Fix #927 - Clean up federation code after Elrond's review

- Add json_error and use inplace of json_response where appropriate.
- Add garbage_collection to config spec file.
- Fix bugs in both garbage collection task and test
- Handle /api/whoami when no user logged in and a test for such a case.
- Validate ID is correct and user has comment privilege to comment.

1 files changed, 11 insertions, 1 deletions

diff --git a/mediagoblin/db/models.py b/mediagoblin/db/models.py
index c6424e71..b3f7e23d 100644
--- a/mediagoblin/db/models.py
+++ b/mediagoblin/db/models.py
@@ -683,8 +683,18 @@ class MediaComment(Base, MediaCommentMixin):
         # Validate inReplyTo has ID
         if "id" not in data["inReplyTo"]:
             return False
+            
+        # Validate that the ID is correct
+        try:
+            media_id = int(data["inReplyTo"]["id"])
+        except ValueError:
+            return False
+        
+        media = MediaEntry.query.filter_by(id=media_id).first()
+        if media is None:
+            return False
 
-        self.media_entry = data["inReplyTo"]["id"]
+        self.media_entry = media.id
         self.content = data["content"]
         return True