prevent moving a category into one of its own descendants (#2355)

commafeed-client/src/pages/app/CategoryDetailsPage.tsx

@@ -37,6 +37,9 @@ export function CategoryDetailsPage() {
         category = query.result && flattenCategoryTree(query.result.data).find(c => c.id === id)
     }
 
+    // a category cannot be moved under itself or one of its own descendants
+    const excludedCategoryIds = category ? flattenCategoryTree(category).map(c => c.id) : [id]
+
     const form = useForm<CategoryModificationRequest>()
     const { setValues } = form
 
@@ -125,7 +128,7 @@ export function CategoryDetailsPage() {
                                 label={<Trans>Parent Category</Trans>}
                                 {...form.getInputProps("parentId")}
                                 clearable
-                                withoutCategoryIds={[id]}
+                                withoutCategoryIds={excludedCategoryIds}
                             />
                             <NumberInput label={<Trans>Position</Trans>} {...form.getInputProps("position")} required min={0} />
                         </>

commafeed-server/src/main/java/com/commafeed/frontend/resource/CategoryREST.java

@@ -435,6 +435,19 @@ public class CategoryREST {
                 && !Strings.CS.equals(req.getParentId(), String.valueOf(req.getId()))) {
             parent = feedCategoryDAO.findById(user, Long.valueOf(req.getParentId()));
         }
+        if (parent != null) {
+            Long parentId = parent.getId();
+            List<FeedCategory> descendants =
+                    feedCategoryDAO.findAllChildrenCategories(user, category);
+            boolean parentIsDescendant =
+                    descendants.stream().anyMatch(c -> c.getId().equals(parentId));
+            if (parentIsDescendant) {
+                return Response.status(Status.BAD_REQUEST)
+                        .entity(
+                                "<message>cannot set a category's own descendant as its parent</message>")
+                        .build();
+            }
+        }
         category.setParent(parent);
 
         if (req.getPosition() != null) {