fix: #7519

src/socket.io/user.js

@@ -337,7 +337,11 @@ SocketUser.setModerationNote = function (socket, data, callback) {
 	if (!socket.uid || !data || !data.uid || !data.note) {
 		return callback(new Error('[[error:invalid-data]]'));
 	}
-
+	const noteData = {
+		uid: socket.uid,
+		note: data.note,
+		timestamp: Date.now(),
+	};
 	async.waterfall([
 		function (next) {
 			privileges.users.canEdit(socket.uid, data.uid, next);
@@ -354,12 +358,10 @@ SocketUser.setModerationNote = function (socket, data, callback) {
 				return next(new Error('[[error:no-privileges]]'));
 			}
 
-			var note = {
+			db.sortedSetAdd('uid:' + data.uid + ':moderation:notes', noteData.timestamp, noteData.timestamp, next);
-				uid: socket.uid,
+		},
-				note: data.note,
+		function (next) {
-				timestamp: Date.now(),
+			db.setObject('uid:' + data.uid + ':moderation:note:' + noteData.timestamp, noteData, next);
-			};
-			db.sortedSetAdd('uid:' + data.uid + ':moderation:notes', note.timestamp, JSON.stringify(note), next);
 		},
 	], callback);
 };

src/upgrades/1.12.1/moderation_notes_refactor.js

@@ -0,0 +1,54 @@
+'use strict';
+
+var async = require('async');
+var db = require('../../database');
+var batch = require('../../batch');
+
+
+module.exports = {
+	name: 'Update moderation notes to hashes',
+	timestamp: Date.UTC(2018, 3, 5),
+	method: function (callback) {
+		var progress = this.progress;
+
+		batch.processSortedSet('users:joindate', function (ids, next) {
+			async.each(ids, function (uid, next) {
+				progress.incr();
+				db.getSortedSetRevRange('uid:' + uid + ':moderation:notes', 0, -1, function (err, notes) {
+					if (err || !notes.length) {
+						return next(err);
+					}
+
+					async.eachSeries(notes, function (note, next) {
+						var noteData;
+						async.waterfall([
+							function (next) {
+								try {
+									noteData = JSON.parse(note);
+									setImmediate(next);
+								} catch (err) {
+									next(err);
+								}
+							},
+							function (next) {
+								db.sortedSetRemove('uid:' + uid + ':moderation:notes', note, next);
+							},
+							function (next) {
+								db.setObject('uid:' + uid + ':moderation:note:' + noteData.timestamp, {
+									uid: noteData.uid,
+									timestamp: noteData.timestamp,
+									note: noteData.note,
+								}, next);
+							},
+							function (next) {
+								db.sortedSetAdd('uid:' + uid + ':moderation:notes', noteData.timestamp, noteData.timestamp, next);
+							},
+						], next);
+					}, next);
+				});
+			}, next);
+		}, {
+			progress: this.progress,
+		}, callback);
+	},
+};

src/user/info.js

@@ -158,18 +158,19 @@ module.exports = function (User) {
 			function (next) {
 				db.getSortedSetRevRange('uid:' + uid + ':moderation:notes', start, stop, next);
 			},
+			function (noteIds, next) {
+				const keys = noteIds.map(id => 'uid:' + uid + ':moderation:note:' + id);
+				db.getObjects(keys, next);
+			},
 			function (notes, next) {
 				var uids = [];
 				noteData = notes.map(function (note) {
-					try {
+					if (note) {
-						var data = JSON.parse(note);
+						uids.push(note.uid);
-						uids.push(data.uid);
+						note.timestampISO = utils.toISOString(note.timestamp);
-						data.timestampISO = utils.toISOString(data.timestamp);
+						note.note = validator.escape(String(note.note));
-						data.note = validator.escape(String(data.note));
-						return data;
-					} catch (err) {
-						return next(err);
 					}
+					return note;
 				});
 
 				User.getUsersFields(uids, ['uid', 'username', 'userslug', 'picture'], next);