* remove moderationRepo from commentHandler

* add msg to prevent users to set their email address public
* prevent header injection

Author: eltouma

src/comment_handler.go

@@ -14,16 +14,14 @@ type CommentHandler struct {
 	recordRepo          RecordRepository
 	adminRepo           AdminRepository
 	notificationService *NotificationService
-	moderationRepo      ModerationRepository
 }
 
-func NewCommentHandler(commentRepo CommentRepository, recordRepo RecordRepository, adminRepo AdminRepository, notificationService *NotificationService, moderationRepo ModerationRepository) *CommentHandler {
+func NewCommentHandler(commentRepo CommentRepository, recordRepo RecordRepository, adminRepo AdminRepository, notificationService *NotificationService) *CommentHandler {
 	return &CommentHandler{
 		commentRepo:         commentRepo,
 		recordRepo:          recordRepo,
 		adminRepo:           adminRepo,
 		notificationService: notificationService,
-		moderationRepo:      moderationRepo,
 	}
 }
 

src/email_sender.go

@@ -5,6 +5,7 @@ import (
 	"net"
 	"net/smtp"
 	"os"
+    "strings"
 )
 
 type EmailSender struct {
@@ -26,13 +27,17 @@ func NewEmailSender() *EmailSender {
 }
 
 func (e *EmailSender) Send(to string, subject string, body string) error {
+    // Sanitize 'to' to prevent header injection
+    if strings.ContainsAny(to, "\r\n") {
+        return fmt.Errorf("email sender: recipient address contains invalid CRLF characters")
+    }
 	var smtpAddr = net.JoinHostPort(e.smtpHost, e.smtpPort)
 
 	auth := smtp.PlainAuth("", e.smtpUsername, e.smtpPassword, e.smtpHost)
 	recipients := []string{to}
 	msg := []byte(
 		"From: " + e.smtpFromAddress + "\r\n" +
-			"To: " + to + "\r\n" +
+			"To: " + to +
 			"Subject: " + subject + "\r\n" +
 			"MIME-Version: 1.0\r\n" +
 			"Content-Type: text/plain; charset=\"UTF-8\"\r\n" +

src/main.go

@@ -477,7 +477,7 @@ func main() {
 	emailWorker := NewEmailWorker(emailQueueRepo, emailSender, orcidService)
 	moderationRepo := NewPostgresModerationRepository(db, categoryRepo, rorRepo)
 	moderationHandler := NewModerationHandler(moderationRepo, adminRepo, notificationService, recordRepo)
-	commentHandler := NewCommentHandler(commentRepo, recordRepo, adminRepo, notificationService, moderationRepo)
+	commentHandler := NewCommentHandler(commentRepo, recordRepo, adminRepo, notificationService)
 
 	// Initialize ROR handler with name cache
 	rorHandler := NewRorHandler()

src/record_repository.go

@@ -1097,8 +1097,8 @@ func (r *PostgresRecordRepository) IncrementDownloadCount(ctx context.Context, i
 func (r *PostgresRecordRepository) GetOwnerOrcid(ctx context.Context, recordID string) (string, error) {
 	var uploaderOrcid string
 	err := r.db.QueryRowContext(ctx, "SELECT uploader_orcid FROM records WHERE id = $1", recordID).Scan(&uploaderOrcid)
-	if err != nil {
-		return "", err
+	if err == sql.ErrNoRows {
+		return "", ErrRecordNotFound
 	}
 	return uploaderOrcid, nil
 }

src/sql/014_add_email_queue.up.sql

@@ -1,7 +1,7 @@
 -- Queue of email notifications to be sent for record and comment moderation events
 CREATE TABLE IF NOT EXISTS email_queue (
     id INTEGER       GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
-    record_id UUID NOT NULL REFERENCES records(id),
+    record_id UUID NOT NULL REFERENCES records(id) ON DELETE CASCADE,
     comment_id BIGINT REFERENCES comments(id) ON DELETE SET NULL,
     recipient_orcid orcid_type NOT NULL,
     subject TEXT NOT NULL,

src/templates/browse.html

@@ -2,7 +2,7 @@
 
 {{ define "content" }}
 <div class="mt-4 alert alert-info alert-dismissible" role="alert">
-  Welcome to the template sharing site, this is still in <b>Beta mode</b>. For more informations, please see the <a href="/about">About</a> page.<br>Thank you for helping us to test so that we can open the site.
+  Welcome to the template sharing site, this is still in <b>Beta mode</b>. For more informations, please see the <a href="/about">About</a> page.<br>Please note that we does not store your email address. To receive notifications, please make sure your email address is set as <b>public</b> on orcid.org<br><br>Thank you for helping us to test so that we can open the site.
 </div>
 <div class="row">
 <h2 class="col-md-12">Browse entries</h2>