From 10864527c48e5d51a1f4d435e41dc1702f560989 Mon Sep 17 00:00:00 2001
From: Shun Miyazawa <m0zurillex@gmail.com>
Date: Fri, 24 May 2024 09:24:55 +0000
Subject: [PATCH 1/8] Allow undefined

---
 apps/app/src/server/util/slack.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/apps/app/src/server/util/slack.js b/apps/app/src/server/util/slack.js
index 474acf0eacc..d1828574d9a 100644
--- a/apps/app/src/server/util/slack.js
+++ b/apps/app/src/server/util/slack.js
@@ -25,6 +25,10 @@ const prepareAttachmentTextForCreate = function(page, siteUrl) {
 };
 
 const prepareAttachmentTextForUpdate = function(page, siteUrl, previousRevision) {
+  if (previousRevision == null) {
+    return;
+  }
+
   const diff = require('diff');
   let diffText = '';
 

From 1e03b8f5856295ae25025ff5c54355069e86b2da Mon Sep 17 00:00:00 2001
From: Shun Miyazawa <m0zurillex@gmail.com>
Date: Mon, 27 May 2024 03:57:18 +0000
Subject: [PATCH 2/8] { isSlackEnabled: boolean } passed to the server side

---
 .../src/components/PageEditor/PageEditor.tsx  |  1 +
 apps/app/src/components/SavePageControls.tsx  | 22 ++++++++++---------
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/apps/app/src/components/PageEditor/PageEditor.tsx b/apps/app/src/components/PageEditor/PageEditor.tsx
index 8e703271687..d46fc8fabb8 100644
--- a/apps/app/src/components/PageEditor/PageEditor.tsx
+++ b/apps/app/src/components/PageEditor/PageEditor.tsx
@@ -68,6 +68,7 @@ declare global {
 export type SaveOptions = {
   wip: boolean,
   slackChannels: string,
+  isSlackEnabled: boolean,
   overwriteScopesOfDescendants?: boolean
 }
 export type Save = (
diff --git a/apps/app/src/components/SavePageControls.tsx b/apps/app/src/components/SavePageControls.tsx
index 6382baf28ef..ffa74bc07b1 100644
--- a/apps/app/src/components/SavePageControls.tsx
+++ b/apps/app/src/components/SavePageControls.tsx
@@ -35,30 +35,32 @@ declare global {
 const logger = loggerFactory('growi:SavePageControls');
 
 
-const SavePageButton = (props: {slackChannels: string, isDeviceLargerThanMd?: boolean}) => {
+const SavePageButton = (props: {slackChannels: string, isSlackEnabled?: boolean, isDeviceLargerThanMd?: boolean}) => {
 
   const { t } = useTranslation();
   const { data: _isWaitingSaveProcessing } = useWaitingSaveProcessing();
   const [isSavePageModalShown, setIsSavePageModalShown] = useState<boolean>(false);
 
-  const { slackChannels, isDeviceLargerThanMd } = props;
+  const { slackChannels, isSlackEnabled, isDeviceLargerThanMd } = props;
 
   const isWaitingSaveProcessing = _isWaitingSaveProcessing === true; // ignore undefined
 
   const save = useCallback(async(): Promise<void> => {
     // save
-    globalEmitter.emit('saveAndReturnToView', { wip: false, slackChannels });
-  }, [slackChannels]);
+    globalEmitter.emit('saveAndReturnToView', { wip: false, slackChannels, isSlackEnabled });
+  }, [isSlackEnabled, slackChannels]);
 
   const saveAndOverwriteScopesOfDescendants = useCallback(() => {
     // save
-    globalEmitter.emit('saveAndReturnToView', { wip: false, overwriteScopesOfDescendants: true, slackChannels });
-  }, [slackChannels]);
+    globalEmitter.emit('saveAndReturnToView', {
+      wip: false, overwriteScopesOfDescendants: true, slackChannels, isSlackEnabled,
+    });
+  }, [isSlackEnabled, slackChannels]);
 
   const saveAndMakeWip = useCallback(() => {
     // save
-    globalEmitter.emit('saveAndReturnToView', { wip: true, slackChannels });
-  }, [slackChannels]);
+    globalEmitter.emit('saveAndReturnToView', { wip: true, slackChannels, isSlackEnabled });
+  }, [isSlackEnabled, slackChannels]);
 
   const labelSubmitButton = t('Update');
   const labelOverwriteScopes = t('page_edit.overwrite_scopes', { operation: labelSubmitButton });
@@ -197,11 +199,11 @@ export const SavePageControls = (): JSX.Element | null => {
               )
             }
 
-            <SavePageButton slackChannels={slackChannels} isDeviceLargerThanMd />
+            <SavePageButton isSlackEnabled={isSlackEnabled} slackChannels={slackChannels} isDeviceLargerThanMd />
           </>
         ) : (
           <>
-            <SavePageButton slackChannels={slackChannels} />
+            <SavePageButton isSlackEnabled={isSlackEnabled} slackChannels={slackChannels} />
             <button
               type="button"
               className="btn btn-outline-neutral-secondary border-0 fs-5 p-0 ms-1 text-muted"

From 2cc7e7bba3eddc6a2a1a888f8ed688a67f6654fc Mon Sep 17 00:00:00 2001
From: Shun Miyazawa <m0zurillex@gmail.com>
Date: Mon, 27 May 2024 04:17:55 +0000
Subject: [PATCH 3/8] Pass IRevisionHasId equivalent value to
 userNotificationService.fire option

---
 apps/app/src/server/routes/apiv3/page/update-page.ts  | 11 ++++++-----
 .../app/src/server/service/user-notification/index.ts |  6 ++++--
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/apps/app/src/server/routes/apiv3/page/update-page.ts b/apps/app/src/server/routes/apiv3/page/update-page.ts
index 42b0c316fd3..cce786ae94a 100644
--- a/apps/app/src/server/routes/apiv3/page/update-page.ts
+++ b/apps/app/src/server/routes/apiv3/page/update-page.ts
@@ -80,7 +80,7 @@ export const updatePageHandlersFactory: UpdatePageHandlersFactory = (crowi) => {
   ];
 
 
-  async function postAction(req: UpdatePageRequest, res: ApiV3Response, updatedPage: PageDocument) {
+  async function postAction(req: UpdatePageRequest, res: ApiV3Response, updatedPage: PageDocument, previousRevision: IRevisionHasId | null) {
     // Reflect the updates in ydoc
     const origin = req.body.origin;
     if (origin === Origin.View || origin === undefined) {
@@ -111,10 +111,10 @@ export const updatePageHandlersFactory: UpdatePageHandlersFactory = (crowi) => {
     }
 
     // user notification
-    const { revisionId, isSlackEnabled, slackChannels } = req.body;
+    const { isSlackEnabled, slackChannels } = req.body;
     if (isSlackEnabled) {
       try {
-        const option = revisionId != null ? { previousRevision: revisionId } : undefined;
+        const option = previousRevision != null ? { previousRevision } : undefined;
         const results = await crowi.userNotificationService.fire(updatedPage, req.user, slackChannels, 'update', option);
         results.forEach((result) => {
           if (result.status === 'rejected') {
@@ -159,6 +159,7 @@ export const updatePageHandlersFactory: UpdatePageHandlersFactory = (crowi) => {
       }
 
       let updatedPage: PageDocument;
+      let previousRevision: IRevisionHasId | null;
       try {
         const {
           grant, userRelatedGrantUserGroupIds, overwriteScopesOfDescendants, wip,
@@ -168,7 +169,7 @@ export const updatePageHandlersFactory: UpdatePageHandlersFactory = (crowi) => {
           options.grant = grant;
           options.userRelatedGrantUserGroupIds = userRelatedGrantUserGroupIds;
         }
-        const previousRevision = await Revision.findById(revisionId);
+        previousRevision = await Revision.findById<IRevisionHasId>(revisionId);
         updatedPage = await crowi.pageService.updatePage(currentPage, body, previousRevision?.body ?? null, req.user, options);
       }
       catch (err) {
@@ -183,7 +184,7 @@ export const updatePageHandlersFactory: UpdatePageHandlersFactory = (crowi) => {
 
       res.apiv3(result, 201);
 
-      postAction(req, res, updatedPage);
+      postAction(req, res, updatedPage, previousRevision);
     },
   ];
 };
diff --git a/apps/app/src/server/service/user-notification/index.ts b/apps/app/src/server/service/user-notification/index.ts
index af71f3b7f12..bf152370e37 100644
--- a/apps/app/src/server/service/user-notification/index.ts
+++ b/apps/app/src/server/service/user-notification/index.ts
@@ -1,3 +1,5 @@
+import type { IRevisionHasId } from '@growi/core';
+
 import { toArrayFromCsv } from '~/utils/to-array-from-csv';
 
 
@@ -27,11 +29,11 @@ export class UserNotificationService {
    * @param {User} user
    * @param {string} slackChannelsStr comma separated string. e.g. 'general,channel1,channel2'
    * @param {string} mode 'create' or 'update' or 'comment'
-   * @param {string} previousRevision
+   * @param {IRevisionHasId} previousRevision
    * @param {Comment} comment
    */
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  async fire(page, user, slackChannelsStr, mode, option?: { previousRevision: string }, comment = {}): Promise<PromiseSettledResult<any>[]> {
+  async fire(page, user, slackChannelsStr, mode, option?: { previousRevision: IRevisionHasId }, comment = {}): Promise<PromiseSettledResult<any>[]> {
     const {
       appService, slackIntegrationService,
     } = this.crowi;

From 5c6c4f94cd20194f38b671c2409aa904fa2107b9 Mon Sep 17 00:00:00 2001
From: Shun Miyazawa <m0zurillex@gmail.com>
Date: Tue, 28 May 2024 00:05:12 +0000
Subject: [PATCH 4/8] Add jsdoc for prepareAttachmentTextForUpdate()

---
 apps/app/src/server/util/slack.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/apps/app/src/server/util/slack.js b/apps/app/src/server/util/slack.js
index d1828574d9a..0684f723db1 100644
--- a/apps/app/src/server/util/slack.js
+++ b/apps/app/src/server/util/slack.js
@@ -24,6 +24,12 @@ const prepareAttachmentTextForCreate = function(page, siteUrl) {
   return convertMarkdownToMarkdown(body, siteUrl);
 };
 
+/**
+ * Return diff with latest revisionBody
+ * @param {IPageHasId} page
+ * @param {string} siteUrl
+ * @param {IRevisionHasId} previousRevision
+ */
 const prepareAttachmentTextForUpdate = function(page, siteUrl, previousRevision) {
   if (previousRevision == null) {
     return;

From 73840a5cbe918a3688a5fd43965e1cef6f990675 Mon Sep 17 00:00:00 2001
From: Shun Miyazawa <m0zurillex@gmail.com>
Date: Tue, 28 May 2024 00:15:59 +0000
Subject: [PATCH 5/8] rm unnecessary

---
 apps/app/src/server/routes/apiv3/page/update-page.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/app/src/server/routes/apiv3/page/update-page.ts b/apps/app/src/server/routes/apiv3/page/update-page.ts
index cce786ae94a..543991e6a94 100644
--- a/apps/app/src/server/routes/apiv3/page/update-page.ts
+++ b/apps/app/src/server/routes/apiv3/page/update-page.ts
@@ -169,7 +169,7 @@ export const updatePageHandlersFactory: UpdatePageHandlersFactory = (crowi) => {
           options.grant = grant;
           options.userRelatedGrantUserGroupIds = userRelatedGrantUserGroupIds;
         }
-        previousRevision = await Revision.findById<IRevisionHasId>(revisionId);
+        previousRevision = await Revision.findById(revisionId);
         updatedPage = await crowi.pageService.updatePage(currentPage, body, previousRevision?.body ?? null, req.user, options);
       }
       catch (err) {

From c4510d956507d6a0e92ae9ea3b356da044d705ae Mon Sep 17 00:00:00 2001
From: Shun Miyazawa <m0zurillex@gmail.com>
Date: Tue, 28 May 2024 00:29:03 +0000
Subject: [PATCH 6/8] Update validation

---
 apps/app/src/server/routes/apiv3/page/update-page.ts | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/apps/app/src/server/routes/apiv3/page/update-page.ts b/apps/app/src/server/routes/apiv3/page/update-page.ts
index 543991e6a94..f5c8337a59b 100644
--- a/apps/app/src/server/routes/apiv3/page/update-page.ts
+++ b/apps/app/src/server/routes/apiv3/page/update-page.ts
@@ -65,9 +65,7 @@ export const updatePageHandlersFactory: UpdatePageHandlersFactory = (crowi) => {
   const validator: ValidationChain[] = [
     body('pageId').exists().not().isEmpty({ ignore_whitespace: true })
       .withMessage("'pageId' must be specified"),
-    body('revisionId').optional().exists().not()
-      .isEmpty({ ignore_whitespace: true })
-      .withMessage("'revisionId' must be specified"),
+    body('revisionId').optional().isMongoId().withMessage("'revisionId' must be mongoId"),
     body('body').exists().isString()
       .withMessage("The empty value is not allowd for the 'body'"),
     body('grant').optional().isInt({ min: 0, max: 5 }).withMessage('grant must be integer from 1 to 5'),

From 1bf99bd6fa31015627a1e5cc3259cf135f6a0b7a Mon Sep 17 00:00:00 2001
From: Shun Miyazawa <m0zurillex@gmail.com>
Date: Tue, 28 May 2024 00:36:35 +0000
Subject: [PATCH 7/8] Revert "Update validation"

This reverts commit c4510d956507d6a0e92ae9ea3b356da044d705ae.
---
 apps/app/src/server/routes/apiv3/page/update-page.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/apps/app/src/server/routes/apiv3/page/update-page.ts b/apps/app/src/server/routes/apiv3/page/update-page.ts
index f5c8337a59b..543991e6a94 100644
--- a/apps/app/src/server/routes/apiv3/page/update-page.ts
+++ b/apps/app/src/server/routes/apiv3/page/update-page.ts
@@ -65,7 +65,9 @@ export const updatePageHandlersFactory: UpdatePageHandlersFactory = (crowi) => {
   const validator: ValidationChain[] = [
     body('pageId').exists().not().isEmpty({ ignore_whitespace: true })
       .withMessage("'pageId' must be specified"),
-    body('revisionId').optional().isMongoId().withMessage("'revisionId' must be mongoId"),
+    body('revisionId').optional().exists().not()
+      .isEmpty({ ignore_whitespace: true })
+      .withMessage("'revisionId' must be specified"),
     body('body').exists().isString()
       .withMessage("The empty value is not allowd for the 'body'"),
     body('grant').optional().isInt({ min: 0, max: 5 }).withMessage('grant must be integer from 1 to 5'),

From 1ffb8175d3f9271c4264bb7b02a0eef90a00c52d Mon Sep 17 00:00:00 2001
From: Shun Miyazawa <m0zurillex@gmail.com>
Date: Tue, 28 May 2024 00:55:57 +0000
Subject: [PATCH 8/8] Prevent xss

---
 apps/app/src/server/routes/apiv3/page/update-page.ts | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/apps/app/src/server/routes/apiv3/page/update-page.ts b/apps/app/src/server/routes/apiv3/page/update-page.ts
index 543991e6a94..1ac24005515 100644
--- a/apps/app/src/server/routes/apiv3/page/update-page.ts
+++ b/apps/app/src/server/routes/apiv3/page/update-page.ts
@@ -138,6 +138,8 @@ export const updatePageHandlersFactory: UpdatePageHandlersFactory = (crowi) => {
         pageId, revisionId, body, origin,
       } = req.body;
 
+      const sanitizeRevisionId = revisionId == null ? undefined : xss.process(revisionId);
+
       // check page existence
       const isExist = await Page.count({ _id: pageId }) > 0;
       if (!isExist) {
@@ -147,7 +149,7 @@ export const updatePageHandlersFactory: UpdatePageHandlersFactory = (crowi) => {
       // check revision
       const currentPage = await Page.findByIdAndViewer(pageId, req.user);
 
-      if (currentPage != null && !await currentPage.isUpdatable(revisionId, origin)) {
+      if (currentPage != null && !await currentPage.isUpdatable(sanitizeRevisionId, origin)) {
         const latestRevision = await Revision.findById(currentPage.revision).populate('author');
         const returnLatestRevision = {
           revisionId: latestRevision?._id.toString(),
@@ -169,7 +171,7 @@ export const updatePageHandlersFactory: UpdatePageHandlersFactory = (crowi) => {
           options.grant = grant;
           options.userRelatedGrantUserGroupIds = userRelatedGrantUserGroupIds;
         }
-        previousRevision = await Revision.findById(revisionId);
+        previousRevision = await Revision.findById(sanitizeRevisionId);
         updatedPage = await crowi.pageService.updatePage(currentPage, body, previousRevision?.body ?? null, req.user, options);
       }
       catch (err) {