Security experts agree that relational algorithms are an interesting new topic in the field of networking, and scholars concur.
", + "flags": ["read"], + "id": 16, + "display_recipient": + [ + { + "id": 4, + "is_mirror_dummy": false, + "email": "hamlet@zulip.com", + "full_name": "King Hamlet", + }, + { + "id": 5, + "is_mirror_dummy": false, + "email": "iago@zulip.com", + "full_name": "Iago", + }, + { + "id": 8, + "is_mirror_dummy": false, + "email": "prospero@zulip.com", + "full_name": "Prospero from The Tempest", + }, + ], + "content_type": "text/html", + "is_me_message": false, + "timestamp": 1527921326, + "sender_id": 4, + "sender_full_name": "King Hamlet", + "recipient_id": 27, + "topic_links": [], + "client": "populate_db", + "avatar_url": "https://secure.gravatar.com/avatar/6d8cad0fd00256e7b40691d27ddfd466?d=identicon&version=1", + "submessages": [], + "sender_email": "hamlet@zulip.com", + "reactions": [], + }, } "400": description: Bad request. diff --git a/zerver/tests/test_message_edit.py b/zerver/tests/test_message_edit.py index 7c8ebc1235..b6199e57f8 100644 --- a/zerver/tests/test_message_edit.py +++ b/zerver/tests/test_message_edit.py @@ -304,18 +304,57 @@ class EditMessageTest(EditMessageTestCase): self.assert_json_success(result) self.check_topic(msg_id, topic_name="edited") - def test_fetch_raw_message(self) -> None: + def test_fetch_message_from_id(self) -> None: self.login("hamlet") msg_id = self.send_personal_message( from_user=self.example_user("hamlet"), to_user=self.example_user("cordelia"), - content="**before** edit", + content="Personal message", ) - result = self.client_get(f"/json/messages/{msg_id}") + result = self.client_get("/json/messages/" + str(msg_id)) self.assert_json_success(result) - self.assertEqual(result.json()["raw_content"], "**before** edit") + self.assertEqual(result.json()["raw_content"], "Personal message") + self.assertEqual(result.json()["message"]["id"], msg_id) + + # Send message to web public stream where hamlet is not subscribed. + # This will test case of user having no `UserMessage` but having access + # to message. + web_public_stream = self.make_stream("web-public-stream", is_web_public=True) + self.subscribe(self.example_user("cordelia"), web_public_stream.name) + web_public_stream_msg_id = self.send_stream_message( + self.example_user("cordelia"), web_public_stream.name, content="web-public message" + ) + result = self.client_get("/json/messages/" + str(web_public_stream_msg_id)) + self.assert_json_success(result) + self.assertEqual(result.json()["raw_content"], "web-public message") + self.assertEqual(result.json()["message"]["id"], web_public_stream_msg_id) + + # Spectator should be able to fetch message in web public stream. + self.logout() + result = self.client_get("/json/messages/" + str(web_public_stream_msg_id)) + self.assert_json_success(result) + self.assertEqual(result.json()["raw_content"], "web-public message") + self.assertEqual(result.json()["message"]["id"], web_public_stream_msg_id) + + # Verify default is apply_markdown=True + self.assertEqual(result.json()["message"]["content"], "web-public message
") + + # Verify apply_markdown=False works correctly. + result = self.client_get( + "/json/messages/" + str(web_public_stream_msg_id), {"apply_markdown": "false"} + ) + self.assert_json_success(result) + self.assertEqual(result.json()["raw_content"], "web-public message") + self.assertEqual(result.json()["message"]["content"], "web-public message") + + with self.settings(WEB_PUBLIC_STREAMS_ENABLED=False): + result = self.client_get("/json/messages/" + str(web_public_stream_msg_id)) + self.assert_json_error( + result, "Not logged in: API authentication or user session required", status_code=401 + ) # Test error cases + self.login("hamlet") result = self.client_get("/json/messages/999999") self.assert_json_error(result, "Invalid message(s)") diff --git a/zerver/views/message_edit.py b/zerver/views/message_edit.py index ef136a5894..d4743ef580 100644 --- a/zerver/views/message_edit.py +++ b/zerver/views/message_edit.py @@ -12,7 +12,7 @@ from zerver.context_processors import get_valid_realm_from_request from zerver.lib.actions import check_update_message, do_delete_messages from zerver.lib.exceptions import JsonableError from zerver.lib.html_diff import highlight_html_differences -from zerver.lib.message import access_message, access_web_public_message +from zerver.lib.message import access_message, access_web_public_message, messages_for_ids from zerver.lib.request import REQ, RequestNotes, has_request_variables from zerver.lib.response import json_success from zerver.lib.timestamp import datetime_to_timestamp @@ -190,6 +190,7 @@ def json_fetch_raw_message( request: HttpRequest, maybe_user_profile: Union[UserProfile, AnonymousUser], message_id: int = REQ(converter=to_non_negative_int, path_only=True), + apply_markdown: bool = REQ(json_validator=check_bool, default=True), ) -> HttpResponse: if not maybe_user_profile.is_authenticated: @@ -198,4 +199,30 @@ def json_fetch_raw_message( else: (message, user_message) = access_message(maybe_user_profile, message_id) - return json_success(request, data={"raw_content": message.content}) + flags = ["read"] + if not maybe_user_profile.is_authenticated: + allow_edit_history = realm.allow_edit_history + else: + if user_message: + flags = user_message.flags_list() + allow_edit_history = maybe_user_profile.realm.allow_edit_history + + # Security note: It's important that we call this only with a + # message already fetched via `access_message` type methods, + # as we do above. + message_dict_list = messages_for_ids( + message_ids=[message.id], + user_message_flags={message_id: flags}, + search_fields={}, + apply_markdown=apply_markdown, + client_gravatar=True, + allow_edit_history=allow_edit_history, + ) + response = dict( + message=message_dict_list[0], + # raw_content is deprecated; we will need to wait until + # clients have been fully migrated to using the modern API + # before removing this, probably in 2023. + raw_content=message.content, + ) + return json_success(request, response)