- // Video is not private, anyone can access it
- if (video.privacy !== VideoPrivacy.PRIVATE) return next()
+ // Video is public, anyone can access it
+ if (video.privacy === VideoPrivacy.PUBLIC) return next()
+
+ // Video is unlisted, check we used the uuid to fetch it
+ if (video.privacy === VideoPrivacy.UNLISTED) {
+ if (isUUIDValid(req.params.id)) return next()
+
+ // Don't leak this unlisted video
+ return res.status(404).end()
+ }