Server: forbid to remove the root user

[github/Chocobozzz/PeerTube.git] / server / middlewares / validators / users.js

diff --git a/server/middlewares/validators/users.js b/server/middlewares/validators/users.js
index 175d90bcb132b585857f8986b6762bfd4cb0d73c..02e4f34cba4fd2072a14452397d044e320917b16 100644 (file)
--- a/server/middlewares/validators/users.js
+++ b/server/middlewares/validators/users.js
@@ -8,29 +8,38 @@ const logger = require('../../helpers/logger')
 const User = mongoose.model('User')
 
 const validatorsUsers = {
-  usersAdd: usersAdd,
-  usersRemove: usersRemove,
-  usersUpdate: usersUpdate
+  usersAdd,
+  usersRemove,
+  usersUpdate
 }
 
 function usersAdd (req, res, next) {
   req.checkBody('username', 'Should have a valid username').isUserUsernameValid()
   req.checkBody('password', 'Should have a valid password').isUserPasswordValid()
 
-  // TODO: check we don't have already the same username
-
   logger.debug('Checking usersAdd parameters', { parameters: req.body })
 
-  checkErrors(req, res, next)
+  checkErrors(req, res, function () {
+    User.loadByUsername(req.body.username, function (err, user) {
+      if (err) {
+        logger.error('Error in usersAdd request validator.', { error: err })
+        return res.sendStatus(500)
+      }
+
+      if (user) return res.status(409).send('User already exists.')
+
+      next()
+    })
+  })
 }
 
 function usersRemove (req, res, next) {
-  req.checkParams('username', 'Should have a valid username').isUserUsernameValid()
+  req.checkParams('id', 'Should have a valid id').notEmpty().isMongoId()
 
   logger.debug('Checking usersRemove parameters', { parameters: req.params })
 
   checkErrors(req, res, function () {
-    User.loadByUsername(req.params.username, function (err, user) {
+    User.loadById(req.params.id, function (err, user) {
       if (err) {
         logger.error('Error in usersRemove request validator.', { error: err })
         return res.sendStatus(500)
@@ -38,12 +47,15 @@ function usersRemove (req, res, next) {
 
       if (!user) return res.status(404).send('User not found')
 
+      if (user.username === 'root') return res.status(400).send('Cannot remove the root user')
+
       next()
     })
   })
 }
 
 function usersUpdate (req, res, next) {
+  req.checkParams('id', 'Should have a valid id').notEmpty().isMongoId()
   // Add old password verification
   req.checkBody('password', 'Should have a valid password').isUserPasswordValid()