.getElementById('post_options_dialog').showModal()"
+        type="button"
+    >
+        {{ icon "ellipsis" }}
+    </button>
+</div>
+
+<dialog id="post_options_dialog">
+    <div class="inner flex flex-col gap-2">
+        <div id="post_options" class="flex flex-col gap-2"></div>
+
+        <hr />
+
+        <div class="flex justify-between">
+            <div></div>
+
+            <div class="flex gap-2">
+                <button
+                    class="bold red quaternary"
+                    onclick="document.getElementById('post_options_dialog').close()"
+                    type="button"
+                >
+                    {{ icon "x" }} {{ text "dialog:action.close" }}
+                </button>
+            </div>
+        </div>
+
+        <script>
+            setTimeout(() => {
+                window.POST_INITIAL_SETTINGS = {
+                    comments_enabled: true,
+                    reposts_enabled: true,
+                    reactions_enabled: true,
+                    is_nsfw: false,
+                    content_warning: "",
+                    tags: [],
+                };
+
+                window.BLANK_INITIAL_SETTINGS = JSON.stringify(
+                    window.POST_INITIAL_SETTINGS,
+                );
+
+                const settings_fields = [
+                    [
+                        [
+                            "comments_enabled",
+                            "Allow people to comment on your post",
+                        ],
+                        window.POST_INITIAL_SETTINGS.comments_enabled.toString(),
+                        "checkbox",
+                    ],
+                    [
+                        [
+                            "reposts_enabled",
+                            "Allow people to repost/quote your post",
+                        ],
+                        window.POST_INITIAL_SETTINGS.reposts_enabled.toString(),
+                        "checkbox",
+                    ],
+                    [
+                        [
+                            "reactions_enabled",
+                            "Allow people to like/dislike your post",
+                        ],
+                        window.POST_INITIAL_SETTINGS.reactions_enabled.toString(),
+                        "checkbox",
+                    ],
+                    [
+                        ["is_nsfw", "Hide from public timelines"],
+                        window.POST_INITIAL_SETTINGS.is_nsfw.toString(),
+                        "checkbox",
+                    ],
+                    [
+                        ["content_warning", "Content warning"],
+                        window.POST_INITIAL_SETTINGS.content_warning,
+                        "textarea",
+                    ],
+                    [
+                        ["tags", "Tags"],
+                        window.POST_INITIAL_SETTINGS.tags,
+                        "input",
+                        {
+                            embed_html:
+                                '<span class="fade">Tags should be separated by a comma.</span>',
+                        },
+                    ],
+                ];
+
+                document.getElementById("post_options").innerHTML = "";
+                trigger("ui::generate_settings_ui", [
+                    document.getElementById("post_options"),
+                    settings_fields,
+                    window.POST_INITIAL_SETTINGS,
+                    {
+                        tags: (new_tags) => {
+                            window.POST_INITIAL_SETTINGS.tags = new_tags
+                                .split(",")
+                                .map((t) => t.trim());
+                        },
+                    },
+                ]);
+            }, 250);
+
+            globalThis.update_settings_maybe = async (id) => {
+                if (
+                    JSON.stringify(window.POST_INITIAL_SETTINGS) !==
+                    window.BLANK_INITIAL_SETTINGS
+                ) {
+                    await fetch(`/api/v1/posts/${id}/context`, {
+                        method: "POST",
+                        headers: {
+                            "Content-Type": "application/json",
+                        },
+                        body: JSON.stringify({
+                            context: window.POST_INITIAL_SETTINGS,
+                        }),
+                    });
+                }
+            };
+        </script>
+    </div>
+</dialog>
+{%- endmacro %}
diff --git a/crates/app/src/public/html/misc/requests.html b/crates/app/src/public/html/misc/requests.html
index c37370f..c1f2396 100644
--- a/crates/app/src/public/html/misc/requests.html
+++ b/crates/app/src/public/html/misc/requests.html
@@ -111,10 +111,7 @@
                     <div id="files_list" class="flex gap-2 flex-wrap"></div>
 
                     <div class="flex flex-wrap w-full gap-2">
-                        {{ components::emoji_picker(element_id="content",
-                        render_dialog=true) }} {% if is_supporter -%} {{
-                        components::file_picker(files_list_id="files_list") }}
-                        {%- endif %}
+                        {{ components::create_post_options() }}
 
                         <button class="primary">{{ text "requests:label.answer" }}</button>
                         <button type="button" class="red quaternary" onclick="trigger('me::remove_question', ['{{ question[0].id }}'])">{{ text "general:action.delete" }}</button>
@@ -199,13 +196,17 @@
             body,
         })
             .then((res) => res.json())
-            .then((res) => {
+            .then(async (res) => {
                 trigger("atto::toast", [
                     res.ok ? "success" : "error",
                     res.message,
                 ]);
 
                 if (res.ok) {
+                    // update settings
+                    await update_settings_maybe(res.payload);
+
+                    // ...
                     e.target.parentElement.remove();
                 }
             });
diff --git a/crates/app/src/routes/api/v1/auth/profile.rs b/crates/app/src/routes/api/v1/auth/profile.rs
index c8d7e7f..5c6c093 100644
--- a/crates/app/src/routes/api/v1/auth/profile.rs
+++ b/crates/app/src/routes/api/v1/auth/profile.rs
@@ -100,6 +100,11 @@ pub async fn update_user_settings_request(
         return Json(Error::NotAllowed.into());
     }
 
+    // check lengths
+    if req.display_name.len() > 32 {
+        return Json(Error::DataTooLong("display name".to_string()).into());
+    }
+
     // check percentage themes
     if !req.theme_sat.is_empty() && !req.theme_sat.ends_with("%") {
         req.theme_sat = format!("{}%", req.theme_sat)