Merge branch 'dtluna/pleroma-bugfix/deny-empty-posts' into develop

lib/pleroma/web/twitter_api/twitter_api_controller.ex

@@ -12,11 +12,23 @@ def verify_credentials(%{assigns: %{user: user}} = conn, _params) do
     |> json_reply(200, response)
   end
 
-  def status_update(%{assigns: %{user: user}} = conn, status_data) do
+  def status_update(%{assigns: %{user: user}} = conn, %{"status" => status_text} = status_data) do
-    media_ids = extract_media_ids(status_data)
+    if status_text |> String.trim |> String.length != 0 do
-    {:ok, activity} = TwitterAPI.create_status(user, Map.put(status_data, "media_ids",  media_ids ))
+      media_ids = extract_media_ids(status_data)
-    conn
+      {:ok, activity} = TwitterAPI.create_status(user, Map.put(status_data, "media_ids",  media_ids ))
-    |> json_reply(200, ActivityRepresenter.to_json(activity, %{user: user}))
+      conn
+      |> json_reply(200, ActivityRepresenter.to_json(activity, %{user: user}))
+    else
+      empty_status_reply(conn)
+    end
+  end
+
+  def status_update(conn, _status_data) do
+    empty_status_reply(conn)
+  end
+
+  defp empty_status_reply(conn) do
+    bad_request_reply(conn, "Client must provide a 'status' parameter with a value.")
   end
 
   defp extract_media_ids(status_data) do
@@ -182,7 +194,7 @@ def update_avatar(%{assigns: %{user: user}} = conn, params) do
   end
 
   defp bad_request_reply(conn, error_message) do
-    json = Poison.encode!(%{"error" => error_message})
+    json = error_json(conn, error_message)
     json_reply(conn, 400, json)
   end
 
@@ -193,9 +205,11 @@ defp json_reply(conn, status, json) do
   end
 
   defp forbidden_json_reply(conn, error_message) do
-    json = %{"error" => error_message, "request" => conn.request_path}
+    json = error_json(conn, error_message)
-    |> Poison.encode!
-
     json_reply(conn, 403, json)
   end
+
+  defp error_json(conn, error_message) do
+    %{"error" => error_message, "request" => conn.request_path} |> Poison.encode!
+  end
 end

test/web/twitter_api/twitter_api_controller_test.exs

@@ -31,10 +31,21 @@ test "without valid credentials", %{conn: conn} do
     end
 
     test "with credentials", %{conn: conn, user: user} do
-      conn = conn
+      conn_with_creds = conn |> with_credentials(user.nickname, "test")
-        |> with_credentials(user.nickname, "test")
+      request_path = "/api/statuses/update.json"
-        |> post("/api/statuses/update.json", %{ status: "Nice meme." })
 
+      error_response = %{"request" => request_path,
+                         "error" => "Client must provide a 'status' parameter with a value."}
+      conn = conn_with_creds |> post(request_path)
+      assert json_response(conn, 400) == error_response
+
+      conn = conn_with_creds |> post(request_path, %{ status: "" })
+      assert json_response(conn, 400) == error_response
+
+      conn = conn_with_creds |> post(request_path, %{ status: " " })
+      assert json_response(conn, 400) == error_response
+
+      conn =  conn_with_creds |> post(request_path, %{ status: "Nice meme." })
       assert json_response(conn, 200) == ActivityRepresenter.to_map(Repo.one(Activity), %{user: user})
     end
   end
@@ -139,7 +150,7 @@ test "with credentials", %{conn: conn, user: current_user} do
     setup [:valid_user]
     test "without any params", %{conn: conn} do
       conn = get(conn, "/api/statuses/user_timeline.json")
-      assert json_response(conn, 400) == %{"error" => "You need to specify screen_name or user_id"}
+      assert json_response(conn, 400) == %{"error" => "You need to specify screen_name or user_id", "request" => "/api/statuses/user_timeline.json"}
     end
 
     test "with user_id", %{conn: conn} do