Merge branch 'security/PleromaAPI-delete' into 'develop'HEADdevelop

CommonAPI: generate ModerationLog for all admin/moderator deletes

See merge request pleroma/pleroma!3765

3 files changed, 16 insertions, 13 deletions

diff --git a/lib/pleroma/web/admin_api/controllers/chat_controller.ex b/lib/pleroma/web/admin_api/controllers/chat_controller.ex
index c3e9e12ce..298543fcf 100644
--- a/lib/pleroma/web/admin_api/controllers/chat_controller.ex
+++ b/lib/pleroma/web/admin_api/controllers/chat_controller.ex
@@ -8,7 +8,6 @@ defmodule Pleroma.Web.AdminAPI.ChatController do
   alias Pleroma.Activity
   alias Pleroma.Chat
   alias Pleroma.Chat.MessageReference
-  alias Pleroma.ModerationLog
   alias Pleroma.Pagination
   alias Pleroma.Web.AdminAPI
   alias Pleroma.Web.CommonAPI
@@ -42,12 +41,6 @@ defmodule Pleroma.Web.AdminAPI.ChatController do
          ^chat_id <- to_string(cm_ref.chat_id),
          %Activity{id: activity_id} <- Activity.get_create_by_object_ap_id(object_ap_id),
          {:ok, _} <- CommonAPI.delete(activity_id, user) do
-      ModerationLog.insert_log(%{
-        action: "chat_message_delete",
-        actor: user,
-        subject_id: message_id
-      })
-
       conn
       |> put_view(MessageReferenceView)
       |> render("show.json", chat_message_reference: cm_ref)
diff --git a/lib/pleroma/web/admin_api/controllers/status_controller.ex b/lib/pleroma/web/admin_api/controllers/status_controller.ex
index c9a4bfde9..9a3d49b57 100644
--- a/lib/pleroma/web/admin_api/controllers/status_controller.ex
+++ b/lib/pleroma/web/admin_api/controllers/status_controller.ex
@@ -65,12 +65,6 @@ defmodule Pleroma.Web.AdminAPI.StatusController do
 
   def delete(%{assigns: %{user: user}} = conn, %{id: id}) do
     with {:ok, %Activity{}} <- CommonAPI.delete(id, user) do
-      ModerationLog.insert_log(%{
-        action: "status_delete",
-        actor: user,
-        subject_id: id
-      })
-
       json(conn, %{})
     end
   end
diff --git a/lib/pleroma/web/common_api.ex b/lib/pleroma/web/common_api.ex
index 89f5dd606..62ab6b69c 100644
--- a/lib/pleroma/web/common_api.ex
+++ b/lib/pleroma/web/common_api.ex
@@ -6,6 +6,7 @@ defmodule Pleroma.Web.CommonAPI do
   alias Pleroma.Activity
   alias Pleroma.Conversation.Participation
   alias Pleroma.Formatter
+  alias Pleroma.ModerationLog
   alias Pleroma.Object
   alias Pleroma.ThreadMute
   alias Pleroma.User
@@ -147,6 +148,21 @@ defmodule Pleroma.Web.CommonAPI do
          true <- User.superuser?(user) || user.ap_id == object.data["actor"],
          {:ok, delete_data, _} <- Builder.delete(user, object.data["id"]),
          {:ok, delete, _} <- Pipeline.common_pipeline(delete_data, local: true) do
+      if User.superuser?(user) and user.ap_id != object.data["actor"] do
+        action =
+          if object.data["type"] == "ChatMessage" do
+            "chat_message_delete"
+          else
+            "status_delete"
+          end
+
+        ModerationLog.insert_log(%{
+          action: action,
+          actor: user,
+          subject_id: activity_id
+        })
+      end
+
       {:ok, delete}
     else
       {:find_activity, _} ->