]> git.immae.eu Git - github/Chocobozzz/PeerTube.git/blob - server/middlewares/validators/shared/accounts.ts
Don't inject untrusted input
[github/Chocobozzz/PeerTube.git] / server / middlewares / validators / shared / accounts.ts
1 import { Response } from 'express'
2 import { AccountModel } from '@server/models/account/account'
3 import { UserModel } from '@server/models/user/user'
4 import { MAccountDefault } from '@server/types/models'
5 import { forceNumber } from '@shared/core-utils'
6 import { HttpStatusCode } from '@shared/models'
7
8 function doesAccountIdExist (id: number | string, res: Response, sendNotFound = true) {
9 const promise = AccountModel.load(forceNumber(id))
10
11 return doesAccountExist(promise, res, sendNotFound)
12 }
13
14 function doesLocalAccountNameExist (name: string, res: Response, sendNotFound = true) {
15 const promise = AccountModel.loadLocalByName(name)
16
17 return doesAccountExist(promise, res, sendNotFound)
18 }
19
20 function doesAccountNameWithHostExist (nameWithDomain: string, res: Response, sendNotFound = true) {
21 const promise = AccountModel.loadByNameWithHost(nameWithDomain)
22
23 return doesAccountExist(promise, res, sendNotFound)
24 }
25
26 async function doesAccountExist (p: Promise<MAccountDefault>, res: Response, sendNotFound: boolean) {
27 const account = await p
28
29 if (!account) {
30 if (sendNotFound === true) {
31 res.fail({
32 status: HttpStatusCode.NOT_FOUND_404,
33 message: 'Account not found'
34 })
35 }
36 return false
37 }
38
39 res.locals.account = account
40 return true
41 }
42
43 async function doesUserFeedTokenCorrespond (id: number, token: string, res: Response) {
44 const user = await UserModel.loadByIdWithChannels(forceNumber(id))
45
46 if (token !== user.feedToken) {
47 res.fail({
48 status: HttpStatusCode.FORBIDDEN_403,
49 message: 'User and token mismatch'
50 })
51 return false
52 }
53
54 res.locals.user = user
55 return true
56 }
57
58 // ---------------------------------------------------------------------------
59
60 export {
61 doesAccountIdExist,
62 doesLocalAccountNameExist,
63 doesAccountNameWithHostExist,
64 doesAccountExist,
65 doesUserFeedTokenCorrespond
66 }