Server: make friends urls come from the request instead of the

[github/Chocobozzz/PeerTube.git] / server / controllers / api / v1 / pods.js

diff --git a/server/controllers/api/v1/pods.js b/server/controllers/api/v1/pods.js
index 2bc761fef4348c93673c4b4b903e3564ca9c7779..982a1e3647066381ad7ffe519884adc41b4f2419 100644 (file)
--- a/server/controllers/api/v1/pods.js
+++ b/server/controllers/api/v1/pods.js
@@ -8,6 +8,7 @@ const waterfall = require('async/waterfall')
 const logger = require('../../../helpers/logger')
 const friends = require('../../../lib/friends')
 const middlewares = require('../../../middlewares')
+const admin = middlewares.admin
 const oAuth = middlewares.oauth
 const validators = middlewares.validators.pods
 const signatureValidator = middlewares.validators.remote.signature
@@ -18,8 +19,17 @@ const Video = mongoose.model('Video')
 
 router.get('/', listPodsUrl)
 router.post('/', validators.podsAdd, addPods)
-router.get('/makefriends', oAuth.authenticate, validators.makeFriends, makeFriends)
-router.get('/quitfriends', oAuth.authenticate, quitFriends)
+router.post('/makefriends',
+  oAuth.authenticate,
+  admin.ensureIsAdmin,
+  validators.makeFriends,
+  makeFriends
+)
+router.get('/quitfriends',
+  oAuth.authenticate,
+  admin.ensureIsAdmin,
+  quitFriends
+)
 // Post because this is a secured request
 router.post('/remove', signatureValidator, removePods)
 
@@ -73,7 +83,9 @@ function listPodsUrl (req, res, next) {
 }
 
 function makeFriends (req, res, next) {
-  friends.makeFriends(function (err) {
+  const urls = req.body.urls
+
+  friends.makeFriends(urls, function (err) {
     if (err) return next(err)
 
     res.type('json').status(204).end()